FedRAMP assesses NIST SP 800-53 controls. Configuration change control asks that changes are reviewed, approved and documented, and that only authorised people can make them.
Today the FedRAMP Moderate blueprint gives code evidence for fourteen controls. From v1.4.0, change records give evidence for CM-3 Configuration Change Control and SA-10 Developer Configuration Management, with supporting evidence for separation of duties, access restrictions for change and integrity.
Toevan gives evidence for controls; it never certifies them or claims a framework is covered. Whether the evidence is sufficient is your auditor’s judgement.
Live14
Code evidence today, sealed on every pull request. Always partial: the control also asks for things outside code. Code evidence today: rules in the FedRAMP Moderate blueprint check part of this on every pull request.
AC-2Account Management
AC Access Control
AC-3Access Enforcement
AC Access Control
AC-4Information Flow Enforcement
AC Access Control
AC-6Least Privilege
AC Access Control
AU-2Event Logging
AU Audit and Accountability
AU-12Audit Record Generation
AU Audit and Accountability
CM-2Baseline Configuration
CM Configuration Management
CM-6Configuration Settings
CM Configuration Management
IA-5Authenticator Management
IA Identification and Authentication
SA-11Developer Testing and Evaluation
SA System and Services Acquisition
Strengthened in v1.4.0: the required checks at merge are sealed per change.
SC-7Boundary Protection
SC System and Communications Protection
SC-8Transmission Confidentiality and Integrity
SC System and Communications Protection
SC-28Protection of Information at Rest
SC System and Communications Protection
SI-2Flaw Remediation
SI System and Information Integrity
Coming in v1.4.02
Process evidence: merged pull requests, approvals, required checks, branch protection, rulesets and bypasses, sealed per change.
CM-3Configuration Change Control
CM Configuration Management
Process evidence: every merged pull request is sealed as a change record with its approvals on the final commit, the required checks at merge, who merged it, its signatures and the code verdicts it carried.
SA-10Developer Configuration Management
SA System and Services Acquisition
Process evidence: change records and control changes for the source repository.
Supporting4
Toevan records related evidence, today or in v1.4.0, but the duty is organisational, so it never counts as covered.
AC-5Separation of DutiesComing in v1.4.0
AC Access Control
Separation of duties per change: the author against the approvers, computed from GitHub account ids. The wider duty stays organisational.
AU-6Audit Record Review, Analysis, and Reporting
AU Audit and Accountability
Supporting evidence today: a rule records evidence related to this duty. The duty itself is an operational process.
CM-5Access Restrictions for ChangeComing in v1.4.0
CM Configuration Management
Who may change protected branches, and every bypass, sealed as control changes. Access management itself stays organisational.
SI-7Software, Firmware, and Information IntegrityComing in v1.4.0
SI System and Information Integrity
Commit signature facts on each merged change.
Planned21
Can be evidenced from code or GitHub. The rule or mapping is not built yet.
AC-7Unsuccessful Logon Attempts
AC Access Control
AC-11Device Lock
AC Access Control
AC-12Session Termination
AC Access Control
AC-17Remote Access
AC Access Control
AU-3Content of Audit Records
AU Audit and Accountability
AU-8Time Stamps
AU Audit and Accountability
AU-9Protection of Audit Information
AU Audit and Accountability
AU-11Audit Record Retention
AU Audit and Accountability
CM-7Least Functionality
CM Configuration Management
CP-9System Backup
CP Contingency Planning
IA-2Identification and Authentication (Organizational Users)
IA Identification and Authentication
IA-4Identifier Management
IA Identification and Authentication
IA-6Authentication Feedback
IA Identification and Authentication
IA-8Identification and Authentication (Non-organizational Users)
IA Identification and Authentication
RA-5Vulnerability Monitoring and Scanning
RA Risk Assessment
SC-12Cryptographic Key Establishment and Management
SC System and Communications Protection
SC-13Cryptographic Protection
SC System and Communications Protection
SC-23Session Authenticity
SC System and Communications Protection
SI-10Information Input Validation
SI System and Information Integrity
SI-11Error Handling
SI System and Information Integrity
SI-12Information Management and Retention
SI System and Information Integrity
Your organisation136
Policy, people, physical security, contracts, regulatory procedure, operations or external audit. Your organisation evidences these.
Show all 136 controls
AC Access Control
AC-1Policy and Proceduresorganisational policyAC-8System Use Notificationan operational processAC-14Permitted Actions Without Identification or Authenticationan operational processAC-18Wireless Accessan operational processAC-19Access Control for Mobile Devicesan operational processAC-20Use of External Systemsan operational processAC-21Information Sharingan operational processAC-22Publicly Accessible Contentan operational process
AT Awareness and Training
AT-1Policy and Proceduresorganisational policyAT-2Literacy Training and Awarenesspeople and HRAT-3Role-based Trainingpeople and HRAT-4Training Recordspeople and HR
AU Audit and Accountability
AU-1Policy and Proceduresorganisational policyAU-4Audit Log Storage Capacityan operational processAU-5Response to Audit Logging Process Failuresan operational processAU-7Audit Record Reduction and Report Generationan operational process
CA Assessment, Authorization, and Monitoring
CA-1Policy and Proceduresorganisational policyCA-2Control Assessmentsan external assessmentCA-3Information Exchangean external assessmentCA-5Plan of Action and Milestonesan external assessmentCA-6Authorizationan external assessmentCA-7Continuous Monitoringan external assessmentCA-9Internal System Connectionsan external assessment
CM Configuration Management
CM-1Policy and Proceduresorganisational policyCM-4Impact Analysesan operational processCM-8System Component Inventoryan operational processCM-9Configuration Management Planan operational processCM-10Software Usage Restrictionsan operational processCM-11User-installed Softwarean operational processCM-12Information Locationan operational process
CP Contingency Planning
CP-1Policy and Proceduresorganisational policyCP-2Contingency Planan operational processCP-3Contingency Trainingan operational processCP-4Contingency Plan Testingan operational processCP-6Alternate Storage Sitean operational processCP-7Alternate Processing Sitean operational processCP-8Telecommunications Servicesan operational processCP-10System Recovery and Reconstitutionan operational process
IA Identification and Authentication
IA-1Policy and Proceduresorganisational policyIA-3Device Identification and Authenticationan operational processIA-7Cryptographic Module Authenticationan operational processIA-11Re-authenticationan operational processIA-12Identity Proofingan operational process
IR Incident Response
IR-1Policy and Proceduresorganisational policyIR-2Incident Response Trainingan operational processIR-3Incident Response Testingan operational processIR-4Incident Handlingan operational processIR-5Incident Monitoringan operational processIR-6Incident Reportingan operational processIR-7Incident Response Assistancean operational processIR-8Incident Response Planan operational process
MA Maintenance
MA-1Policy and Proceduresorganisational policyMA-2Controlled Maintenancephysical securityMA-3Maintenance Toolsphysical securityMA-4Nonlocal Maintenancephysical securityMA-5Maintenance Personnelphysical securityMA-6Timely Maintenancephysical security
MP Media Protection
MP-1Policy and Proceduresorganisational policyMP-2Media Accessphysical securityMP-3Media Markingphysical securityMP-4Media Storagephysical securityMP-5Media Transportphysical securityMP-6Media Sanitizationphysical securityMP-7Media Usephysical security
PE Physical and Environmental Protection
PE-1Policy and Proceduresorganisational policyPE-2Physical Access Authorizationsphysical securityPE-3Physical Access Controlphysical securityPE-4Access Control for Transmissionphysical securityPE-5Access Control for Output Devicesphysical securityPE-6Monitoring Physical Accessphysical securityPE-8Visitor Access Recordsphysical securityPE-9Power Equipment and Cablingphysical securityPE-10Emergency Shutoffphysical securityPE-11Emergency Powerphysical securityPE-12Emergency Lightingphysical securityPE-13Fire Protectionphysical securityPE-14Environmental Controlsphysical securityPE-15Water Damage Protectionphysical securityPE-16Delivery and Removalphysical securityPE-17Alternate Work Sitephysical security
PL Planning
PL-1Policy and Proceduresorganisational policyPL-2System Security and Privacy Plansorganisational policyPL-4Rules of Behaviororganisational policyPL-8Security and Privacy Architecturesorganisational policyPL-10Baseline Selectionorganisational policyPL-11Baseline Tailoringorganisational policy
PS Personnel Security
PS-1Policy and Proceduresorganisational policyPS-2Position Risk Designationpeople and HRPS-3Personnel Screeningpeople and HRPS-4Personnel Terminationpeople and HRPS-5Personnel Transferpeople and HRPS-6Access Agreementspeople and HRPS-7External Personnel Securitypeople and HRPS-8Personnel Sanctionspeople and HRPS-9Position Descriptionspeople and HR
RA Risk Assessment
RA-1Policy and Proceduresorganisational policyRA-2Security Categorizationorganisational policyRA-3Risk Assessmentorganisational policyRA-7Risk Responseorganisational policyRA-9Criticality Analysisorganisational policy
SA System and Services Acquisition
SA-1Policy and Proceduresorganisational policySA-2Allocation of Resourcesorganisational policySA-3System Development Life Cycleorganisational policySA-4Acquisition Processcontracts and vendorsSA-5System Documentationorganisational policySA-8Security and Privacy Engineering Principlesorganisational policySA-9External System Servicescontracts and vendorsSA-15Development Process, Standards, and Toolsorganisational policySA-22Unsupported System Componentsorganisational policy
SC System and Communications Protection
SC-1Policy and Proceduresorganisational policySC-2Separation of System and User Functionalityan operational processSC-4Information in Shared System Resourcesan operational processSC-5Denial-of-service Protectionan operational processSC-10Network Disconnectan operational processSC-15Collaborative Computing Devices and Applicationsan operational processSC-17Public Key Infrastructure Certificatesan operational processSC-18Mobile Codean operational processSC-20Secure Name/Address Resolution Service (Authoritative Source)an operational processSC-21Secure Name/Address Resolution Service (Recursive or Caching Resolver)an operational processSC-22Architecture and Provisioning for Name/Address Resolution Servicean operational processSC-39Process Isolationan operational process
SI System and Information Integrity
SI-1Policy and Proceduresorganisational policySI-3Malicious Code Protectionan operational processSI-4System Monitoringan operational processSI-5Security Alerts, Advisories, and Directivesan operational processSI-8Spam Protectionan operational processSI-16Memory Protectionan operational process
SR Supply Chain Risk Management
SR-1Policy and Proceduresorganisational policySR-2Supply Chain Risk Management Plancontracts and vendorsSR-3Supply Chain Controls and Processescontracts and vendorsSR-5Acquisition Strategies, Tools, and Methodscontracts and vendorsSR-6Supplier Assessments and Reviewscontracts and vendorsSR-8Notification Agreementscontracts and vendorsSR-10Inspection of Systems or Componentscontracts and vendorsSR-11Component Authenticitycontracts and vendorsSR-12Component Disposalcontracts and vendors
Using it in an audit
Take the population from the change records (from v1.4.0)
Every merge into a protected branch and every direct push in the period, captured from GitHub as it happened, is a sealed record you can export for sampling. You can re-perform the default branch’s population from git history; designated production branches are planned for v1.4.1.
Read the code evidence for the period
Each pull request carries sealed code results against the blueprint’s rules, pinned to the commit and the rule-set version in force.
Test a sample
For each sampled record, check its results, then verify its signature and its place in the chain offline.
toevan audit verify --path evidence-clone --pub-key toevan.pub
How each fact was obtained
Every fact in a record and a report carries one of six labels, so your auditor knows how far to rely on it.
- Recomputed
- Toevan computed it from the code or git history itself.
- Re-perform it from the same inputs and get the same result.
- Reported + sealed
- GitHub reported it; Toevan captured it at the event and signed it.
- Rely on it as far as you rely on GitHub. Any later change is detectable.
- Declared + sealed
- The organisation declared it, such as a change to what is checked; Toevan signed the declaration and its history.
- See who declared what, when, and every later change.
- Toevan record, not sealed
- Held in Toevan’s database but not sealed in the ledger, such as a waiver today. Nothing protects it by a signature.
- Treat it as Toevan’s statement, and ask the organisation for the approval behind it.
- Consumed
- Taken from another system’s signed record, such as build provenance, and linked by commit or digest. Planned.
- Check the original record independently.
- Not captured
- No reliable source was available. Toevan does not infer it.
- Obtain it from the organisation by other means.
See it in a report
The sample change evidence report shows the evidence as your auditor receives it, with every fact labelled.
Open the sample reportTest the mapping on a real audit.
Bring one repository and an upcoming audit. We’ll set up the blueprint and walk your auditor through verification.