Browse 1,193 controls and enhancements across 20 security and privacy families. Use the GovRAMP crosswalk to locate controls referenced by Security Snapshot, Core, and Moderate.
A shared catalog supports common-control planning; designation as a common, hybrid, or system-specific control depends on your organization’s implementation and inheritance decisions.
Sources and crosswalk scope
NIST OSCAL content 5.1.1+u4, retrieved 2026-09-18. GovRAMP Snapshot v1.4 and Core selection from Moderate v1.06 reference the December 2020 Rev. 5 text. Mappings establish exact identifier correspondence, not identical requirements, inherited implementation, or GovRAMP authorization. GovRAMP parameters and additional requirements remain authoritative for each program. Full Moderate, High, and other programs are not mapped here. Withdrawn controls are retained for reference.
Respond to information spills by:
a. Assigning [Assignment: personnel or roles] with responsibility for responding to information spills;
b. Identifying the specific information involved in the system contamination;
c. Alerting [Assignment: personnel or roles] of the information spill using a method of communication not associated with the spill;
d. Isolating the contaminated system or system component;
e. Eradicating the information from the contaminated system or component;
f. Identifying other systems or system components that may have been subsequently contaminated; and
g. Performing the following additional actions: [Assignment: actions].
Discussion
Information spillage refers to instances where information is placed on systems that are not authorized to process such information. Information spills occur when information that is thought to be a certain classification or impact level is transmitted to a system and subsequently is determined to be of a higher classification or impact level. At that point, corrective action is required. The nature of the response is based on the classification or impact level of the spilled information, the security capabilities of the system, the specific nature of the contaminated storage media, and the access authorizations of individuals with authorized access to the contaminated system. The methods used to communicate information about the spill after the fact do not involve methods directly associated with the actual spill to minimize the risk of further spreading the contamination before such contamination is isolated and eradicated.
GovRAMP crosswalk
GovRAMP Moderate Readiness · IR-9 — Direct NIST identifier reference. GovRAMP source matrix
Provide information spillage response training [Assignment: frequency].
Discussion
Organizations establish requirements for responding to information spillage incidents in incident response plans. Incident response training on a regular basis helps to ensure that organizational personnel understand their individual responsibilities and what specific actions to take when spillage incidents occur.
GovRAMP crosswalk
GovRAMP Moderate Readiness · IR-9 (2) — Direct NIST identifier reference. GovRAMP source matrix
Implement the following procedures to ensure that organizational personnel impacted by information spills can continue to carry out assigned tasks while contaminated systems are undergoing corrective actions: [Assignment: procedures].
Discussion
Corrective actions for systems contaminated due to information spillages may be time-consuming. Personnel may not have access to the contaminated systems while corrective actions are being taken, which may potentially affect their ability to conduct organizational business.
GovRAMP crosswalk
GovRAMP Moderate Readiness · IR-9 (3) — Direct NIST identifier reference. GovRAMP source matrix
Employ the following controls for personnel exposed to information not within assigned access authorizations: [Assignment: controls].
Discussion
Controls include ensuring that personnel who are exposed to spilled information are made aware of the laws, executive orders, directives, regulations, policies, standards, and guidelines regarding the information and the restrictions imposed based on exposure to such information.
GovRAMP crosswalk
GovRAMP Moderate Readiness · IR-9 (4) — Direct NIST identifier reference. GovRAMP source matrix
