FedRAMP Controls / CM
CM-3(4) Security and Privacy Representatives
Family CM
Baselines moderate
Mapped KSIs 3
Control statement
Require {{ insert: param, cm-3.4_prm_1 }} to be members of the {{ insert: param, cm-03.04_odp.03 }}. Parameter placeholders {{ insert: param, … }} reference FedRAMP-set values in the resolved profile. Full parameter map is
preserved in the catalog database.
Covered by these Key Security Indicators
| KSI | Title | Category |
|---|---|---|
| KSI-AFR-05 | Significant Change Notifications Determine how significant changes will be tracked and how all necessary parties will be notified in alignment with the FedRAMP Significant Change Notifications (SCN) process and persistently address all related requirements and recommendations. | Authorization by FedRAMP |
| KSI-CMT-04 | Change Management Procedures _Persistently_ review the effectiveness of documented change management procedures. | Change Management |
| KSI-PIY-04 | CISA Secure By Design _Persistently_ review the effectiveness of building security and privacy considerations into the Software Development Lifecycle and aligning with CISA Secure By Design principles. | Policy and Inventory |