# Controls

*Which NIST line does each law, guarantee, and scenario answer? For an assessor.*

The lines are NIST SP 800-53 Rev 5 controls as the FedRAMP Rev 5 Moderate baseline selects and parameterizes them. The selections and parameter values come from the OSCAL profile `FedRAMP_rev5_MODERATE-baseline_profile.json`, read on 2026-09-14 in the oscal-compass-lab mirror of GSA's fedramp-automation repository. The control text comes from the csf.tools mirror of the Rev 5 catalog. A control cited with an asterisk in `docs/example.md` is outside the baseline, and no control in the baseline asks for a reference monitor.

A law is a row of `docs/conformance.md` under "The laws", and a guarantee is a row under "The guarantees". A scenario is a row of `docs/example.md` under "The scenarios".

## The parameters

| Parameter | Value | What it means here |
|---|---|---|
| AU-2 `au-02_odp.01` | ends "For Web applications: all administrator activity, authentication checks, authorization checks, data deletions, data access, data changes, and permission changes" | authorization checks are the decision event. Data access is the access event. Data changes, deletions, and permission changes are the change event. Administrator activity is a decision or change whose subject kind is `:privileged`. Authentication checks are the application's, outside the library |
| AU-3(1) `au-03.01_odp` | includes "characteristics that describe or identify the object or resource being acted upon" | every event carries the object type and the ids it acted on |
| AC-2(4) | "Automatically audit account creation, modification, enabling, disabling, and removal actions" | a single-row write to a schema audited as `:user` emits one change event |
| AC-6(9) | "Log the execution of privileged functions" | every decision for a `:privileged` subject carries that kind |

## The controls

| Control | Answered by |
|---|---|
| AC-2, AC-2(4) | `ac2-01` |
| AC-2(2), AC-2(3) | `ac2-02` |
| AC-2(3), PS-5 | `ac2-03` |
| AC-2(7), AC-6(7) | `ac2-04` |
| AC-2(13), PS-4 | `ac2-05` |
| AC-3 | `ac3-01` |
| AC-3 | `ac3-02` |
| AC-3 | `ac3-03` |
| AC-3 | `ac3-04` |
| AC-3 | `ac3-05` |
| AC-6(2) | `ac6-01` |
| AC-6(9) | `au2-01`, for the subject of kind `:privileged` it denies |
| AU-2 | `au2-01` |
| AU-2 | `au2-02` |
| AU-2 | `au2-03` |
| AU-3 | `au3-01` |
| AU-3 | `au3-02` |
| AU-3 | `au3-03` |
| AU-3(1) | `au3-04` |
| AU-12, AC-2(4) | `au12-01`, `E1` |
| AU-12 | `au12-02`, `E2` |
| AU-12 | `au12-03`, `E3` |
| AU-12 | `au12-04` |
| AU-12 | `au12-05` |
| AU-12 | `au12-06`, `E5` |
| AU-12 | `au12-07`, one coverage test per adapter |
| CM-3, CM-5 | `cm3-01` |
| CM-3(2) | `cm3-02` |
| CM-5(1) | `cm3-03` |
| CM-3(2) | `cm3-04` |
| AC-5 | `sod-01` to `sod-03`, separation of duties in the example |
| AC-6, AC-6(1), AC-6(5), AC-6(10) | `lp-01` to `lp-08`, least privilege in the example |
| IA-11 | `ia-01` to `ia-03`, re-authentication in the example |
| AC-6(9), AU-6 | `ovr-01` to `ovr-03`, the audited override in the example |

## The consumer's lines

The library emits what these need, and the deployer's consumer satisfies them.

| Control | What the consumer does |
|---|---|
| AC-2(1), AC-2(5), AC-2(9), AC-2(12) | Automates account management, logs out inactive sessions, manages shared accounts, and monitors for atypical use, over the change and decision events |
| AU-6, AU-6(1), AU-6(3) | Reviews the records weekly and correlates across the audit stores |
| AU-9, AU-9(4) | Protects the records and restricts access to them |
| AU-11 | Retains the records for the period M-21-31 sets |
| CM-3(4), CM-5(5) | Puts a security representative on the change board and limits who can publish a version |
| AU-5 | Alerts on a handler failure, which telemetry reports as its own event |

A row is complete when it names a law, a guarantee, a scenario, or a consumer responsibility, and the freeze test holds the law ids.