FedRAMP Moderate Baseline Rev 4

ActiveCore framework

Best for: FedRAMP is mandatory for federal agency cloud deployments and service models at the low, moderate, and high-risk impact levels. Companies that employ cloud technologies in products or services used by the federal government may be required to obtain an ATO.

Mandatory?	Mandatory for CSPs selling to U.S. federal agencies
Who validates?	3PAO (Third Party Assessment Organization). No self-assessment.
Renewal	Continuous monitoring; annual assessment
Scope	Cloud service offering for federal use (moderate impact)
Governing body	General Services Administration (GSA), FedRAMP Moderate Rev 4. Official source

Controls by category

145 controls are Mapped to FedRAMP Moderate Baseline Rev 4.

AC-17 Remote Access

Control	Status
App Configuration should use private link	Mapped
Function apps should have remote debugging disabled	Mapped
Disk access resources should use private link	Mapped
Windows virtual machines should have the Windows Guest Configuration extension installed for assignments	Mapped
Virtual machines with no identities should use system-assigned managed identity for Guest Configuration assignments	Mapped
Virtual machines with a user-assigned identity should also use system-assigned managed identity for Guest Configuration assignments	Mapped
Linux machines should prohibit remote connections from accounts without passwords	Mapped
Container registries should use private link	Mapped
Cosmos DB accounts should use private link	Mapped
Data factories should use private link	Mapped
Event Hub namespaces should use private link	Mapped
Azure API for FHIR should use private link	Mapped
MariaDB servers should have private endpoints enabled	Mapped
MySQL servers should have private endpoints enabled	Mapped
PostgreSQL servers should have private endpoints enabled	Mapped
Azure Cache for Redis should use private link	Mapped
Azure Cognitive Search services should use a SKU that supports private link	Mapped
Azure Service Bus namespaces should use private link	Mapped
Azure SignalR Service should use private link	Mapped
Azure Spring Cloud should use network injection	Mapped
Azure SQL databases should have private endpoint connections enabled	Mapped
Storage accounts should have the default network access rule set to deny	Mapped
Storage accounts should have network access restrictions configured	Mapped
Storage accounts should use virtual network rules to restrict network access	Mapped
Azure Synapse workspaces should use private link	Mapped

AC-17(1) Automated Monitoring/Control

Control	Status
App Configuration should use private link	Mapped
Function apps should have remote debugging disabled	Mapped
Disk access resources should use private link	Mapped
Windows virtual machines should have the Windows Guest Configuration extension installed for assignments	Mapped
Virtual machines with no identities should use system-assigned managed identity for Guest Configuration assignments	Mapped
Virtual machines with a user-assigned identity should also use system-assigned managed identity for Guest Configuration assignments	Mapped
Linux machines should prohibit remote connections from accounts without passwords	Mapped
Container registries should use private link	Mapped
Cosmos DB accounts should use private link	Mapped
Data factories should use private link	Mapped
Event Hub namespaces should use private link	Mapped
Azure API for FHIR should use private link	Mapped
MariaDB servers should have private endpoints enabled	Mapped
MySQL servers should have private endpoints enabled	Mapped
PostgreSQL servers should have private endpoints enabled	Mapped
Azure Cache for Redis should use private link	Mapped
Azure Cognitive Search services should use a SKU that supports private link	Mapped
Azure Service Bus namespaces should use private link	Mapped
Azure SignalR Service should use private link	Mapped
Azure Spring Cloud should use network injection	Mapped
Azure SQL databases should have private endpoint connections enabled	Mapped
Storage accounts should have the default network access rule set to deny	Mapped
Storage accounts should have network access restrictions configured	Mapped
Storage accounts should use virtual network rules to restrict network access	Mapped
Azure Synapse workspaces should use private link	Mapped

AC-2 Account Management

Control	Status
App Service API apps should use managed identity	Mapped
Function apps should use managed identity	Mapped
App Service apps should have 'Register with Azure Active Directory' enabled	Mapped
App Service apps should use managed identity	Mapped
Azure subscriptions should not have blocked accounts with owner permissions	Mapped
Azure subscriptions should not have guest accounts with owner permissions	Mapped
Azure subscriptions should not have guest accounts with read permissions	Mapped
Azure subscriptions should not have guest accounts with write permissions	Mapped
Custom RBAC roles should not be used	Mapped
Azure subscriptions should limit owners to 3	Mapped
Service Fabric clusters should use only Azure Active Directory for client authentication	Mapped
SQL servers should have a Microsoft Entra ID admin configured	Mapped
SQL servers should have an Azure Active Directory administrator configured	Mapped

AC-2(1) Automated System Account Management

Control	Status
Service Fabric clusters should use only Azure Active Directory for client authentication	Mapped
SQL servers should have a Microsoft Entra ID admin configured	Mapped
SQL servers should have an Azure Active Directory administrator configured	Mapped

AC-2(12) Account Monitoring

Control	Status
Azure subscriptions should have Microsoft Defender for Storage enabled	Mapped

AC-2(7) Role-Based Schemes

Control	Status
Custom RBAC roles should not be used	Mapped
Service Fabric clusters should use only Azure Active Directory for client authentication	Mapped
SQL servers should have a Microsoft Entra ID admin configured	Mapped
SQL servers should have an Azure Active Directory administrator configured	Mapped

AC-3 Access Enforcement

Control	Status
App Service API apps should use managed identity	Mapped
Function apps should use managed identity	Mapped
App Service apps should have 'Register with Azure Active Directory' enabled	Mapped
App Service apps should use managed identity	Mapped
Linux machines should require passwords for all accounts	Mapped
Virtual machines with no identities should use system-assigned managed identity for Guest Configuration assignments	Mapped
Virtual machines with a user-assigned identity should also use system-assigned managed identity for Guest Configuration assignments	Mapped
Linux machines should require SSH keys for authentication	Mapped
Virtual machines should use Azure Resource Manager resources	Mapped
Service Fabric clusters should use only Azure Active Directory for client authentication	Mapped
SQL servers should have a Microsoft Entra ID admin configured	Mapped
SQL servers should have an Azure Active Directory administrator configured	Mapped
Storage accounts should use Azure Resource Manager resources	Mapped

AC-4 Information Flow Enforcement

Control	Status
API Management services should use a virtual network	Mapped
App Configuration should use private link	Mapped
App Service apps should not allow CORS access from every resource	Mapped
App Service apps should not allow CORS access from every resource	Mapped
Cognitive Services accounts should have network access restrictions configured	Mapped
Disk access resources should use private link	Mapped
Container registries should use private link	Mapped
Cosmos DB accounts should use private link	Mapped
Cosmos DB accounts should have 'Firewalls & Networks' limited to selected networks instead of all networks	Mapped
Azure Cosmos DB accounts should have firewall rules	Mapped
Data factories should use private link	Mapped
Event Hub namespaces should use private link	Mapped
Azure API for FHIR should use private link	Mapped
Kubernetes clusters should have authorized IP ranges configured	Mapped
MariaDB servers should have private endpoints enabled	Mapped
MariaDB servers should have public network access disabled	Mapped
MySQL servers should have private endpoints enabled	Mapped
MySQL servers should have public network access disabled	Mapped
Virtual machine network interfaces should have IP forwarding disabled	Mapped
PostgreSQL servers should have private endpoints enabled	Mapped
PostgreSQL servers should have public network access disabled	Mapped
Azure Cache for Redis should use private link	Mapped
Azure Cognitive Search services should use a SKU that supports private link	Mapped
Azure Service Bus namespaces should use private link	Mapped
Azure SignalR Service should use private link	Mapped
Azure SQL databases should have private endpoint connections enabled	Mapped
Storage accounts should have the default network access rule set to deny	Mapped
Storage accounts should have network access restrictions configured	Mapped
Storage accounts should use virtual network rules to restrict network access	Mapped
Azure Synapse workspaces should use private link	Mapped

AC-5 Separation Of Duties

Control	Status
Azure subscriptions should have more than one owner	Mapped

AC-6 Least Privilege

Control	Status
Custom RBAC roles should not be used	Mapped
Azure subscriptions should limit owners to 3	Mapped

AU-11 Audit Record Retention

Control	Status
SQL servers should have 'Auditing' retention set to greater than 90 days	Mapped
SQL servers auditing to storage accounts should have retention set to 90 days or more	Mapped

AU-12 Audit Generation

Control	Status
App Service apps should have resource logs enabled	Mapped
Batch accounts should have resource logs enabled	Mapped
Virtual machines should have the Guest Configuration extension installed	Mapped
Virtual machines with no identities should use system-assigned managed identity for Guest Configuration assignments	Mapped
Virtual machines should use system-assigned managed identity with the Guest Configuration extension	Mapped
Virtual machines with a user-assigned identity should also use system-assigned managed identity for Guest Configuration assignments	Mapped
Data Lake Analytics accounts should have resource logs enabled	Mapped
Data Lake Store accounts should have resource logs enabled	Mapped
Event Hub namespaces should have resource logs enabled	Mapped
IoT hubs should have resource logs enabled	Mapped
Logic App workflows should have resource logs enabled	Mapped
Search services should have resource logs enabled	Mapped
Azure subscriptions should have Microsoft Defender for Storage enabled	Mapped
Service Bus namespaces should have resource logs enabled	Mapped
Critical SQL servers should have Microsoft Defender for SQL set to 'On'	Mapped
SQL servers should have auditing enabled	Mapped
Stream Analytics jobs should have resource logs enabled	Mapped

AU-6 Audit Record Review, Analysis And Reporting

Control	Status
Azure subscriptions should have Microsoft Defender for Storage enabled	Mapped
Critical SQL servers should have Microsoft Defender for SQL set to 'On'	Mapped

CM-6 Configuration Settings

Control	Status
App Service apps should not allow CORS access from every resource	Mapped
Function apps should not allow CORS access from every resource	Mapped
Function apps should have remote debugging disabled	Mapped
App Service apps should not allow CORS access from every resource	Mapped
Linux machines should have the Azure compute security baseline requirements satisfied	Mapped
Windows machines should have the Azure compute security baseline requirements satisfied	Mapped

CP-6 Alternate Storage Sites

Control	Status
MariaDB servers should have geo-redundant backup enabled	Mapped
MySQL servers should have geo-redundant backup enabled	Mapped
PostgreSQL servers should have geo-redundant backup enabled	Mapped
Azure SQL databases should have long-term geo-redundant backup enabled	Mapped
Storage accounts should have geo-redundant storage enabled	Mapped

CP-6(1) Separation From Primary Site

Control	Status
MariaDB servers should have geo-redundant backup enabled	Mapped
MySQL servers should have geo-redundant backup enabled	Mapped
PostgreSQL servers should have geo-redundant backup enabled	Mapped
Azure SQL databases should have long-term geo-redundant backup enabled	Mapped
Storage accounts should have geo-redundant storage enabled	Mapped

CP-7 Alternate Processing Site

Control	Status
Virtual machines should have disaster recovery configured	Mapped

CP-9 Information System Backup

Control	Status
Virtual machines should be protected by Azure Backup	Mapped
Key vaults should have deletion protection enabled	Mapped
Key vaults should have soft delete enabled	Mapped
Key vaults should have recoverability configured	Mapped
MariaDB servers should have geo-redundant backup enabled	Mapped
MySQL servers should have geo-redundant backup enabled	Mapped
PostgreSQL servers should have geo-redundant backup enabled	Mapped

IA-2 Identification and Authentication (Organizational users)

Control	Status
App Service API apps should use managed identity	Mapped
Function apps should use managed identity	Mapped
App Service apps should have 'Register with Azure Active Directory' enabled	Mapped
App Service apps should use managed identity	Mapped
Service Fabric clusters should use only Azure Active Directory for client authentication	Mapped
SQL servers should have a Microsoft Entra ID admin configured	Mapped
SQL servers should have an Azure Active Directory administrator configured	Mapped

IA-4 Identifier Management

Control	Status
App Service API apps should use managed identity	Mapped
Function apps should use managed identity	Mapped
App Service apps should have 'Register with Azure Active Directory' enabled	Mapped
App Service apps should use managed identity	Mapped
Service Fabric clusters should use only Azure Active Directory for client authentication	Mapped
SQL servers should have a Microsoft Entra ID admin configured	Mapped
SQL servers should have an Azure Active Directory administrator configured	Mapped

IA-5 Authenticator Management

Control	Status
Windows virtual machines should have the Windows Guest Configuration extension installed for assignments	Mapped
Virtual machines with no identities should use system-assigned managed identity for Guest Configuration assignments	Mapped
Virtual machines with a user-assigned identity should also use system-assigned managed identity for Guest Configuration assignments	Mapped
Windows machines should not store passwords using reversible encryption	Mapped
Linux machines should require SSH keys for authentication	Mapped
Key vault certificates should have 'Validity Period (in months)' set to 12 or less	Mapped
Key Vault keys should have an expiration date	Mapped
Key Vault secrets should have an expiration date	Mapped
Non-RBAC key vaults should have 'Expiration Date' configured for all keys	Mapped
Non-RBAC key vaults should have 'Expiration Date' configured for all secrets	Mapped
RBAC key vaults should have 'Expiration Date' configured for all keys	Mapped

IA-5(1) Password-Based Authentication

Control	Status
Windows virtual machines should have the Windows Guest Configuration extension installed for assignments	Mapped
Virtual machines with no identities should use system-assigned managed identity for Guest Configuration assignments	Mapped
Virtual machines with a user-assigned identity should also use system-assigned managed identity for Guest Configuration assignments	Mapped
Windows machines should have maximum password age set to 70 days	Mapped
Windows machines should have minimum password age set to 1 day	Mapped
Windows machines should have minimum password length set to 14 characters	Mapped
Windows machines should have the password complexity setting enabled	Mapped
Windows machines should not store passwords using reversible encryption	Mapped
Windows machines should prohibit reuse of the previous 24 passwords	Mapped

IR-4 Incident Handling

Control	Status
Azure subscriptions should have Microsoft Defender for Storage enabled	Mapped
Subscriptions should have a contact email address for security issues	Mapped
Azure subscriptions should have email notifications to subscription owners for high severity alerts enabled	Mapped
Critical SQL servers should have Microsoft Defender for SQL set to 'On'	Mapped

IR-5 Incident Monitoring

Control	Status
Azure subscriptions should have Microsoft Defender for Storage enabled	Mapped
Subscriptions should have a contact email address for security issues	Mapped
Azure subscriptions should have email notifications to subscription owners for high severity alerts enabled	Mapped
Critical SQL servers should have Microsoft Defender for SQL set to 'On'	Mapped

RA-5 Vulnerability Scanning

Control	Status
SQL managed instances should have vulnerability assessment enabled	Mapped
Azure subscriptions should have Microsoft Defender for Storage enabled	Mapped
Critical SQL servers should have Microsoft Defender for SQL set to 'On'	Mapped
Synapse workspaces should have vulnerability assessment enabled	Mapped

SC-12 Cryptographic Key Establishment And Management

Control	Status
Batch accounts should use customer-managed keys to encrypt data	Mapped
Cognitive Services accounts should use customer-managed keys to encrypt data	Mapped
OS and data disks should use customer-managed keys for encryption	Mapped
Managed disks should use both platform-managed and customer-managed keys for double encryption	Mapped
Container Instance container groups should use customer-managed keys for encryption	Mapped
Container registries should use customer-managed keys for encryption	Mapped
Data factories should use customer-managed keys for encryption	Mapped
Event Hub namespaces should use a customer-managed key for encryption	Mapped
Azure HDInsight clusters should use customer-managed keys to encrypt data at rest	Mapped
Azure HDInsight clusters should use encryption at host to encrypt data at rest	Mapped
Azure API for FHIR should use a customer-managed key to encrypt data at rest	Mapped
HPC Cache accounts should use customer-managed keys for encryption	Mapped
AKS clusters should use customer-managed keys to encrypt both OS and data disks	Mapped
Azure Data Explorer clusters should use customer-managed keys for encryption at rest	Mapped
Azure Machine Learning workspaces should use customer-managed keys for encryption	Mapped
SQL managed instances should use customer-managed keys to encrypt data at rest	Mapped
MySQL servers should use customer-managed keys to encrypt data at rest	Mapped
Service Bus Premium namespaces should use a customer-managed key for encryption	Mapped
SQL servers should use customer-managed keys to encrypt data at rest	Mapped
Storage accounts should use customer-managed key for encryption	Mapped
Storage account encryption scopes should use customer-managed keys to encrypt data at rest	Mapped
Azure Synapse workspaces should use customer-managed keys to encrypt data at rest	Mapped

SC-28 Protection Of Information At Rest

Control	Status
Automation account variables should have encryption enabled	Mapped
Virtual machines and virtual machine scale sets should have encryption at host enabled	Mapped
Azure Stack Edge devices should have double encryption enabled	Mapped
AKS clusters should have encryption at host enabled for temporary disks and agent node pool caches	Mapped
Azure Data Explorer clusters should have disk encryption enabled	Mapped
Azure Data Explorer clusters should have double encryption enabled	Mapped
MySQL servers should have infrastructure encryption enabled	Mapped
PostgreSQL servers should have infrastructure encryption enabled	Mapped
Service Fabric clusters should have the ClusterProtectionLevel property set to EncryptAndSign	Mapped
Storage accounts should have infrastructure encryption enabled	Mapped

SC-28(1) Cryptographic Protection

Control	Status
Automation account variables should have encryption enabled	Mapped
Virtual machines and virtual machine scale sets should have encryption at host enabled	Mapped
Azure Stack Edge devices should have double encryption enabled	Mapped
AKS clusters should have encryption at host enabled for temporary disks and agent node pool caches	Mapped
Azure Data Explorer clusters should have disk encryption enabled	Mapped
Azure Data Explorer clusters should have double encryption enabled	Mapped
MySQL servers should have infrastructure encryption enabled	Mapped
PostgreSQL servers should have infrastructure encryption enabled	Mapped
Service Fabric clusters should have the ClusterProtectionLevel property set to EncryptAndSign	Mapped
Storage accounts should have infrastructure encryption enabled	Mapped

SC-5 Denial Of Service Protection

Control	Status
Application gateways should have Web Application Firewall (WAF) enabled	Mapped
Azure Front Door services should have Web Application Firewall (WAF) enabled	Mapped
Virtual machine network interfaces should have IP forwarding disabled	Mapped

SC-7 Boundary Protection

Control	Status
API Management services should use a virtual network	Mapped
App Configuration should use private link	Mapped
Application gateways should have Web Application Firewall (WAF) enabled	Mapped
Cognitive Services accounts should have network access restrictions configured	Mapped
Disk access resources should use private link	Mapped
Container registries should use private link	Mapped
Cosmos DB accounts should use private link	Mapped
Cosmos DB accounts should have 'Firewalls & Networks' limited to selected networks instead of all networks	Mapped
Azure Cosmos DB accounts should have firewall rules	Mapped
Data factories should use private link	Mapped
Event Hub namespaces should use private link	Mapped
Azure Front Door services should have Web Application Firewall (WAF) enabled	Mapped
Azure API for FHIR should use private link	Mapped
Kubernetes clusters should have authorized IP ranges configured	Mapped
MariaDB servers should have private endpoints enabled	Mapped
MariaDB servers should have public network access disabled	Mapped
MySQL servers should have private endpoints enabled	Mapped
MySQL servers should have public network access disabled	Mapped
Virtual machine network interfaces should have IP forwarding disabled	Mapped
PostgreSQL servers should have private endpoints enabled	Mapped
PostgreSQL servers should have public network access disabled	Mapped
Azure Cache for Redis should use private link	Mapped
Azure Cognitive Search services should use a SKU that supports private link	Mapped
Azure Service Bus namespaces should use private link	Mapped
Azure SignalR Service should use private link	Mapped
Azure SQL databases should have private endpoint connections enabled	Mapped
Storage accounts should have the default network access rule set to deny	Mapped
Storage accounts should have network access restrictions configured	Mapped
Storage accounts should use virtual network rules to restrict network access	Mapped
Azure Synapse workspaces should use private link	Mapped

SC-7(3) Access Points

Control	Status
API Management services should use a virtual network	Mapped
App Configuration should use private link	Mapped
Application gateways should have Web Application Firewall (WAF) enabled	Mapped
Cognitive Services accounts should have network access restrictions configured	Mapped
Disk access resources should use private link	Mapped
Container registries should use private link	Mapped
Cosmos DB accounts should use private link	Mapped
Cosmos DB accounts should have 'Firewalls & Networks' limited to selected networks instead of all networks	Mapped
Azure Cosmos DB accounts should have firewall rules	Mapped
Data factories should use private link	Mapped
Event Hub namespaces should use private link	Mapped
Azure Front Door services should have Web Application Firewall (WAF) enabled	Mapped
Azure API for FHIR should use private link	Mapped
Kubernetes clusters should have authorized IP ranges configured	Mapped
MariaDB servers should have private endpoints enabled	Mapped
MariaDB servers should have public network access disabled	Mapped
MySQL servers should have private endpoints enabled	Mapped
MySQL servers should have public network access disabled	Mapped
Virtual machine network interfaces should have IP forwarding disabled	Mapped
PostgreSQL servers should have private endpoints enabled	Mapped
PostgreSQL servers should have public network access disabled	Mapped
Azure Cache for Redis should use private link	Mapped
Azure Cognitive Search services should use a SKU that supports private link	Mapped
Azure Service Bus namespaces should use private link	Mapped
Azure SignalR Service should use private link	Mapped
Azure SQL databases should have private endpoint connections enabled	Mapped
Storage accounts should have the default network access rule set to deny	Mapped
Storage accounts should have network access restrictions configured	Mapped
Storage accounts should use virtual network rules to restrict network access	Mapped
Azure Synapse workspaces should use private link	Mapped

SC-8 Transmission Confidentiality And Integrity

Control	Status
App Service API apps should require FTPS only	Mapped
App Service API apps should require HTTPS for all access	Mapped
Function apps should require FTPS only	Mapped
Function apps should use the latest TLS version	Mapped
App Service web apps should require FTPS	Mapped
HDInsight clusters should have encryption in transit enabled for communication between cluster nodes	Mapped
MySQL servers should have 'Enforce SSL connection' enabled	Mapped
PostgreSQL servers should have 'Enforce SSL connection' enabled	Mapped

SC-8(1) Cryptographic Or Alternate Physical Protection

Control	Status
App Service API apps should require FTPS only	Mapped
App Service API apps should require HTTPS for all access	Mapped
Function apps should require FTPS only	Mapped
Function apps should use the latest TLS version	Mapped
App Service web apps should require FTPS	Mapped
HDInsight clusters should have encryption in transit enabled for communication between cluster nodes	Mapped
MySQL servers should have 'Enforce SSL connection' enabled	Mapped
PostgreSQL servers should have 'Enforce SSL connection' enabled	Mapped

SI-16 Memory Protection

Control	Status
Windows virtual machines should have Windows Defender Exploit Guard enabled	Mapped

SI-2 Flaw Remediation

Control	Status
Function apps should use the latest 'HTTP Version' when used to run the app	Mapped
Kubernetes clusters should use a non-vulnerable Kubernetes version	Mapped
Azure subscriptions should have Microsoft Defender for Storage enabled	Mapped

SI-3 Malicious Code Protection

Control	Status
Windows virtual machines should have Windows Defender Exploit Guard enabled	Mapped

SI-3(1) Central Management

Control	Status
Windows virtual machines should have Windows Defender Exploit Guard enabled	Mapped

SI-4 Information System Monitoring

Control	Status
Virtual machines should have the Guest Configuration extension installed	Mapped
Virtual machines with no identities should use system-assigned managed identity for Guest Configuration assignments	Mapped
Virtual machines should use system-assigned managed identity with the Guest Configuration extension	Mapped
Virtual machines with a user-assigned identity should also use system-assigned managed identity for Guest Configuration assignments	Mapped
Azure subscriptions should have Microsoft Defender for Storage enabled	Mapped
Critical SQL servers should have Microsoft Defender for SQL set to 'On'	Mapped

Framework	Control overlap	Note
CMMC 2.0 Level 2	High 96%
NIST SP 800-53 Rev 5	High 89%
NIST SP 800-171 Rev 2	High 85%

Frequently asked questions

How many controls does the FedRAMP Moderate baseline have?

The FedRAMP Moderate baseline has 325 controls, whereas the FedRAMP High baseline has 421 controls. The number of controls in a baseline increases as the impact level increases.

What are the FedRAMP impact levels?

Authorizations are granted at three impact levels based on NIST FIPS 199 guidelines: Low (limited effect), Moderate (serious adverse effect), and High (severe or catastrophic effect).

What are the paths for a cloud provider to demonstrate FedRAMP compliance?

A Cloud Service Provider can earn a Provisional ATO from the FedRAMP Joint Authorization Board, receive an ATO from a federal agency, or develop a CSP Supplied Package independently. Each path requires an assessment by an accredited 3PAO.

Is FedRAMP a point-in-time certification?

FedRAMP is not a point-in-time certification or accreditation. It is an assessment and authorization program with provisions for continuous monitoring, so deployed security controls in a cloud service offering remain effective as the environment changes.