FedRAMP

Federal cloud security and component inventory requirements.


Region	Americas
Country or scope	United States
Sector	Cloud
In your workspace	On unless you switch it off in Compliance › Manage.

How Safeguard covers FedRAMP

Scan requirements: 6, all decided by a scan.
Controls: the scan requirements below, plus 11 controls from Safeguard's control catalog for FedRAMP.
Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
Policy templates: 25: 3 written for FedRAMP and 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

What a scan checks

Each scan of a product checks these 6 requirements against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`FR-CM-8` System Component Inventory	Authorized cloud services must develop and maintain an accurate, current inventory of system components, including the software within the authorization boundary (FedRAMP baselines; NIST SP 800-53 CM-8)	Scan
`FR-CM-8V` Inventory Granularity	The component inventory must include information necessary for accountability, such as software version numbers, to be usable for assessment and incident response (NIST SP 800-53 CM-8 inventory content)	Scan
`FR-SI-7` Software Integrity Verification	Providers must employ integrity verification tools to detect unauthorized changes to software, which depends on known-good cryptographic hashes for components (NIST SP 800-53 SI-7)	Scan
`FR-RA-5` Vulnerability Scanning Correlation	Monthly vulnerability scanning obligations require components to carry standard identifiers so scan findings map to inventory entries (FedRAMP continuous monitoring; NIST SP 800-53 RA-5)	Scan
`FR-SR-4` Supply Chain Provenance	Rev 5 baselines require documenting the provenance of systems and components, attributing software to its developers and suppliers (NIST SP 800-53 SR-4)	Scan
`FR-CA-DOC` Authorization Package Evidence	Assessment and authorization artifacts must be identifiable, dated documents maintained across the authorization lifecycle (FedRAMP authorization package requirements; NIST SP 800-53 CA family)	Scan

More controls in the catalog

The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.

Control	Name
`FRMP-AC-2`	Cloud account management controls
`FRMP-CA-3`	Authorize system interconnections
`FRMP-CM-6`	Apply FedRAMP-approved configuration baselines
`FRMP-IR-6`	Report incidents to US-CERT and agencies within FedRAMP SLAs
`FRMP-RA-5`	Perform FedRAMP-required vulnerability scanning
`FRMP-SA-9`	Manage third-party cloud service dependencies
`FRMP-SC-28`	Encrypt federal data at rest in cloud storage
`FRMP-AU-6`	Review and analyze audit logs for FedRAMP
`FRMP-PL-8`	Maintain FedRAMP System Security Plan
`FRMP-3PAO`	Engage a FedRAMP-accredited 3PAO for assessments
`FRMP-CONMON`	Implement FedRAMP continuous monitoring program

Policy templates

Written for FedRAMP:

FedRAMP Authorization Boundary and System Description Policy
FedRAMP Incident Reporting and Breach Notification Policy
FedRAMP Continuous Monitoring Program Policy

And 22 from the standard set, adapted to FedRAMP.