FedRAMP Security Controls

FedRAMP security controls are based on NIST SP 800-53, the government's comprehensive catalog of security and privacy controls. FedRAMP selects controls from this catalog based on impact level and adds FedRAMP-specific parameters and requirements. Understanding these controls is essential for successful authorization.

Control Families

NIST 800-53 organizes controls into 20 families. The most significant for FedRAMP include:

Access Control (AC) covers account management, access enforcement, separation of duties, least privilege, session controls, and remote access. This is one of the largest control families and a frequent source of assessment findings.

Audit and Accountability (AU) requires comprehensive logging, log protection, audit review and reporting, and log retention. FedRAMP has specific requirements for log content and retention periods.

Configuration Management (CM) addresses baseline configurations, configuration change control, security impact analysis, and least functionality. Maintaining hardened, documented configurations across all system components is essential.

Incident Response (IR) requires incident response planning, training, testing, monitoring, and reporting. FedRAMP requires specific incident reporting timelines to US-CERT.

System and Communications Protection (SC) covers boundary protection, cryptographic protections, network segmentation, and transmission confidentiality. FIPS 140-2 validated cryptographic modules are required.

FedRAMP-Specific Requirements

FedRAMP adds requirements beyond base NIST 800-53 controls. These include specific encryption standards (FIPS 140-2 at minimum), incident reporting to US-CERT within specified timeframes, data location requirements (data must reside within the US for Moderate and High), and continuous monitoring reporting requirements.

The System Security Plan

The SSP is the central document of your FedRAMP authorization package. It describes every control, how it is implemented, who is responsible, and what evidence supports it. For Moderate impact, the SSP typically runs 300 to 500 pages. Invest in thorough, accurate documentation — the 3PAO and authorizing official rely heavily on the SSP.

Implementation Strategy

Start with the controls that are hardest to implement — access control, configuration management, and continuous monitoring infrastructure. Leverage existing certifications (SOC 2, ISO 27001) as a foundation. Use FedRAMP automation tools and templates to reduce documentation effort.

In the next lesson, we will cover continuous monitoring requirements.