FedRAMP Moderate control library
Every control CMDash tracks for FedRAMP Moderate, in the order the standard itself uses. Each one is a row in the product with an owner, a status, evidence and its own history — this page is the public index of what those rows are.
328 controls19 families56 mapped to other frameworks326 with authoritative text
Families
Access Control · 45Audit & Accountability · 20Assessment & Authorization · 14Configuration Management · 25Contingency Planning · 24Identification & Authentication · 22Incident Response · 17Risk Assessment · 9System & Communications Protection · 27System & Information Integrity · 23Awareness & Training · 6Maintenance · 10Media Protection · 9Physical & Environmental · 18Planning · 7Personnel Security · 9System & Services Acquisition · 16Supply Chain Risk Management · 12Program Management · 15
Access Control · 45
Audit & Accountability · 20
Configuration Management · 25
Contingency Planning · 24
Identification & Authentication · 22
Incident Response · 17
| IR-1 | Policy and procedures |
| IR-2 | Incident response training |
| IR-3 | Incident response testing Maps to HITRUST CSF v11 |
| IR-4 | Incident handling Maps to HITRUST CSF v11, NIST Cybersecurity Framework (1.1, legacy), TISAX (VDA ISA v6) |
| IR-5 | Incident monitoring |
| IR-6 | Incident reporting Maps to HITRUST CSF v11, NIST Cybersecurity Framework (1.1, legacy) |
| IR-7 | Incident response assistance |
| IR-8 | Incident response plan |
| IR-2(1) | IR training | simulated events |
| IR-2(2) | IR training | automated training environments |
| IR-3(2) | IR testing | coordination with related plans |
| IR-4(1) | Incident handling | automated incident handling processes |
| IR-4(4) | Incident handling | information correlation |
| IR-6(1) | Incident reporting | automated reporting |
| IR-7(1) | IR assistance | automation support |
| IR-8(1) | IR plan | breach |
| IR-4(3) | Incident handling | continuity of operations |
Risk Assessment · 9
| RA-1 | Policy and procedures |
| RA-2 | Security categorization Maps to HITRUST CSF v11 |
| RA-3 | Risk assessment Maps to HITRUST CSF v11, NIST Cybersecurity Framework (1.1, legacy), TISAX (VDA ISA v6) |
| RA-5 | Vulnerability monitoring and scanning Maps to HITRUST CSF v11, NIST Cybersecurity Framework (1.1, legacy), TISAX (VDA ISA v6) |
| RA-5(2) | Vulnerability monitoring | update vulnerabilities to be scanned |
| RA-5(5) | Vulnerability monitoring | privileged access |
| RA-5(11) | Vulnerability monitoring | public disclosure program |
| RA-7 | Risk response |
| RA-9 | Criticality analysis |
System & Communications Protection · 27
System & Information Integrity · 23
Awareness & Training · 6
| AT-1 | Policy and procedures |
| AT-2 | Literacy training and awareness Maps to HITRUST CSF v11, TISAX (VDA ISA v6) |
| AT-2(2) | Literacy training | insider threat |
| AT-2(3) | Literacy training | social engineering and mining |
| AT-3 | Role-based training |
| AT-4 | Training records |
Maintenance · 10
| MA-1 | Policy and procedures |
| MA-2 | Controlled maintenance |
| MA-3 | Maintenance tools |
| MA-3(1) | Maintenance tools | inspect tools |
| MA-3(2) | Maintenance tools | inspect media |
| MA-3(3) | Maintenance tools | prevent unauthorized removal |
| MA-4 | Nonlocal maintenance Maps to HITRUST CSF v11 |
| MA-5 | Maintenance personnel |
| MA-5(1) | Maintenance personnel | individuals without appropriate access |
| MA-6 | Timely maintenance |
Media Protection · 9
| MP-1 | Policy and procedures |
| MP-2 | Media access |
| MP-3 | Media marking |
| MP-4 | Media storage |
| MP-5 | Media transport |
| MP-6 | Media sanitization Maps to HITRUST CSF v11 |
| MP-6(1) | Media sanitization | review, approve, track, document, and verify |
| MP-6(2) | Media sanitization | equipment testing |
| MP-7 | Media use |
Physical & Environmental · 18
| PE-1 | Policy and procedures |
| PE-2 | Physical access authorizations |
| PE-3 | Physical access control Maps to HITRUST CSF v11, TISAX (VDA ISA v6) |
| PE-4 | Access control for transmission |
| PE-5 | Access control for output devices |
| PE-6 | Monitoring physical access |
| PE-6(1) | Monitoring physical access | intrusion alarms and surveillance equipment |
| PE-8 | Visitor access records |
| PE-9 | Power equipment and cabling |
| PE-10 | Emergency shutoff |
| PE-11 | Emergency power Maps to HITRUST CSF v11 |
| PE-12 | Emergency lighting |
| PE-13 | Fire protection Maps to HITRUST CSF v11 |
| PE-13(1) | Fire protection | detection systems – automatic activation and notification |
| PE-14 | Environmental controls |
| PE-15 | Water damage protection |
| PE-16 | Delivery and removal |
| PE-17 | Alternate work site |
Planning · 7
| PL-1 | Policy and procedures Maps to HITRUST CSF v11, TISAX (VDA ISA v6) |
| PL-2 | System security and privacy plans |
| PL-4 | Rules of behavior |
| PL-4(1) | Rules of behavior | social media and external site/application usage restrictions |
| PL-8 | Security and privacy architectures |
| PL-10 | Baseline selection |
| PL-11 | Baseline tailoring |
Personnel Security · 9
| PS-1 | Policy and procedures |
| PS-2 | Position risk designation |
| PS-3 | Personnel screening Maps to HITRUST CSF v11, TISAX (VDA ISA v6) |
| PS-4 | Personnel termination Maps to HITRUST CSF v11 |
| PS-5 | Personnel transfer |
| PS-6 | Access agreements Maps to HITRUST CSF v11 |
| PS-7 | External personnel security |
| PS-8 | Personnel sanctions |
| PS-9 | Position descriptions |
System & Services Acquisition · 16
Supply Chain Risk Management · 12
Program Management · 15
| PM-1 | Information security program plan Maps to HITRUST CSF v11 |
| PM-2 | Information security program leadership role Maps to HITRUST CSF v11 |
| PM-3 | Information security and privacy resources |
| PM-4 | Plan of action and milestones process |
| PM-5 | System inventory |
| PM-6 | Measures of performance |
| PM-7 | Enterprise architecture |
| PM-8 | Critical infrastructure plan |
| PM-9 | Risk management strategy |
| PM-10 | Authorization process Maps to TISAX (VDA ISA v6) |
| PM-11 | Mission and business process definition |
| PM-12 | Insider threat program |
| PM-14 | Testing, training, and monitoring |
| PM-15 | Security and privacy groups and associations |
| PM-16 | Threat awareness program |
Where this comes from
Control identifiers, families and titles are the rows CMDash’s own seed data writes for FedRAMP Moderate Rev 5, published from a build-time export rather than read from any customer’s workspace. Control text is quoted verbatim from NIST SP 800-53 Rev 5 (OSCAL catalog), which is in the public domain. Cross-framework mappings are CMDash’s own, and each one is shown on both frameworks it connects.
Track these controls in CMDash
Every control on this page becomes a row with an owner, a status, evidence and an audit trail — with the crosswalks already wired, so evidence mapped once counts in more than one framework.