2

Quoting the FedRAMP official FAQ:

FedRAMP requirements include additional controls above the standard NIST baseline controls in NIST SP 800-53 Revision 4. These additional controls address the unique elements of cloud computing to ensure all federal data is secure in cloud environments.

However when I download the list of controls via the Official Fedramp Website (see this for "HIGH", and similar links for the other levels), I get what looks like the NIST 800-53 controls. Depending on the FedRAMP impact level, a subset of the NIST controls are selected.

So, what are those "additional controls above the NIST baseline"? I can’t find those on the web.

Improve this question
2
  • Are you sure that fedramp needs its own tag?
    – user163495
    Commented Dec 10, 2019 at 9:36
  • How about I'm unsure that it doesn't ?
    – niilzon
    Commented Dec 11, 2019 at 16:03

1 Answer 1

Reset to default
0

What FedRAMP calls "complementary controls" are simply the classic NIST "security control enhancements" selected for FedRAMP, and that are available in the usual NIST templates.

It was just a vocabulary issue..

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .