Browse 1,193 controls and enhancements across 20 security and privacy families. Use the GovRAMP crosswalk to locate controls referenced by Security Snapshot, Core, and Moderate.
A shared catalog supports common-control planning; designation as a common, hybrid, or system-specific control depends on your organization’s implementation and inheritance decisions.
Sources and crosswalk scope
NIST OSCAL content 5.1.1+u4, retrieved 2026-09-18. GovRAMP Snapshot v1.4 and Core selection from Moderate v1.06 reference the December 2020 Rev. 5 text. Mappings establish exact identifier correspondence, not identical requirements, inherited implementation, or GovRAMP authorization. GovRAMP parameters and additional requirements remain authoritative for each program. Full Moderate, High, and other programs are not mapped here. Withdrawn controls are retained for reference.
Official pinned NIST sourceSHA-256: 81cf2de45ede9aef3de7ce09d65ea9d32f662c483bbf916f6e346292b22f7763
Incident Response · Base control
IR-8 · Incident Response Plan
Control statement and discussion
NIST control statement
a. Develop an incident response plan that:
1. Provides the organization with a roadmap for implementing its incident response capability;
2. Describes the structure and organization of the incident response capability;
3. Provides a high-level approach for how the incident response capability fits into the overall organization;
4. Meets the unique requirements of the organization, which relate to mission, size, structure, and functions;
5. Defines reportable incidents;
6. Provides metrics for measuring the incident response capability within the organization;
7. Defines the resources and management support needed to effectively maintain and mature an incident response capability;
8. Addresses the sharing of incident information;
9. Is reviewed and approved by [Assignment: personnel or roles] [Assignment: frequency] ; and
10. Explicitly designates responsibility for incident response to [Assignment: entities, personnel, or roles].
b. Distribute copies of the incident response plan to [Assignment: incident response personnel];
c. Update the incident response plan to address system and organizational changes or problems encountered during plan implementation, execution, or testing;
d. Communicate incident response plan changes to [Assignment: organization-defined incident response personnel (identified by name and/or by role) and organizational elements] ; and
e. Protect the incident response plan from unauthorized disclosure and modification.
Discussion
It is important that organizations develop and implement a coordinated approach to incident response. Organizational mission and business functions determine the structure of incident response capabilities. As part of the incident response capabilities, organizations consider the coordination and sharing of information with external organizations, including external service providers and other organizations involved in the supply chain. For incidents involving personally identifiable information (i.e., breaches), include a process to determine whether notice to oversight organizations or affected individuals is appropriate and provide that notice accordingly.
GovRAMP crosswalk
- GovRAMP Core Readiness — 60 Controls · IR-8 — Direct NIST identifier reference. GovRAMP source matrix
- GovRAMP Moderate Readiness · IR-8 — Direct NIST identifier reference. GovRAMP source matrix
Incident Response · Enhancement
IR-8(1) · Breaches
View parent controlControl statement and discussion
NIST control statement
Include the following in the Incident Response Plan for breaches involving personally identifiable information:
(a) A process to determine if notice to individuals or other organizations, including oversight organizations, is needed;
(b) An assessment process to determine the extent of the harm, embarrassment, inconvenience, or unfairness to affected individuals and any mechanisms to mitigate such harms; and
(c) Identification of applicable privacy requirements.
Discussion
Organizations may be required by law, regulation, or policy to follow specific procedures relating to breaches, including notice to individuals, affected organizations, and oversight bodies; standards of harm; and mitigation or other specific requirements.
GovRAMP crosswalk
Not selected in the imported Snapshot or Core sets. This does not establish exclusion from other GovRAMP baselines.
Incident Response · Base control
IR-9 · Information Spillage Response
Control statement and discussion
NIST control statement
Respond to information spills by:
a. Assigning [Assignment: personnel or roles] with responsibility for responding to information spills;
b. Identifying the specific information involved in the system contamination;
c. Alerting [Assignment: personnel or roles] of the information spill using a method of communication not associated with the spill;
d. Isolating the contaminated system or system component;
e. Eradicating the information from the contaminated system or component;
f. Identifying other systems or system components that may have been subsequently contaminated; and
g. Performing the following additional actions: [Assignment: actions].
Discussion
Information spillage refers to instances where information is placed on systems that are not authorized to process such information. Information spills occur when information that is thought to be a certain classification or impact level is transmitted to a system and subsequently is determined to be of a higher classification or impact level. At that point, corrective action is required. The nature of the response is based on the classification or impact level of the spilled information, the security capabilities of the system, the specific nature of the contaminated storage media, and the access authorizations of individuals with authorized access to the contaminated system. The methods used to communicate information about the spill after the fact do not involve methods directly associated with the actual spill to minimize the risk of further spreading the contamination before such contamination is isolated and eradicated.
GovRAMP crosswalk
- GovRAMP Moderate Readiness · IR-9 — Direct NIST identifier reference. GovRAMP source matrix
Incident Response · Enhancement
IR-9(2) · Training
View parent controlControl statement and discussion
NIST control statement
Provide information spillage response training [Assignment: frequency].
Discussion
Organizations establish requirements for responding to information spillage incidents in incident response plans. Incident response training on a regular basis helps to ensure that organizational personnel understand their individual responsibilities and what specific actions to take when spillage incidents occur.
GovRAMP crosswalk
- GovRAMP Moderate Readiness · IR-9 (2) — Direct NIST identifier reference. GovRAMP source matrix
Incident Response · Enhancement
IR-9(3) · Post-spill Operations
View parent controlControl statement and discussion
NIST control statement
Implement the following procedures to ensure that organizational personnel impacted by information spills can continue to carry out assigned tasks while contaminated systems are undergoing corrective actions: [Assignment: procedures].
Discussion
Corrective actions for systems contaminated due to information spillages may be time-consuming. Personnel may not have access to the contaminated systems while corrective actions are being taken, which may potentially affect their ability to conduct organizational business.
GovRAMP crosswalk
- GovRAMP Moderate Readiness · IR-9 (3) — Direct NIST identifier reference. GovRAMP source matrix
Incident Response · Enhancement
IR-9(4) · Exposure to Unauthorized Personnel
View parent controlControl statement and discussion
NIST control statement
Employ the following controls for personnel exposed to information not within assigned access authorizations: [Assignment: controls].
Discussion
Controls include ensuring that personnel who are exposed to spilled information are made aware of the laws, executive orders, directives, regulations, policies, standards, and guidelines regarding the information and the restrictions imposed based on exposure to such information.
GovRAMP crosswalk
- GovRAMP Moderate Readiness · IR-9 (4) — Direct NIST identifier reference. GovRAMP source matrix
Maintenance · Base control
MA-1 · Policy and Procedures
Control statement and discussion
NIST control statement
a. Develop, document, and disseminate to [Assignment: organization-defined personnel or roles]:
1. [Selection (one-or-more): organization-level; mission/business process-level; system-level] maintenance policy that:
(a) Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
(b) Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and
2. Procedures to facilitate the implementation of the maintenance policy and the associated maintenance controls;
b. Designate an [Assignment: official] to manage the development, documentation, and dissemination of the maintenance policy and procedures; and
c. Review and update the current maintenance:
1. Policy [Assignment: frequency] and following [Assignment: events] ; and
2. Procedures [Assignment: frequency] and following [Assignment: events].
Discussion
Maintenance policy and procedures address the controls in the MA family that are implemented within systems and organizations. The risk management strategy is an important factor in establishing such policies and procedures. Policies and procedures contribute to security and privacy assurance. Therefore, it is important that security and privacy programs collaborate on the development of maintenance policy and procedures. Security and privacy program policies and procedures at the organization level are preferable, in general, and may obviate the need for mission- or system-specific policies and procedures. The policy can be included as part of the general security and privacy policy or be represented by multiple policies that reflect the complex nature of organizations. Procedures can be established for security and privacy programs, for mission or business processes, and for systems, if needed. Procedures describe how the policies or controls are implemented and can be directed at the individual or role that is the object of the procedure. Procedures can be documented in system security and privacy plans or in one or more separate documents. Events that may precipitate an update to maintenance policy and procedures assessment or audit findings, security incidents or breaches, or changes in applicable laws, executive orders, directives, regulations, policies, standards, and guidelines. Simply restating controls does not constitute an organizational policy or procedure.
GovRAMP crosswalk
- GovRAMP Moderate Readiness · MA-1 — Direct NIST identifier reference. GovRAMP source matrix
Maintenance · Base control
MA-2 · Controlled Maintenance
Control statement and discussion
NIST control statement
a. Schedule, document, and review records of maintenance, repair, and replacement on system components in accordance with manufacturer or vendor specifications and/or organizational requirements;
b. Approve and monitor all maintenance activities, whether performed on site or remotely and whether the system or system components are serviced on site or removed to another location;
c. Require that [Assignment: personnel or roles] explicitly approve the removal of the system or system components from organizational facilities for off-site maintenance, repair, or replacement;
d. Sanitize equipment to remove the following information from associated media prior to removal from organizational facilities for off-site maintenance, repair, or replacement: [Assignment: information];
e. Check all potentially impacted controls to verify that the controls are still functioning properly following maintenance, repair, or replacement actions; and
f. Include the following information in organizational maintenance records: [Assignment: information].
Discussion
Controlling system maintenance addresses the information security aspects of the system maintenance program and applies to all types of maintenance to system components conducted by local or nonlocal entities. Maintenance includes peripherals such as scanners, copiers, and printers. Information necessary for creating effective maintenance records includes the date and time of maintenance, a description of the maintenance performed, names of the individuals or group performing the maintenance, name of the escort, and system components or equipment that are removed or replaced. Organizations consider supply chain-related risks associated with replacement components for systems.
GovRAMP crosswalk
- GovRAMP Moderate Readiness · MA-2 — Direct NIST identifier reference. GovRAMP source matrix
Maintenance · Enhancement
MA-2(2) · Automated Maintenance Activities
View parent controlControl statement and discussion
NIST control statement
(a) Schedule, conduct, and document maintenance, repair, and replacement actions for the system using [Assignment: organization-defined automated mechanisms] ; and
(b) Produce up-to date, accurate, and complete records of all maintenance, repair, and replacement actions requested, scheduled, in process, and completed.
Discussion
The use of automated mechanisms to manage and control system maintenance programs and activities helps to ensure the generation of timely, accurate, complete, and consistent maintenance records.
GovRAMP crosswalk
Not selected in the imported Snapshot or Core sets. This does not establish exclusion from other GovRAMP baselines.
Maintenance · Base control
MA-3 · Maintenance Tools
Control statement and discussion
NIST control statement
a. Approve, control, and monitor the use of system maintenance tools; and
b. Review previously approved system maintenance tools [Assignment: frequency].
Discussion
Approving, controlling, monitoring, and reviewing maintenance tools address security-related issues associated with maintenance tools that are not within system authorization boundaries and are used specifically for diagnostic and repair actions on organizational systems. Organizations have flexibility in determining roles for the approval of maintenance tools and how that approval is documented. A periodic review of maintenance tools facilitates the withdrawal of approval for outdated, unsupported, irrelevant, or no-longer-used tools. Maintenance tools can include hardware, software, and firmware items and may be pre-installed, brought in with maintenance personnel on media, cloud-based, or downloaded from a website. Such tools can be vehicles for transporting malicious code, either intentionally or unintentionally, into a facility and subsequently into systems. Maintenance tools can include hardware and software diagnostic test equipment and packet sniffers. The hardware and software components that support maintenance and are a part of the system (including the software implementing utilities such as "ping," "ls," "ipconfig," or the hardware and software implementing the monitoring port of an Ethernet switch) are not addressed by maintenance tools.
GovRAMP crosswalk
- GovRAMP Security Snapshot Readiness · MA-3 — Direct NIST identifier reference. GovRAMP source matrix
- GovRAMP Core Readiness — 60 Controls · MA-3 — Direct NIST identifier reference. GovRAMP source matrix
- GovRAMP Moderate Readiness · MA-3 — Direct NIST identifier reference. GovRAMP source matrix
Maintenance · Enhancement
MA-3(1) · Inspect Tools
View parent controlControl statement and discussion
NIST control statement
Inspect the maintenance tools used by maintenance personnel for improper or unauthorized modifications.
Discussion
Maintenance tools can be directly brought into a facility by maintenance personnel or downloaded from a vendor’s website. If, upon inspection of the maintenance tools, organizations determine that the tools have been modified in an improper manner or the tools contain malicious code, the incident is handled consistent with organizational policies and procedures for incident handling.
GovRAMP crosswalk
- GovRAMP Moderate Readiness · MA-3 (1) — Direct NIST identifier reference. GovRAMP source matrix
Maintenance · Enhancement
MA-3(2) · Inspect Media
View parent controlControl statement and discussion
NIST control statement
Check media containing diagnostic and test programs for malicious code before the media are used in the system.
Discussion
If, upon inspection of media containing maintenance, diagnostic, and test programs, organizations determine that the media contains malicious code, the incident is handled consistent with organizational incident handling policies and procedures.
GovRAMP crosswalk
- GovRAMP Moderate Readiness · MA-3 (2) — Direct NIST identifier reference. GovRAMP source matrix
Maintenance · Enhancement
MA-3(3) · Prevent Unauthorized Removal
View parent controlControl statement and discussion
NIST control statement
Prevent the removal of maintenance equipment containing organizational information by:
(a) Verifying that there is no organizational information contained on the equipment;
(b) Sanitizing or destroying the equipment;
(c) Retaining the equipment within the facility; or
(d) Obtaining an exemption from [Assignment: personnel or roles] explicitly authorizing removal of the equipment from the facility.
Discussion
Organizational information includes all information owned by organizations and any information provided to organizations for which the organizations serve as information stewards.
GovRAMP crosswalk
- GovRAMP Moderate Readiness · MA-3 (3) — Direct NIST identifier reference. GovRAMP source matrix
Maintenance · Enhancement
MA-3(4) · Restricted Tool Use
View parent controlControl statement and discussion
NIST control statement
Restrict the use of maintenance tools to authorized personnel only.
Discussion
Restricting the use of maintenance tools to only authorized personnel applies to systems that are used to carry out maintenance functions.
GovRAMP crosswalk
Not selected in the imported Snapshot or Core sets. This does not establish exclusion from other GovRAMP baselines.
Maintenance · Enhancement
MA-3(5) · Execution with Privilege
View parent controlControl statement and discussion
NIST control statement
Monitor the use of maintenance tools that execute with increased privilege.
Discussion
Maintenance tools that execute with increased system privilege can result in unauthorized access to organizational information and assets that would otherwise be inaccessible.
GovRAMP crosswalk
Not selected in the imported Snapshot or Core sets. This does not establish exclusion from other GovRAMP baselines.
Maintenance · Enhancement
MA-3(6) · Software Updates and Patches
View parent controlControl statement and discussion
NIST control statement
Inspect maintenance tools to ensure the latest software updates and patches are installed.
Discussion
Maintenance tools using outdated and/or unpatched software can provide a threat vector for adversaries and result in a significant vulnerability for organizations.
GovRAMP crosswalk
Not selected in the imported Snapshot or Core sets. This does not establish exclusion from other GovRAMP baselines.
Maintenance · Base control
MA-4 · Nonlocal Maintenance
Control statement and discussion
NIST control statement
a. Approve and monitor nonlocal maintenance and diagnostic activities;
b. Allow the use of nonlocal maintenance and diagnostic tools only as consistent with organizational policy and documented in the security plan for the system;
c. Employ strong authentication in the establishment of nonlocal maintenance and diagnostic sessions;
d. Maintain records for nonlocal maintenance and diagnostic activities; and
e. Terminate session and network connections when nonlocal maintenance is completed.
Discussion
Nonlocal maintenance and diagnostic activities are conducted by individuals who communicate through either an external or internal network. Local maintenance and diagnostic activities are carried out by individuals who are physically present at the system location and not communicating across a network connection. Authentication techniques used to establish nonlocal maintenance and diagnostic sessions reflect the network access requirements in [IA-2](#ia-2) . Strong authentication requires authenticators that are resistant to replay attacks and employ multi-factor authentication. Strong authenticators include PKI where certificates are stored on a token protected by a password, passphrase, or biometric. Enforcing requirements in [MA-4](#ma-4) is accomplished, in part, by other controls. [SP 800-63B](#e59c5a7c-8b1f-49ca-8de0-6ee0882180ce) provides additional guidance on strong authentication and authenticators.
GovRAMP crosswalk
- GovRAMP Moderate Readiness · MA-4 — Direct NIST identifier reference. GovRAMP source matrix
Maintenance · Enhancement
MA-4(1) · Logging and Review
View parent controlControl statement and discussion
NIST control statement
(a) Log [Assignment: organization-defined audit events] for nonlocal maintenance and diagnostic sessions; and
(b) Review the audit records of the maintenance and diagnostic sessions to detect anomalous behavior.
Discussion
Audit logging for nonlocal maintenance is enforced by [AU-2](#au-2) . Audit events are defined in [AU-2a](#au-2_smt.a).
GovRAMP crosswalk
Not selected in the imported Snapshot or Core sets. This does not establish exclusion from other GovRAMP baselines.
Maintenance · Enhancement
MA-4(3) · Comparable Security and Sanitization
View parent controlControl statement and discussion
NIST control statement
(a) Require that nonlocal maintenance and diagnostic services be performed from a system that implements a security capability comparable to the capability implemented on the system being serviced; or
(b) Remove the component to be serviced from the system prior to nonlocal maintenance or diagnostic services; sanitize the component (for organizational information); and after the service is performed, inspect and sanitize the component (for potentially malicious software) before reconnecting the component to the system.
Discussion
Comparable security capability on systems, diagnostic tools, and equipment providing maintenance services implies that the implemented controls on those systems, tools, and equipment are at least as comprehensive as the controls on the system being serviced.
GovRAMP crosswalk
Not selected in the imported Snapshot or Core sets. This does not establish exclusion from other GovRAMP baselines.
Maintenance · Enhancement
MA-4(4) · Authentication and Separation of Maintenance Sessions
View parent controlControl statement and discussion
NIST control statement
Protect nonlocal maintenance sessions by:
(a) Employing [Assignment: authenticators that are replay resistant] ; and
(b) Separating the maintenance sessions from other network sessions with the system by either:
(1) Physically separated communications paths; or
(2) Logically separated communications paths.
Discussion
Communications paths can be logically separated using encryption.
GovRAMP crosswalk
Not selected in the imported Snapshot or Core sets. This does not establish exclusion from other GovRAMP baselines.
Maintenance · Enhancement
MA-4(5) · Approvals and Notifications
View parent controlControl statement and discussion
NIST control statement
(a) Require the approval of each nonlocal maintenance session by [Assignment: personnel or roles] ; and
(b) Notify the following personnel or roles of the date and time of planned nonlocal maintenance: [Assignment: personnel and roles].
Discussion
Notification may be performed by maintenance personnel. Approval of nonlocal maintenance is accomplished by personnel with sufficient information security and system knowledge to determine the appropriateness of the proposed maintenance.
GovRAMP crosswalk
Not selected in the imported Snapshot or Core sets. This does not establish exclusion from other GovRAMP baselines.
Maintenance · Enhancement
MA-4(6) · Cryptographic Protection
View parent controlControl statement and discussion
NIST control statement
Implement the following cryptographic mechanisms to protect the integrity and confidentiality of nonlocal maintenance and diagnostic communications: [Assignment: cryptographic mechanisms].
Discussion
Failure to protect nonlocal maintenance and diagnostic communications can result in unauthorized individuals gaining access to organizational information. Unauthorized access during remote maintenance sessions can result in a variety of hostile actions, including malicious code insertion, unauthorized changes to system parameters, and exfiltration of organizational information. Such actions can result in the loss or degradation of mission or business capabilities.
GovRAMP crosswalk
Not selected in the imported Snapshot or Core sets. This does not establish exclusion from other GovRAMP baselines.
Maintenance · Enhancement
MA-4(7) · Disconnect Verification
View parent controlControl statement and discussion
NIST control statement
Verify session and network connection termination after the completion of nonlocal maintenance and diagnostic sessions.
Discussion
Verifying the termination of a connection once maintenance is completed ensures that connections established during nonlocal maintenance and diagnostic sessions have been terminated and are no longer available for use.
GovRAMP crosswalk
Not selected in the imported Snapshot or Core sets. This does not establish exclusion from other GovRAMP baselines.
Maintenance · Base control
MA-5 · Maintenance Personnel
Control statement and discussion
NIST control statement
a. Establish a process for maintenance personnel authorization and maintain a list of authorized maintenance organizations or personnel;
b. Verify that non-escorted personnel performing maintenance on the system possess the required access authorizations; and
c. Designate organizational personnel with required access authorizations and technical competence to supervise the maintenance activities of personnel who do not possess the required access authorizations.
Discussion
Maintenance personnel refers to individuals who perform hardware or software maintenance on organizational systems, while [PE-2](#pe-2) addresses physical access for individuals whose maintenance duties place them within the physical protection perimeter of the systems. Technical competence of supervising individuals relates to the maintenance performed on the systems, while having required access authorizations refers to maintenance on and near the systems. Individuals not previously identified as authorized maintenance personnel—such as information technology manufacturers, vendors, systems integrators, and consultants—may require privileged access to organizational systems, such as when they are required to conduct maintenance activities with little or no notice. Based on organizational assessments of risk, organizations may issue temporary credentials to these individuals. Temporary credentials may be for one-time use or for very limited time periods.
GovRAMP crosswalk
- GovRAMP Moderate Readiness · MA-5 — Direct NIST identifier reference. GovRAMP source matrix
Maintenance · Enhancement
MA-5(1) · Individuals Without Appropriate Access
View parent controlControl statement and discussion
NIST control statement
(a) Implement procedures for the use of maintenance personnel that lack appropriate security clearances or are not U.S. citizens, that include the following requirements:
(1) Maintenance personnel who do not have needed access authorizations, clearances, or formal access approvals are escorted and supervised during the performance of maintenance and diagnostic activities on the system by approved organizational personnel who are fully cleared, have appropriate access authorizations, and are technically qualified; and
(2) Prior to initiating maintenance or diagnostic activities by personnel who do not have needed access authorizations, clearances or formal access approvals, all volatile information storage components within the system are sanitized and all nonvolatile storage media are removed or physically disconnected from the system and secured; and
(b) Develop and implement [Assignment: alternate controls] in the event a system component cannot be sanitized, removed, or disconnected from the system.
Discussion
Procedures for individuals who lack appropriate security clearances or who are not U.S. citizens are intended to deny visual and electronic access to classified or controlled unclassified information contained on organizational systems. Procedures for the use of maintenance personnel can be documented in security plans for the systems.
GovRAMP crosswalk
- GovRAMP Moderate Readiness · MA-5 (1) — Direct NIST identifier reference. GovRAMP source matrix
