Browse 1,193 controls and enhancements across 20 security and privacy families. Use the GovRAMP crosswalk to locate controls referenced by Security Snapshot, Core, and Moderate.
A shared catalog supports common-control planning; designation as a common, hybrid, or system-specific control depends on your organization’s implementation and inheritance decisions.
Sources and crosswalk scope
NIST OSCAL content 5.1.1+u4, retrieved 2026-09-18. GovRAMP Snapshot v1.4 and Core selection from Moderate v1.06 reference the December 2020 Rev. 5 text. Mappings establish exact identifier correspondence, not identical requirements, inherited implementation, or GovRAMP authorization. GovRAMP parameters and additional requirements remain authoritative for each program. Full Moderate, High, and other programs are not mapped here. Withdrawn controls are retained for reference.
Official pinned NIST sourceSHA-256: 81cf2de45ede9aef3de7ce09d65ea9d32f662c483bbf916f6e346292b22f7763
Identification and Authentication · Enhancement
IA-8(5) · Acceptance of PIV-I Credentials
View parent controlControl statement and discussion
NIST control statement
Accept and verify federated or PKI credentials that meet [Assignment: policy].
Discussion
Acceptance of PIV-I credentials can be implemented by PIV, PIV-I, and other commercial or external identity providers. The acceptance and verification of PIV-I-compliant credentials apply to both logical and physical access control systems. The acceptance and verification of PIV-I credentials address nonfederal issuers of identity cards that desire to interoperate with United States Government PIV systems and that can be trusted by Federal Government-relying parties. The X.509 certificate policy for the Federal Bridge Certification Authority (FBCA) addresses PIV-I requirements. The PIV-I card is commensurate with the PIV credentials as defined in cited references. PIV-I credentials are the credentials issued by a PIV-I provider whose PIV-I certificate policy maps to the Federal Bridge PIV-I Certificate Policy. A PIV-I provider is cross-certified with the FBCA (directly or through another PKI bridge) with policies that have been mapped and approved as meeting the requirements of the PIV-I policies defined in the FBCA certificate policy.
GovRAMP crosswalk
Not selected in the imported Snapshot or Core sets. This does not establish exclusion from other GovRAMP baselines.
Identification and Authentication · Enhancement
IA-8(6) · Disassociability
View parent controlControl statement and discussion
NIST control statement
Implement the following measures to disassociate user attributes or identifier assertion relationships among individuals, credential service providers, and relying parties: [Assignment: measures].
Discussion
Federated identity solutions can create increased privacy risks due to the tracking and profiling of individuals. Using identifier mapping tables or cryptographic techniques to blind credential service providers and relying parties from each other or to make identity attributes less visible to transmitting parties can reduce these privacy risks.
GovRAMP crosswalk
Not selected in the imported Snapshot or Core sets. This does not establish exclusion from other GovRAMP baselines.
Identification and Authentication · Base control
IA-9 · Service Identification and Authentication
Control statement and discussion
NIST control statement
Uniquely identify and authenticate [Assignment: system services and applications] before establishing communications with devices, users, or other services or applications.
Discussion
Services that may require identification and authentication include web applications using digital certificates or services or applications that query a database. Identification and authentication methods for system services and applications include information or code signing, provenance graphs, and electronic signatures that indicate the sources of services. Decisions regarding the validity of identification and authentication claims can be made by services separate from the services acting on those decisions. This can occur in distributed system architectures. In such situations, the identification and authentication decisions (instead of actual identifiers and authentication data) are provided to the services that need to act on those decisions.
GovRAMP crosswalk
Not selected in the imported Snapshot or Core sets. This does not establish exclusion from other GovRAMP baselines.
Identification and Authentication · Base control
IA-10 · Adaptive Authentication
Control statement and discussion
NIST control statement
Require individuals accessing the system to employ [Assignment: supplemental authentication techniques or mechanisms] under specific [Assignment: circumstances or situations].
Discussion
Adversaries may compromise individual authentication mechanisms employed by organizations and subsequently attempt to impersonate legitimate users. To address this threat, organizations may employ specific techniques or mechanisms and establish protocols to assess suspicious behavior. Suspicious behavior may include accessing information that individuals do not typically access as part of their duties, roles, or responsibilities; accessing greater quantities of information than individuals would routinely access; or attempting to access information from suspicious network addresses. When pre-established conditions or triggers occur, organizations can require individuals to provide additional authentication information. Another potential use for adaptive authentication is to increase the strength of mechanism based on the number or types of records being accessed. Adaptive authentication does not replace and is not used to avoid the use of multi-factor authentication mechanisms but can augment implementations of multi-factor authentication.
GovRAMP crosswalk
Not selected in the imported Snapshot or Core sets. This does not establish exclusion from other GovRAMP baselines.
Identification and Authentication · Base control
IA-11 · Re-authentication
Control statement and discussion
NIST control statement
Require users to re-authenticate when [Assignment: circumstances or situations].
Discussion
In addition to the re-authentication requirements associated with device locks, organizations may require re-authentication of individuals in certain situations, including when roles, authenticators or credentials change, when security categories of systems change, when the execution of privileged functions occurs, after a fixed time period, or periodically.
GovRAMP crosswalk
- GovRAMP Moderate Readiness · IA-11 — Direct NIST identifier reference. GovRAMP source matrix
Identification and Authentication · Base control
IA-12 · Identity Proofing
Control statement and discussion
NIST control statement
a. Identity proof users that require accounts for logical access to systems based on appropriate identity assurance level requirements as specified in applicable standards and guidelines;
b. Resolve user identities to a unique individual; and
c. Collect, validate, and verify identity evidence.
Discussion
Identity proofing is the process of collecting, validating, and verifying a user’s identity information for the purposes of establishing credentials for accessing a system. Identity proofing is intended to mitigate threats to the registration of users and the establishment of their accounts. Standards and guidelines specifying identity assurance levels for identity proofing include [SP 800-63-3](#737513fa-6758-403f-831d-5ddab5e23cb3) and [SP 800-63A](#9099ed2c-922a-493d-bcb4-d896192243ff) . Organizations may be subject to laws, executive orders, directives, regulations, or policies that address the collection of identity evidence. Organizational personnel consult with the senior agency official for privacy and legal counsel regarding such requirements.
GovRAMP crosswalk
- GovRAMP Moderate Readiness · IA-12 — Direct NIST identifier reference. GovRAMP source matrix
Identification and Authentication · Enhancement
IA-12(1) · Supervisor Authorization
View parent controlControl statement and discussion
NIST control statement
Require that the registration process to receive an account for logical access includes supervisor or sponsor authorization.
Discussion
Including supervisor or sponsor authorization as part of the registration process provides an additional level of scrutiny to ensure that the user’s management chain is aware of the account, the account is essential to carry out organizational missions and functions, and the user’s privileges are appropriate for the anticipated responsibilities and authorities within the organization.
GovRAMP crosswalk
Not selected in the imported Snapshot or Core sets. This does not establish exclusion from other GovRAMP baselines.
Identification and Authentication · Enhancement
IA-12(2) · Identity Evidence
View parent controlControl statement and discussion
NIST control statement
Require evidence of individual identification be presented to the registration authority.
Discussion
Identity evidence, such as documentary evidence or a combination of documents and biometrics, reduces the likelihood of individuals using fraudulent identification to establish an identity or at least increases the work factor of potential adversaries. The forms of acceptable evidence are consistent with the risks to the systems, roles, and privileges associated with the user’s account.
GovRAMP crosswalk
- GovRAMP Moderate Readiness · IA-12 (2) — Direct NIST identifier reference. GovRAMP source matrix
Identification and Authentication · Enhancement
IA-12(3) · Identity Evidence Validation and Verification
View parent controlControl statement and discussion
NIST control statement
Require that the presented identity evidence be validated and verified through [Assignment: methods of validation and verification].
Discussion
Validation and verification of identity evidence increases the assurance that accounts and identifiers are being established for the correct user and authenticators are being bound to that user. Validation refers to the process of confirming that the evidence is genuine and authentic, and the data contained in the evidence is correct, current, and related to an individual. Verification confirms and establishes a linkage between the claimed identity and the actual existence of the user presenting the evidence. Acceptable methods for validating and verifying identity evidence are consistent with the risks to the systems, roles, and privileges associated with the users account.
GovRAMP crosswalk
- GovRAMP Moderate Readiness · IA-12 (3) — Direct NIST identifier reference. GovRAMP source matrix
Identification and Authentication · Enhancement
IA-12(4) · In-person Validation and Verification
View parent controlControl statement and discussion
NIST control statement
Require that the validation and verification of identity evidence be conducted in person before a designated registration authority.
Discussion
In-person proofing reduces the likelihood of fraudulent credentials being issued because it requires the physical presence of individuals, the presentation of physical identity documents, and actual face-to-face interactions with designated registration authorities.
GovRAMP crosswalk
Not selected in the imported Snapshot or Core sets. This does not establish exclusion from other GovRAMP baselines.
Identification and Authentication · Enhancement
IA-12(5) · Address Confirmation
View parent controlControl statement and discussion
NIST control statement
Require that a [Selection (one): registration code; notice of proofing] be delivered through an out-of-band channel to verify the users address (physical or digital) of record.
Discussion
To make it more difficult for adversaries to pose as legitimate users during the identity proofing process, organizations can use out-of-band methods to ensure that the individual associated with an address of record is the same individual that participated in the registration. Confirmation can take the form of a temporary enrollment code or a notice of proofing. The delivery address for these artifacts is obtained from records and not self-asserted by the user. The address can include a physical or digital address. A home address is an example of a physical address. Email addresses and telephone numbers are examples of digital addresses.
GovRAMP crosswalk
- GovRAMP Moderate Readiness · IA-12 (5) — Direct NIST identifier reference. GovRAMP source matrix
Identification and Authentication · Enhancement
IA-12(6) · Accept Externally-proofed Identities
View parent controlControl statement and discussion
NIST control statement
Accept externally-proofed identities at [Assignment: identity assurance level].
Discussion
To limit unnecessary re-proofing of identities, particularly of non-PIV users, organizations accept proofing conducted at a commensurate level of assurance by other agencies or organizations. Proofing is consistent with organizational security policy and the identity assurance level appropriate for the system, application, or information accessed. Accepting externally-proofed identities is a fundamental component of managing federated identities across agencies and organizations.
GovRAMP crosswalk
Not selected in the imported Snapshot or Core sets. This does not establish exclusion from other GovRAMP baselines.
Identification and Authentication · Base control
IA-13 · Identity Providers and Authorization Servers
Control statement and discussion
NIST control statement
Employ identity providers and authorization servers to manage user, device, and non-person entity (NPE) identities, attributes, and access rights supporting authentication and authorization decisions in accordance with [Assignment: policy] using [Assignment: mechanisms].
Discussion
Identity providers, both internal and external to the organization, manage the user, device, and NPE authenticators and issue statements, often called identity assertions, attesting to identities of other systems or systems components. Authorization servers create and issue access tokens to identified and authenticated users and devices that can be used to gain access to system or information resources. For example, single sign-on (SSO) provides identity provider and authorization server functions. Authenticator management (to include credential management) is covered by IA-05.
GovRAMP crosswalk
Not selected in the imported Snapshot or Core sets. This does not establish exclusion from other GovRAMP baselines.
Identification and Authentication · Enhancement
IA-13(1) · Protection of Cryptographic Keys
View parent controlControl statement and discussion
NIST control statement
Cryptographic keys that protect access tokens are generated, managed, and protected from disclosure and misuse.
Discussion
Identity assertions and access tokens are typically digitally signed. The private keys used to sign these assertions and tokens are protected commensurate with the impact of the system and information resources that can be accessed.
GovRAMP crosswalk
Not selected in the imported Snapshot or Core sets. This does not establish exclusion from other GovRAMP baselines.
Identification and Authentication · Enhancement
IA-13(2) · Verification of Identity Assertions and Access Tokens
View parent controlControl statement and discussion
NIST control statement
The source and integrity of identity assertions and access tokens are verified before granting access to system and information resources.
Discussion
This includes verification of digital signatures protecting identity assertions and access tokens, as well as included metadata. Metadata includes information about the access request such as information unique to user, system or information resource being accessed, or the transaction itself such as time. Protected system and information resources could include connected networks, applications, and APIs.
GovRAMP crosswalk
Not selected in the imported Snapshot or Core sets. This does not establish exclusion from other GovRAMP baselines.
Identification and Authentication · Enhancement
IA-13(3) · Token Management
View parent controlControl statement and discussion
NIST control statement
In accordance with [Assignment: policy], assertions and access tokens are:
(a) generated;
(b) issued;
(c) refreshed;
(d) revoked;
(e) time-restricted; and
(f) audience-restricted.
Discussion
An access token is a piece of data that represents the authorization granted to a user or NPE to access specific systems or information resources. Access tokens enable controlled access to services and resources. Properly managing the lifecycle of access tokens, including their issuance, validation, and revocation, is crucial to maintaining confidentiality of data and systems. Restricting token validity to a specific audience, e.g., an application or security domain, and restricting token validity lifetimes are important practices. Access tokens are revoked or invalidated if they are compromised, lost, or are no longer needed to mitigate the risks associated with stolen or misused tokens.
GovRAMP crosswalk
Not selected in the imported Snapshot or Core sets. This does not establish exclusion from other GovRAMP baselines.
Incident Response · Base control
IR-1 · Policy and Procedures
Control statement and discussion
NIST control statement
a. Develop, document, and disseminate to [Assignment: organization-defined personnel or roles]:
1. [Selection (one-or-more): organization-level; mission/business process-level; system-level] incident response policy that:
(a) Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
(b) Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and
2. Procedures to facilitate the implementation of the incident response policy and the associated incident response controls;
b. Designate an [Assignment: official] to manage the development, documentation, and dissemination of the incident response policy and procedures; and
c. Review and update the current incident response:
1. Policy [Assignment: frequency] and following [Assignment: events] ; and
2. Procedures [Assignment: frequency] and following [Assignment: events].
Discussion
Incident response policy and procedures address the controls in the IR family that are implemented within systems and organizations. The risk management strategy is an important factor in establishing such policies and procedures. Policies and procedures contribute to security and privacy assurance. Therefore, it is important that security and privacy programs collaborate on the development of incident response policy and procedures. Security and privacy program policies and procedures at the organization level are preferable, in general, and may obviate the need for mission- or system-specific policies and procedures. The policy can be included as part of the general security and privacy policy or be represented by multiple policies that reflect the complex nature of organizations. Procedures can be established for security and privacy programs, for mission or business processes, and for systems, if needed. Procedures describe how the policies or controls are implemented and can be directed at the individual or role that is the object of the procedure. Procedures can be documented in system security and privacy plans or in one or more separate documents. Events that may precipitate an update to incident response policy and procedures include assessment or audit findings, security incidents or breaches, or changes in laws, executive orders, directives, regulations, policies, standards, and guidelines. Simply restating controls does not constitute an organizational policy or procedure.
GovRAMP crosswalk
- GovRAMP Moderate Readiness · IR-1 — Direct NIST identifier reference. GovRAMP source matrix
Incident Response · Base control
IR-2 · Incident Response Training
Control statement and discussion
NIST control statement
a. Provide incident response training to system users consistent with assigned roles and responsibilities:
1. Within [Assignment: time period] of assuming an incident response role or responsibility or acquiring system access;
2. When required by system changes; and
3. [Assignment: frequency] thereafter; and
b. Review and update incident response training content [Assignment: frequency] and following [Assignment: events].
Discussion
Incident response training is associated with the assigned roles and responsibilities of organizational personnel to ensure that the appropriate content and level of detail are included in such training. For example, users may only need to know who to call or how to recognize an incident; system administrators may require additional training on how to handle incidents; and incident responders may receive more specific training on forensics, data collection techniques, reporting, system recovery, and system restoration. Incident response training includes user training in identifying and reporting suspicious activities from external and internal sources. Incident response training for users may be provided as part of [AT-2](#at-2) or [AT-3](#at-3) . Events that may precipitate an update to incident response training content include, but are not limited to, incident response plan testing or response to an actual incident (lessons learned), assessment or audit findings, or changes in applicable laws, executive orders, directives, regulations, policies, standards, and guidelines.
GovRAMP crosswalk
- GovRAMP Moderate Readiness · IR-2 — Direct NIST identifier reference. GovRAMP source matrix
Incident Response · Enhancement
IR-2(1) · Simulated Events
View parent controlControl statement and discussion
NIST control statement
Incorporate simulated events into incident response training to facilitate the required response by personnel in crisis situations.
Discussion
Organizations establish requirements for responding to incidents in incident response plans. Incorporating simulated events into incident response training helps to ensure that personnel understand their individual responsibilities and what specific actions to take in crisis situations.
GovRAMP crosswalk
Not selected in the imported Snapshot or Core sets. This does not establish exclusion from other GovRAMP baselines.
Incident Response · Enhancement
IR-2(2) · Automated Training Environments
View parent controlControl statement and discussion
NIST control statement
Provide an incident response training environment using [Assignment: automated mechanisms].
Discussion
Automated mechanisms can provide a more thorough and realistic incident response training environment. This can be accomplished, for example, by providing more complete coverage of incident response issues, selecting more realistic training scenarios and environments, and stressing the response capability.
GovRAMP crosswalk
Not selected in the imported Snapshot or Core sets. This does not establish exclusion from other GovRAMP baselines.
Incident Response · Enhancement
IR-2(3) · Breach
View parent controlControl statement and discussion
NIST control statement
Provide incident response training on how to identify and respond to a breach, including the organization’s process for reporting a breach.
Discussion
For federal agencies, an incident that involves personally identifiable information is considered a breach. A breach results in the loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or a similar occurrence where a person other than an authorized user accesses or potentially accesses personally identifiable information or an authorized user accesses or potentially accesses such information for other than authorized purposes. The incident response training emphasizes the obligation of individuals to report both confirmed and suspected breaches involving information in any medium or form, including paper, oral, and electronic. Incident response training includes tabletop exercises that simulate a breach. See [IR-2(1)](#ir-2.1).
GovRAMP crosswalk
Not selected in the imported Snapshot or Core sets. This does not establish exclusion from other GovRAMP baselines.
Incident Response · Base control
IR-3 · Incident Response Testing
Control statement and discussion
NIST control statement
Test the effectiveness of the incident response capability for the system [Assignment: frequency] using the following tests: [Assignment: tests].
Discussion
Organizations test incident response capabilities to determine their effectiveness and identify potential weaknesses or deficiencies. Incident response testing includes the use of checklists, walk-through or tabletop exercises, and simulations (parallel or full interrupt). Incident response testing can include a determination of the effects on organizational operations and assets and individuals due to incident response. The use of qualitative and quantitative data aids in determining the effectiveness of incident response processes.
GovRAMP crosswalk
- GovRAMP Core Readiness — 60 Controls · IR-3 — Direct NIST identifier reference. GovRAMP source matrix
- GovRAMP Moderate Readiness · IR-3 — Direct NIST identifier reference. GovRAMP source matrix
Incident Response · Enhancement
IR-3(1) · Automated Testing
View parent controlControl statement and discussion
NIST control statement
Test the incident response capability using [Assignment: automated mechanisms].
Discussion
Organizations use automated mechanisms to more thoroughly and effectively test incident response capabilities. This can be accomplished by providing more complete coverage of incident response issues, selecting realistic test scenarios and environments, and stressing the response capability.
GovRAMP crosswalk
Not selected in the imported Snapshot or Core sets. This does not establish exclusion from other GovRAMP baselines.
Incident Response · Enhancement
IR-3(2) · Coordination with Related Plans
View parent controlControl statement and discussion
NIST control statement
Coordinate incident response testing with organizational elements responsible for related plans.
Discussion
Organizational plans related to incident response testing include business continuity plans, disaster recovery plans, continuity of operations plans, contingency plans, crisis communications plans, critical infrastructure plans, and occupant emergency plans.
GovRAMP crosswalk
- GovRAMP Moderate Readiness · IR-3 (2) — Direct NIST identifier reference. GovRAMP source matrix
Incident Response · Enhancement
IR-3(3) · Continuous Improvement
View parent controlControl statement and discussion
NIST control statement
Use qualitative and quantitative data from testing to:
(a) Determine the effectiveness of incident response processes;
(b) Continuously improve incident response processes; and
(c) Provide incident response measures and metrics that are accurate, consistent, and in a reproducible format.
Discussion
To help incident response activities function as intended, organizations may use metrics and evaluation criteria to assess incident response programs as part of an effort to continually improve response performance. These efforts facilitate improvement in incident response efficacy and lessen the impact of incidents.
GovRAMP crosswalk
Not selected in the imported Snapshot or Core sets. This does not establish exclusion from other GovRAMP baselines.
