FedRAMP Controls & NIST 800-53

What you will be able to do

• Navigate the NIST SP 800-53 Rev 5 catalog and read any control, enhancement, and parameter with confidence.
• Categorize a cloud system with FIPS 199 and select the matching FedRAMP baseline (Low, Moderate, or High).
• Explain what FedRAMP adds on top of the NIST 800-53B baselines, including added controls and assigned parameter values.
• Tailor a baseline using organization-defined parameters, scoping decisions, and compensating controls that hold up under review.
• Map inherited, shared, and customer-responsible controls across a leveraged authorization and a Customer Responsibility Matrix.
• Write control implementation statements in the FedRAMP SSP template that a 3PAO assessor can actually test.
• Assemble the SSP and its attachments into a control package that is ready for assessment.

What is inside

4 modules, 8 lessons. Each module ends in a graded quiz and most carry an assignment.

1. 01

   The FedRAMP Program and the 800-53 Catalog

   FedRAMP is how the federal government authorizes a cloud service once and lets many agencies reuse that decision, and NIST SP 800-53 is the control catalog it runs on. This module sets the landscape. Lesson 1 explains how FedRAMP works: the authorization paths, the Risk Management Framework underneath them, and the four roles you work alongside (CSP, 3PAO, PMO, and AO). Lesson 2 teaches you to read the 800-53 Rev 5 catalog itself, from the 20 control families down to identifiers, base controls, enhancements, and the parameters FedRAMP fills in. By the end you can place any task in its RMF step and read any control number on sight.

   2 lessons · 5 quiz questions

2. 02

   Categorization and the Low, Moderate, High Baselines

   Every FedRAMP package begins with one decision that shapes everything after it: how much harm would follow if this system's data leaked, was altered, or went dark. This module teaches you to answer that question the way a FedRAMP Analyst must. You will apply FIPS 199 and NIST SP 800-60 to fix a system's confidentiality, integrity, and availability impacts, resolve them into a single impact level with the high-water mark, and map that level to the correct FedRAMP baseline. You will see exactly how the Low, Moderate, and High baselines differ in control count and rigor, learn when the LI-SaaS tailored baseline applies, and understand how this one categorization decision drives the entire control set you will later implement and assess.

   2 lessons · 5 quiz questions · assignment

3. 03

   Tailoring and Inheritance

   A FedRAMP baseline is a starting point, not a finished control set. This module covers how FedRAMP tailors 800-53 with assigned parameter values and added controls, how to apply organization-defined parameters, scoping, and compensating controls, and how to account for controls you inherit through leveraged authorizations and the Customer Responsibility Matrix.

   2 lessons · 5 quiz questions

4. 04

   Documenting Controls in the System Security Plan

   The SSP is where control selection becomes an authorization package. This module teaches you to write implementation statements in the FedRAMP SSP template that say who does what and can actually be tested, to set implementation status honestly, and to assemble the SSP with its attachments, CIS, and CRM so it is ready for the 3PAO assessment.

   2 lessons · 5 quiz questions · assignment