| Field | Value |
|---|
| Type | Skill Resource |
| Source | ~/.copilot/skills/security/references/ato/control-module-catalog.md |
| Description | Not specified |
Source Content
Control-Module Catalog — the “right ATO way” per area
The à-la-carte module catalog the platform builds to. Each row is an independently deployable control with a FedRAMP High default and a documented dial-down to Moderate / Low. Source: docs/product/roadmap/frd-fedramp-compliant-platform.mdx (FRD-SEC-001). Use this to answer “what is the right way to build this, and which level does each choice meet?”
Rule that governs every module: controls fail closed (deny on authz/policy-engine failure), every module emits OSCAL evidence, all crypto is a FIPS 140-3-validated module in approved mode, and you never hand-roll cryptography. Say “maps to control X-NN”, never “FedRAMP compliant”.
Identity & access (IA, AC)
| Module | 800-53 | High — the right way | Dial-down | Suggested OSS / standard |
|---|
| Identity proofing (IAL3) | IA-12 | Supervised in-person / supervised-remote proofing; store evidence + decision | IAL2 remote; IAL1 self-asserted | Proofing provider per 800-63A |
| Authentication (AAL3) | IA-2, IA-2(1/2), IA-5 | Phishing-resistant hardware MFA only — FIDO2/WebAuthn, PIV/CAC. No SMS OTP. | AAL2 = MFA w/ phishing-resistant option | Keycloak/Authentik + WebAuthn; PIV/CAC via PKCS#11 |
| Federation / SSO (FAL3) | IA-2, AC-14 | Holder-of-key assertions bound to an authenticator; OIDC/SAML | FAL2 encrypted assertion; FAL1 signed bearer | Authentik/Authelia/Keycloak IdP |
| Role/attribute access | AC-2, AC-3, AC-6 | RBAC + ABAC; enforced least privilege; periodic access review | Fewer roles, manual review | Authorization library |
| Separation of duties | AC-5 | Enforced incompatible-role checks; dual control for sensitive ops | Advisory only | Policy in authz library |
| Session management | AC-11, AC-12 | Idle lock, absolute timeout, re-auth for step-up, concurrent-session limits | Longer timeouts | Better-Auth/Authelia session policy |
| Privileged access + break-glass | AC-2(7), AC-6(5) | Just-in-time elevation, recorded break-glass, no standing admin | Standing admin w/ MFA | Vault/Authentik + audit |
Audit, monitoring & authorization evidence (AU, CA, SI)
| Module | 800-53 | High — the right way | Dial-down | Suggested OSS / standard |
|---|
| Tamper-evident audit logging | AU-2, AU-3, AU-9 | Append-only, hash-chained/signed events on a defined schema | Standard immutable storage | Audit log library (FRD-014) |
| Log retention | AU-11 | ≥ 1 year online + 2 years offline | Shorter retention | Loki + object-storage lifecycle |
| Central aggregation + alerting (SIEM) | AU-6, SI-4 | Correlate, alert on security events, anomaly detection | Basic alerting | Loki/Grafana + rules; Wazuh |
| OSCAL SSP + evidence automation | CA-2, CA-7 | Generate machine-readable SSP; collect runtime evidence | Manual SSP | OSCAL evidence viewer |
| Continuous-monitoring dashboard | CA-7 | Live control status, POA&M, scan results | Periodic report | Grafana + OSCAL feed |
Data protection & cryptography (SC, MP)
| Module | 800-53 | High — the right way | Dial-down | Suggested OSS / standard |
|---|
| Encryption in transit | SC-8, SC-13 | TLS 1.2+/1.3, FIPS 140-3-validated modules, mTLS internally | TLS 1.2, edge-only | Traefik/Linkerd; BoringCrypto/OpenSSL FIPS |
| Encryption at rest | SC-28, SC-13 | FIPS 140-3 module; per-tenant keys; full-disk + field-level for sensitive data | DB-level only | Postgres TDE/pgcrypto, LUKS |
| Key & secret management | SC-12, SC-13, IA-5 | HSM/KMS-backed keys, rotation, no secrets in code | Managed KMS | 1Password Connect / Vault + KMS |
| Data classification + DLP | MP-2, MP-4, SC-7 | Tag data by sensitivity; egress controls on classified data | Tagging only | Custom + policy |
Boundary, configuration & integrity (SC, CM, RA, SI)
| Module | 800-53 | High — the right way | Dial-down | Suggested OSS / standard |
|---|
| Boundary protection / segmentation | SC-7 | WAF, default-deny network policy, microsegmentation, no flat network | Edge firewall + segments | Kyverno + NetworkPolicy, Traefik WAF |
| Hardened baselines + drift detection | CM-2, CM-6 | CIS/DISA STIG baselines as code; detect & remediate drift | CIS Level 1 | Kyverno, OpenSCAP, IaC |
| Change & configuration control | CM-3, CM-4 | All change via GitOps + review; immutable infra | PR review | ArgoCD, signed commits |
| Vulnerability scanning | RA-5 | Monthly OS/web/DB + container + IaC scanning | Quarterly | Trivy, OpenSCAP, ZAP |
| Flaw remediation SLAs | SI-2 | By finding severity: High 30d / Moderate 90d / Low 180d, in POA&M | Best-effort | POA&M automation |
| Integrity monitoring / malware | SI-3, SI-7 | FIM, image signing + admission control, runtime detection | Image scanning | Falco, cosign + Kyverno |
The SI-2 windows are by finding severity, independent of the system impact level. A Moderate system still fixes a Critical/High finding on the 30-day clock.
Resilience & response (CP, IR)
| Module | 800-53 | High — the right way | Dial-down | Suggested OSS / standard |
|---|
| Backup & disaster recovery | CP-9, CP-10 | Encrypted, tested backups; documented RTO/RPO; cross-region | Single-region backups | Velero, pgBackRest |
| Incident response | IR-4, IR-6 | IR plan, US-CERT/CISA reporting within the required window, runbooks | Internal IR only | GlitchTip + runbooks |
Supply chain, SDLC & privacy (SR, SA, SI, PT)
| Module | 800-53 | High — the right way | Dial-down | Suggested OSS / standard |
|---|
| Supply chain / SBOM | SR-3, SR-4 | Generate + verify SBOM per build; provenance attestation | SBOM only | Syft + cosign/SLSA |
| Secure SDLC scanning | SA-11, SI-2 | SAST + DAST + secret + dependency review in CI, gating | SAST + secret scan | CodeQL/Semgrep, gitleaks, Dependabot/Renovate |
| Privacy / PII controls | PT-2, PT-3 | Data inventory, consent, minimization, subject-access support | Inventory + notice | Consent module, data map |
What software does NOT cover (out of scope of an ATO-readiness review)
These are required for an actual ATO but are process / organizational / physical, not app code. Flag them as “out of software scope” — do not mark a change Aligned/Partial/Gap against them:
- Authorization mechanics: agency sponsorship, 3PAO/C3PAO engagement, SAR, the ATO letter itself.
- PE (physical/environmental), most PS (personnel security) and AT (training) beyond what software enforces.
- US-person staffing and facility security (a hosting/contract control, even at High/IL5).
Implementation handoff (from the FRD)
When implementing a module: (1) read the mapped 800-53 control text and the relevant security doc; (2) implement the highest-assurance default with a config flag for dial-down; (3) emit OSCAL implementation statements + a runtime evidence endpoint; (4) write negative / fail-closed tests; (5) never hand-roll cryptography — use a FIPS-validated provider; (6) record a Decision Record for any deviation; (7) in code/docs say “maps to control X-NN”, not “FedRAMP compliant”.
Source
All module behavior, OSS suggestions, and dial-downs: docs/product/roadmap/frd-fedramp-compliant-platform.mdx (FRD-SEC-001). Verify control text against NIST 800-53 Rev 5.