Security Compliance Frameworks (SOX, HIPAA, PCI DSS, FedRAMP…)

Co jest w środku

What is the primary goal of the Sarbanes-Oxley Act (SOX)?

To protect investors by improving the accuracy and reliability of corporate disclosures and financial reporting.

What role does the Public Company Accounting Oversight Board (PCAOB) play in SOX compliance?

It oversees the audits of public companies to ensure compliance with SOX.

Which companies are primarily affected by SOX?

Publicly traded companies and wholly-owned subsidiaries in the U.S.

How does SOX impact IT and cybersecurity?

SOX requires IT controls that ensure data integrity, security, and accurate financial reporting.

What is the consequence of SOX non-compliance?

Legal penalties, fines, and reputational damage.

What is the role of auditors in SOX compliance?

Auditors evaluate the effectiveness of internal controls over financial reporting.

How often must SOX compliance be evaluated?

Annually.

What are the three main rules of HIPAA?

The Privacy Rule, the Security Rule, and the Breach Notification Rule.

What is the purpose of the HIPAA Security Rule?

To protect the confidentiality, integrity, and availability of electronic protected health information (ePHI).

Who must comply with HIPAA regulations?

Covered entities (like healthcare providers) and their business associates.

What is a business associate under HIPAA?

A person or entity that performs functions involving PHI on behalf of a covered entity.

What are the consequences of a HIPAA violation?

Civil penalties, criminal penalties, and reputational damage.

What is the difference between the Privacy Rule and the Security Rule in HIPAA?

The Privacy Rule governs all PHI; the Security Rule focuses only on ePHI.

What are the HIPAA breach notification requirements?

Notification to affected individuals, HHS, and sometimes the media within 60 days of discovery.

What is the HITECH Act's relation to HIPAA?

It strengthens HIPAA by increasing penalties and expanding breach notification rules.

What are technical safeguards under HIPAA?

Access controls, audit controls, integrity, authentication, and transmission security.

What are the five Trust Services Criteria in SOC 2?

Security, Availability, Processing Integrity, Confidentiality, and Privacy.

What is the difference between SOC 2 Type I and Type II reports?

Type I reviews controls at a point in time; Type II assesses over a period (typically 6 to 12 months).

Who issues SOC 2 reports?

Certified public accounting (CPA) firms.

Why is a SOC 2 report important for service organizations?

It builds trust with clients by verifying data protection and control practices.

What framework underlies SOC 2 reports?

The AICPA Trust Services Criteria framework.

Can organizations exclude criteria from their SOC 2 report?

Yes, only Security is required; others are optional based on services offered.

What is the role of complementary user entity controls (CUECs)?

They are controls users must implement for SOC 2 controls to be effective.

What is a bridge letter in SOC 2 compliance?

A document covering the gap between a report end date and current date.

What is included in the management assertion of a SOC 2 report?

A statement by management asserting the design and operation of their controls.

What is FedRAMP?

A U.S. government program that standardizes cloud security assessments for federal agencies.

What are the three impact levels in FedRAMP?

Low, Moderate, and High, based on FIPS 199 categorization.

What is a FedRAMP ATO?

Authorization to Operate granted after successful security assessment.

What is the role of a 3PAO in FedRAMP?

A Third Party Assessment Organization that performs the required security assessment.

What documentation is required for FedRAMP?

System Security Plan (SSP), Security Assessment Plan (SAP), Security Assessment Report (SAR), POA&M, etc.

What is the FedRAMP Marketplace?

A public site listing authorized cloud service offerings (CSOs) and in-process providers.

What is the purpose of the CIS Critical Security Controls?

To provide prioritized and actionable guidance to reduce cybersecurity risk.

What are the three Implementation Groups (IGs) in CIS Controls v8?

IG1 (basic), IG2 (intermediate), and IG3 (advanced), based on risk and resources.

What is the scope of CIS Control 1 in v8?

Inventory and control of enterprise assets.

What kind of organizations use CIS Controls?

Organizations of all sizes as a baseline for cybersecurity best practices.

How often are CIS Controls updated?

They are reviewed regularly and updated as threats evolve, latest being v8.

What is the relationship between CIS Controls and other frameworks?

CIS Controls map to NIST CSF, ISO 27001, and others for easier crosswalk.

What is the benefit of prioritization in CIS Controls?

Helps organizations focus limited resources on the most effective defenses.

What is the main purpose of ISO 27001?

To provide a framework for establishing, implementing, maintaining, and improving an Information Security Management System (ISMS).

What is an ISMS in the context of ISO 27001?

A systematic approach to managing sensitive company information to remain secure.

What is the Plan-Do-Check-Act (PDCA) cycle in ISO 27001?

A continual improvement model applied to manage and improve the ISMS.

What are Annex A controls in ISO 27001?

In the 2022 version, 93 controls organized into 4 themes: organizational, people, physical, and technological. The 2013 version had 114 controls across 14 domains.

What is the significance of risk assessment in ISO 27001?

Identifying, analyzing, and evaluating risks is critical to tailor controls appropriately.

What is ISO 27002?

A code of practice that provides guidance on implementing ISO 27001 controls.

What certification can organizations achieve for ISO 27001?

ISO 27001 certification by accredited certification bodies.

How often must an ISO 27001 ISMS be audited?

Typically annually, including internal audits and surveillance audits by certifiers.

What are the five core functions of the NIST CSF?

Identify, Protect, Detect, Respond, and Recover.

What is the purpose of the Identify function in NIST CSF?

To develop an organizational understanding to manage cybersecurity risk.

How does the Protect function support cybersecurity?

By implementing safeguards to limit or contain the impact of a potential cybersecurity event.

What types of controls are involved in the Detect function?

Anomalies and events detection, continuous monitoring, and detection processes.

What is the Respond function focused on in NIST CSF?

Taking action regarding a detected cybersecurity event to contain impact.

What is the goal of the Recover function?

To restore capabilities or services impaired due to a cybersecurity incident.

How does NIST CSF help organizations?

It provides a flexible, risk-based approach to managing cybersecurity.

Is NIST CSF mandatory for organizations?

No, it's voluntary but widely adopted especially in critical infrastructure sectors.

What is the purpose of PCI DSS?

To protect cardholder data and reduce credit card fraud.

Who must comply with PCI DSS?

Any organization that stores, processes, or transmits credit card information.

What are the 12 PCI DSS requirements?

They include firewall config, changing default passwords, protecting stored data, encryption, access controls, monitoring, and security policies.

What is a Self-Assessment Questionnaire (SAQ) in PCI DSS?

A validation tool for merchants to assess their compliance with PCI DSS.

What is the role of a Qualified Security Assessor (QSA)?

A third party authorized to assess PCI DSS compliance for organizations.

How often must PCI DSS compliance be validated?

At least annually and after significant changes.

What is the importance of network segmentation in PCI DSS?

To reduce scope by isolating cardholder data environment from other networks.

What is the significance of encryption in PCI DSS?

Encrypting cardholder data protects confidentiality and prevents unauthorized access.

What is the GDPR?

The General Data Protection Regulation, an EU regulation for data privacy and protection.

Who does GDPR apply to?

Any organization processing personal data of EU residents, regardless of location.

What are the key principles of GDPR?

Lawfulness, fairness, transparency, purpose limitation, data minimization, accuracy, storage limitation, integrity, and confidentiality.

What rights do data subjects have under GDPR?

Rights to access, rectification, erasure (right to be forgotten), restriction, data portability, and objection.

What is a Data Protection Officer (DPO)?

A designated individual responsible for GDPR compliance within an organization.

What are the penalties for GDPR violations?

Fines up to €20 million or 4% of global annual turnover, whichever is higher.

What is the role of Data Processing Agreements (DPA) under GDPR?

Contracts outlining responsibilities between data controllers and processors.

What is meant by 'Privacy by Design' in GDPR?

Integrating data protection into system design and business processes from the start.

Why is integrating multiple compliance frameworks beneficial?

It reduces duplication, streamlines audits, and enhances overall security posture.

What is a common challenge in managing multiple cybersecurity frameworks?

Differing requirements and terminology can create complexity and overhead.

How can organizations align different compliance frameworks effectively?

By mapping controls across frameworks and adopting unified policies.

What is the role of risk management in compliance integration?

It helps prioritize controls based on impact and likelihood across frameworks.

How does automation aid compliance efforts?

Automates monitoring, reporting, and evidence collection, reducing manual effort.

How does employee training support compliance?

Ensures awareness of policies, reducing human risk factors.

What is the importance of documentation in compliance?

Provides evidence for audits and helps maintain consistent control implementation.

What is FedRAMP Ready status?

A designation indicating a provider is prepared to begin the authorization process, based on a 3PAO readiness assessment. Its role is changing under the Consolidated Rules for 2026 as the program moves toward 20x certification.

What was the Joint Authorization Board (JAB), and does it still exist?

A board of agencies that issued provisional ATOs for cloud services. It was eliminated by OMB Memorandum M-24-15 in July 2024. FedRAMP is removing JAB references from its guidance. Authorization now runs through agency sponsorship or, under 20x, program certification.

What does A&A stand for, and what are its two halves?

Assessment and Authorization. Assess the controls independently, then a designated official authorizes the system. Formerly called C&A.

Who grants a FedRAMP ATO?

The Authorizing Official (AO) at the sponsoring agency. Authorization is a risk acceptance decision by a person.

What are the seven steps of the RMF (NIST 800-37)?

Prepare,
Categorize,
Select,
Implement,
Assess,
Authorize,
Monitor.

What is the difference between NIST 800-30, 800-37, and 800-53?

800-30 is how to conduct a risk assessment (the method). 800-37 is the RMF lifecycle (the process). 800-53 is the catalog of controls (the library).

What is a C3PAO versus a 3PAO?

C3PAO assesses CMMC. 3PAO assesses FedRAMP. Both are accredited independent assessors.

What is an SCA in DoD terminology?

Security Control Assessor. The independent assessor role in DoD authorizations.

What is FIPS 199 and when is it used?

Categorizes a system as Low, Moderate, or High based on impact to confidentiality, integrity, and availability. Done first, because it drives baseline selection.

What is FIPS 200?

Minimum security requirements. The bridge that says once a system is categorized, apply the corresponding 800-53 baseline.

What is FIPS 140-3?

Cryptographic module validation. Validated modules are required for anything protecting federal data. FIPS 140-2 is the predecessor.

What is in a FedRAMP SSP above the control implementations?

System name and identifier,
FIPS 199 categorization and information types, owner and authorizing official and contacts, operational status,
service and deployment model,
system description and data flows,
environment and inventory,
interconnections,
applicable laws and standards.

What is a SAP in the FedRAMP artifact set?

Security Assessment Plan. How the 3PAO will test the controls.

What is a SAR in the FedRAMP artifact set?

Security Assessment Report. The assessor's findings after testing.

What is a POA&M?

Plan of Action and Milestones. Open gaps with owners, remediation plans, and target dates.

In FedRAMP, what is the CIS (Control Implementation Summary)?

A per-control summary of who is responsible: provider, customer, shared, or inherited from the underlying provider. Not to be confused with the CIS Critical Security Controls.

In FedRAMP, what is the CRM (Customer Responsibility Matrix)?

The subset of controls the customer must implement themselves, written for their consumption. An agency uses it to build its own ATO on top of the service.

Why do the CIS and CRM exist in FedRAMP but not in CMMC?

FedRAMP authorizes a service that other organizations consume and inherit from. CMMC certifies an organization protecting its own systems, so there is nobody inheriting.

What are the recurring FedRAMP continuous monitoring deliverables?

Monthly authenticated vulnerability scans (infrastructure, web, database, container), monthly POA&M submission, monthly updated inventory, deviation requests as applicable, significant change requests, annual assessment, annual penetration test, annual IR and contingency plan testing.

What are the FedRAMP POA&M remediation timelines?

High 30 days, Moderate 90 days, Low 180 days.

What are the three FedRAMP deviation request types?

False positive, risk adjustment, operational requirement.

What is a significant change request in FedRAMP?

A formal submission and approval required before implementing a major change to an authorized system. There is no CMMC equivalent.

How often does FedRAMP require vulnerability scanning?

Monthly, authenticated, across infrastructure, web application, and database, with results submitted to the agency. CMMC requires scanning but does not dictate cadence.

Roughly how many controls are in FedRAMP Moderate and High?

Moderate is roughly 325 controls. High is roughly 410 to 420.

How many practices are in CMMC Level 2, and where do they come from?

110 practices, taken directly from NIST 800-171.

What is the relationship between NIST 800-171 and 800-53?

800-171 is a CUI-focused tailoring of the 800-53 Moderate baseline, so the control families are shared.

What does 800-171 cover that FedRAMP does not, and vice versa?

800-171 addresses confidentiality of CUI only. FedRAMP covers confidentiality, integrity, and availability.

Which control families were dropped from 800-53 when 800-171 was created?

Contingency planning, most of system and services acquisition, planning, program management, privacy, and much of the assessment and authorization family. They were assumed already present in federal systems.

What is the core difference in what CMMC and FedRAMP authorize?

CMMC certifies an organization protecting CUI on its own systems. FedRAMP authorizes a cloud service offering that agencies consume and build on.

How does the assessment rhythm differ between CMMC and FedRAMP?

CMMC is a triennial assessment plus annual affirmation, a project with an end date. FedRAMP is continuous, with monthly submissions to the agency and annual assessment.

How is risk acceptance handled in CMMC versus FedRAMP?

FedRAMP uses formal deviation requests. CMMC has no risk acceptance mechanism at all; a practice is either met or it is not.

How does authorization boundary scoping differ between CMMC and FedRAMP?

CMMC permits aggressive scope reduction through an enclave strategy. The FedRAMP boundary must include everything supporting the service, including corporate and management systems that touch it.

What are the incident reporting timelines for DFARS/CMMC and FedRAMP?

DFARS and CMMC require reporting to DoD within 72 hours. FedRAMP requires reporting confirmed incidents to the agency and US-CERT within one hour.

What is the biggest new work area moving from CMMC to FedRAMP?

Availability and resilience: contingency plan, backup and restoration, disaster recovery, and annual contingency plan testing. None of these are in the 110.

What are the DoD Impact Levels?

IL2 is publicly releasable information. IL4 is CUI with low to moderate national security impact. IL5 is stricter, covering CUI and unclassified national security systems. IL6 covers classified up to Secret.

What is the DoD Cloud Computing SRG?

The Security Requirements Guide that defines the Impact Levels and the DoD-specific requirements for cloud services handling DoD data.

What does IL4 add on top of FedRAMP Moderate?

A DoD Provisional Authorization from DISA, connectivity through a Cloud Access Point, US persons requirements and background investigations for privileged users, data at rest in the US, tenant separation from non-DoD workloads, and DISA STIG hardening.

What is a Cloud Access Point?

The controlled connection point through which DoD cloud traffic must route, rather than connecting directly to the internet.

Which hardening standard does DoD require rather than CIS benchmarks?

DISA STIGs.

What is CNSSI 1253?

Categorization guidance for national security systems. Defines how 800-53 controls apply to NSS, and pairs with the DoD Cloud SRG.

What is IAVM, and what is an IAVA?

Information Assurance Vulnerability Management is the DoD program for mandated vulnerability response. An IAVA is a mandatory, tracked, deadline-bound alert that must be acknowledged, remediated, and reported up the chain.

What is a CISA Emergency Directive?

A binding order to federal civilian agencies when a threat is confirmed and actively exploited. Mandatory actions with a hard deadline, overriding normal risk-based prioritization.

What is a CISA Binding Operational Directive (BOD)?

A broader standing requirement for federal civilian agencies, as opposed to the incident-driven Emergency Directive.

What is the CISA KEV catalog?

Known Exploited Vulnerabilities. The authoritative list of vulnerabilities confirmed to be exploited in the wild, used to prioritize ahead of raw CVSS score.

What is eMASS?

The DoD web-based system of record for managing the RMF process and ATO packages: controls, implementation detail, assessment results, POA&M, and the workflow to authorization.

What is Xacta?

A commercial GRC and compliance automation platform from Telos, widely used in FedRAMP and cloud environments to build and maintain authorization packages.

What is OSCAL?

Open Security Controls Assessment Language. NIST machine-readable formats in JSON, XML, and YAML for control implementations, SSPs, assessment plans, and POA&Ms, replacing prose documents with structured data that can be validated automatically.

What is GovRAMP?

The state and local government equivalent of FedRAMP. Formerly StateRAMP.

STATUS CHECK: What is the current state of FedRAMP as of mid 2026?

Two paths coexist. Rev 5 is the established path and remains valid. FedRAMP 20x is live and in Phase 3, with Class A, B, and C certification rules finalized. Rev 5 is not retired yet.

What replaced the JAB after OMB Memorandum M-24-15?

M-24-15 (July 2024) eliminated the JAB and its provisional ATO path. Authorization runs through agency sponsorship, or through FedRAMP 20x program certification which does not require an agency sponsor.

What is FedRAMP 20x?

A certification approach that replaces narrative control documentation with measurable Key Security Indicators and automated validation. IN EFFECT NOW: Classes A, B, and C are finalized and available.

What are Key Security Indicators (KSIs) in FedRAMP 20x?

Measurable security capabilities that replace narrative control implementations. The provider proves the capability works through automated validation rather than documenting intent. Applies to 20x, not to Rev 5 packages.

What are the FedRAMP 20x certification classes?

Class A is the entry class for providers with mature security programs. Class B covers small-scale or light-use services (Low). Class C covers common enterprise services (Moderate). Class D for High is FUTURE, planned for Phase 4, estimated FY27.

What are the five core principles of FedRAMP 20x?

Transparency, flexibility, accountability, accuracy, and automatic validation. The stated aim is moving assurance away from paperwork and toward evidence.

What are the FedRAMP Consolidated Rules for 2026?

The single ruleset covering both 20x certification and continuing Rev 5 obligations, published in June 2026. Effective dates and grace periods vary by ruleset, so confirm which parts apply before assuming a requirement is live.

What is the Security Decision Record (SDR)?

A persistently maintained, machine-readable record of security decisions across the service lifecycle, required in human-readable and JSON form. It replaces much of what the SSP contained. Applies under the 2026 rules, not to legacy Rev 5 packages already in place.

Is OSCAL currently required for FedRAMP?

Directionally yes, and it is being phased in for all providers rather than only 20x participants. Treat specific deadlines as moving, since FedRAMP states that future dates are estimates rather than firm commitments.

When does FedRAMP stop accepting new Rev 5 certifications?

June 11, 2027, in the Phase 5 window. FedRAMP labels future phase dates as estimates for public awareness, not firm commitments.

What phase is FedRAMP 20x in, and what does that mean?

Phase 3, wide-scale adoption, running FY26 Q3 to Q4. Phases 1 and 2 were the Low and Moderate pilots and are complete. Phase 4 (Class D High) and Phase 5 (end of new Rev 5) are future and estimated.

What did the FedRAMP 20x pilots demonstrate?

That Key Security Indicators can show security posture in near real time in place of static annual assessments, that automated validation integrates with existing provider tooling, and that adoption requires deep engagement from engineering teams rather than compliance staff alone.

CAUTION: how should FedRAMP 20x dates be treated?

As estimates. FedRAMP states explicitly that future dates are for public awareness, not firm commitments, and will shift with real-world conditions. Rev 5 remains a valid operating path today.

How does the POA&M function differently in CMMC versus FedRAMP?

In CMMC it is a temporary bridge: it exists only between conditional and final certification, must be closed within 180 days, and after the closeout assessment there is no ongoing POA&M. Changes after that flow through change management, and significant changes may trigger reassessment. In FedRAMP it is permanent operating machinery where every open finding lives continuously and is submitted monthly.

What is a DoD Provisional Authorization?

An authorization issued by DISA for a cloud offering at a given Impact Level, separate from the FedRAMP ATO. It is not an ATO. The PA says the offering is acceptable for DoD use; the mission owner consuming the service still issues their own ATO on top of it, inheriting the PA and adding controls for how they use it.

What are the seven steps of the FedRAMP authorization path?

1. Optional readiness assessment. 2. Agency sponsor and FIPS 199 categorization. 3. Pre-authorization planning. 4. Initial 3PAO assessment. 5. POA&M creation. 6. Agency authorization and PMO review. 7. Continuous monitoring.

What is a Readiness Assessment Report (RAR)?

An optional 3PAO health check against the baseline, reviewed by the PMO. If approved you are listed as FedRAMP Ready. It requires an unambiguous attestation with no conditional language, and no penetration test is required at that stage.

What is an In Process Request (IPR)?

The package submitted to the FedRAMP PMO once an agency sponsor is secured. It includes a project plan and a work breakdown structure. Acceptance gets you listed as In Process on the Marketplace.

What is a Work Breakdown Structure in the FedRAMP context?

The milestone timeline for the authorization effort, submitted with the In Process Request.

What are the three FedRAMP Marketplace designations?

Ready, In Process, and Authorized.

Who validates the impact level you propose?

You make the initial FIPS 199 determination, and the agency sponsor validates the recommendation.

What happens in pre-authorization planning?

Draft the SSP in detail, prepare the SAP, boundary and data flow diagrams, and attachments. Align with the sponsor and 3PAO on scope, remediation schedule, and test logistics. Close gaps before formal testing. Multiple iterations here are normal and they shorten the assessment.

What is the 3PAO impartiality rule?

A two year bar between consulting and assessing. A firm that consulted for you cannot then assess you, so consulting and assessment vendors have to be sequenced deliberately.

Can you change 3PAOs?

Yes, at any time. There is no requirement to keep the same one, and they vary in thoroughness, proactivity, and cost.

What is the scope of the FedRAMP annual assessment?

A core set of controls FedRAMP names, plus at minimum one third of the remaining controls, plus every control that had a finding in the previous assessment. The 3PAO and CSP should also confirm with the PMO and AO whether anything additional must be tested.

If the CSP runs its own scans, what is the 3PAO obligation?

The 3PAO must independently verify the results, either by observing the scans or by an alternative validation method. The 3PAO does not manage remediation; it confirms that reported posture reflects reality.

What is the Risk Exposure Table (RET)?

A FedRAMP template produced alongside the SAP and SAR. It is the assessor view of aggregate risk at a point in time.

What is the FedRAMP PMO role after authorization?

Verifying annual assessment packages, maintaining Marketplace authorization status, and quality review so packages are suitable for government-wide reuse. Its capacity is concentrated on package quality rather than monitoring individual environments.

Does FedRAMP say controls or requirements?

Controls. FedRAMP and 800-53 both use security controls, control baselines, and control implementation throughout. 800-171 says requirements, and CMMC 2.0 follows that, though almost everyone says controls anyway. CMMC 1.0 said practices.

Assessment or audit in FedRAMP language?

Assessment. Security Assessment Plan, Security Assessment Report, Third Party Assessment Organization, annual assessment. Assessor, not auditor. Audit and auditor are the SOC 2 and ISO vocabulary, and audit-ready is common vernacular, so both float around in a shop running multiple frameworks.

What does the FedRAMP template call the control narrative?

The implementation description. Practitioners commonly say implementation statement. Both are understood.

What are control parts, and why do they matter in FedRAMP?

Many 800-53 controls have lettered parts. FedRAMP requires each part addressed separately rather than one narrative covering all of them.

What is an Organization Defined Parameter (ODP)?

The blanks inside a control, such as how often something happens or how long something is retained. FedRAMP prescribes many of these values rather than letting the organization choose, which is a key difference from CMMC.

What are the FedRAMP SSP attachments?

Policies and procedures per family, user guide, digital identity worksheet, privacy threshold analysis and impact assessment, rules of behavior, contingency plan, configuration management plan, incident response plan, CIS and CRM workbook, FIPS 199 categorization, separation of duties matrix, laws and regulations, integrated inventory workbook, and continuous monitoring plan. Numbering shifts between template versions.

How granular is the component inventory in the SSP itself?

The SSP describes the environment: what tiers exist, what components make them up, how they relate. It does not list every host. It points to the integrated inventory workbook as the authoritative enumerated list.

What is in the integrated inventory workbook?

A row per asset: unique identifier, IP, DNS and NetBIOS name, MAC, whether virtual, whether public, OS and software vendor, product and version, patch level, function, asset type, network or VLAN, and system and application owners.

Which inventory workbook column matters most for ConMon?

The authenticated scan flag per asset. It is where the inventory declares what should have been scanned, which is what you reconcile the scan results against.

When does a FedRAMP SSP need updating?

Annual review as the floor. Then any boundary change including a new outbound connection, any interconnection change, component and inventory changes, ports protocols and services changes, control implementation changes, personnel changes for named roles, and POA&M closures that changed an implementation. Significant changes need an approved SCR before implementation, not just a document edit.

Is a new outbound connection an SSP change?

Yes. A connection out is a boundary change even though nothing new was built inside the system.

What is the tradeoff between broad and specific implementation statements?

Specific statements are easy for an assessor to test and easy to fail you on, and they go wrong the moment implementation changes. Broad statements survive change and attract less document review scrutiny, but the scrutiny does not disappear, it moves to assessment day where you improvise and commit verbally to something you would never have written. FedRAMP pushes toward specific anyway because parameters are prescribed and parts must be addressed individually.

What is the most common SSP failure?

Drift. The SSP describes a system that stops existing the moment engineering ships, and the assessor tests the system rather than the document. The finding is the gap between them.

Why is stating that the system enforces least privilege not an implementation?

It states intent rather than mechanism. An implementation names what enforces it, where it is enforced, and how it is verified.

What is the FedRAMP ConMon Playbook?

The FedRAMP document codifying the monthly, annual, and event driven obligations every CSP must meet.

What are the source documents for FedRAMP continuous monitoring?

NIST 800-137, the ConMon Playbook, the FedRAMP Continuous Monitoring Strategy Guide, and the Continuous Monitoring Performance Management Guide.

What are the six steps of the ConMon process?

Define the required posture, establish the monitoring framework, implement collection, analyze and report, respond, then review and update and start again.

When does continuous monitoring begin?

The moment the ATO is issued, not when the POA&M is cleared. As POA&M items close, the new implementations get folded into monitoring.

What is the quarterly FedRAMP obligation?

Review for significant changes to the system.

Beyond infrastructure, web, database, and container, what else is scanned?

Wireless, where wireless is inside the authorization boundary, scanning for unauthorized access points. Plus the annual penetration test, which follows FedRAMP guidance defining mandatory attack vectors rather than leaving scope to the tester.

Why do containers break the monthly scan model, and what satisfies the requirement instead?

They do not live a month. FedRAMP expects containers rebuilt and redeployed rather than patched in place, so the image scan plus proof that running containers only come from scanned images is what satisfies the scanning requirement.

Is sampling allowed for FedRAMP monthly scans?

No. Full inventory, monthly. Partial coverage is a finding rather than an approach.

What is the most common monthly ConMon failure?

Scan coverage reconciliation against inventory. Assets in the inventory that were not scanned, and scanned assets absent from the inventory. Both are findings, and the reconciliation is the work rather than the scan.

What is silent authentication failure?

A credentialed scan whose credentials fail often still reports success, having quietly run unauthenticated. The results look clean and mean nothing. Verify authentication per host rather than trusting a green scan. Comparing authenticated host count against expected is a good first alert to build.

When does the remediation clock start?

At first detection, not when the finding was logged or triaged. Slow intake burns the window rather than resetting it.

Why is recurrence worse than persistence in a POA&M?

An item closed one month that reappears the next means the remediation did not hold. That reads worse to an assessor than an item that stayed open with an honest plan, and recurrence rate is the only honest measure of remediation quality.

What happens when ConMon obligations are missed?

They age into POA&M findings, become visible to agency buyers through the Marketplace, and sustained failure can cost the authorization.

Do automated ConMon reports still need human sign off?

Yes. FedRAMP permits automation broadly, but output must be reviewed and signed by the provider and the 3PAO. Automation removes the toil, not the accountability.

What are the four ways authenticated scanning is actually done?

Agent based, where an agent reports in and there is no credential handling at scan time. Credentialed network scan, where the scanner pulls privileged credentials from a vault. Agentless snapshot, which reads a disk snapshot out of band. And image scanning as the evidence for immutable short lived infrastructure.

Why has agent based scanning become dominant at scale?

Managing credentials across a large or ephemeral fleet does not work. The agent reports in, so there is no credential handling at scan time and no silent authentication failure.

What is the scanner of record?

The tool whose output you submit as the monthly deliverable and which the assessor validates. It is a distinct question from which tools you use operationally.

Why is an agentless CNAPP usually not the scanner of record?

FedRAMP has historically meant a credentialed scan where the scanner logs in and enumerates packages, patch level, and configuration. Agentless snapshot reading is a different mechanism, so the 3PAO has to understand it, observe or reproduce it, and attest results reflect reality. Coverage is also uneven: strong on host and container image, but it is not a web application scanner and does not do authenticated database configuration scanning.

Where does a CNAPP like Wiz genuinely help with FedRAMP?

FedRAMP has historically meant a credentialed scan where the scanner logs in and enumerates packages, patch level, and configuration. Agentless snapshot reading is a different mechanism, so the 3PAO has to understand it, observe or reproduce it, and attest results reflect reality. Coverage is also uneven: strong on host and container image, but it is not a web application scanner and does not do authenticated database configuration scanning.

Is a risk register required in FedRAMP?

Not as a separate artifact you design. FedRAMP requires the same risk assessment discipline but supplies the artifacts, so the register function is distributed: RA-3 for the documented assessment, the Risk Exposure Table with the SAR, the POA&M as the operational register, and deviation requests as the acceptance path.

What does RA-3 require?

A documented risk assessment, updated on a defined frequency and when significant change occurs. It is the closest FedRAMP analog to the CMMC risk assessment requirement.

What is RA-7?

Risk Response, a Rev 5 addition. Responding to findings from risk assessments, which is where accepting, avoiding, transferring, or mitigating gets recorded.

Who accepts risk in FedRAMP?

The Authorizing Official at the sponsoring agency. Risk acceptance is not an internal decision, and the deviation request is the route to it.

Why is severity not the same as risk?

NIST 800-53 Rev 5 does not treat vulnerability severity as synonymous with risk. Exposure, reachability, and what sits behind the asset determine actual risk. Without disciplined risk adjustment up front, a scan returning thousands of highs against a 30 day clock becomes unmanageable.

How should a POA&M be sorted for daily work?

By clock rather than severity. Severity sets the size of the window, elapsed time tells you what is about to breach. A moderate at day 85 of 90 outranks a high at day 5 of 30, and sorting by severity hides that.

Why group POA&M items by root cause?

Two hundred rows traced to one unpatched base image is one fix and one conversation with one team. Counting rows makes the program look overwhelmed and points the team at symptoms.

What does vendor dependency tracking require?

A flag on the item plus a recorded check-in with the vendor on a recurring cadence. Waiting on a vendor is legitimate; waiting with no record of chasing them is a finding.

What is the single biggest structural difference between CMMC and FedRAMP?

CMMC leaves most of the how to the organization; FedRAMP prescribes it. Scan cadence, document formats, control parameters, remediation timelines, change process, and reporting are all your choice in CMMC and specified in FedRAMP. That is where habits from one silently produce wrong answers in the other.

Which things does CMMC leave to the organization that FedRAMP prescribes?

Boundary scoping approach, documentation format, control parameter values, scan cadence and types, remediation timelines, POA&M use, change management process, continuous monitoring program design, and configuration baseline choice.

Logic Apps or Azure Functions, how do you choose?

Logic Apps to connect things: prebuilt connectors, human approval steps, notification and ticketing. Functions to compute things: transformation, parsing, API calls with no connector, anything you want unit tested and in source control. Avoid putting real logic in Logic Apps because version control and testing are weaker and cost scales with action count.

When do you use an Automation Account runbook instead?

Operating system level work, long running jobs, or reaching on-prem and isolated networks through a hybrid runbook worker, which a cloud hosted function cannot do.

What is the rule of thumb for Azure automation choice?

Logic Apps to connect things, Functions to compute things, runbooks to reach things, Policy to prevent things.

Why build alerts before automation?

An alert is automation with a human as the action. It surfaces the failure while it is still cheap, produces the signal you later automate against, and tells you whether the condition is even worth automating.

+26 fiszek więcej