Key Takeaways

• Twenty Control Families. Every System Security Plan (SSP) maps to the same 20 NIST SP 800-53 Rev5 families, organized into technical, operational, and management categories.
• Counts Scale by Baseline. FedRAMP Low requires 156 controls, Moderate 323, and High 410, with FedRAMP-specific parameters layered on top.
• Five Families Block Most. System and Communications Protection (Federal Information Processing Standards (FIPS) 140 failures), Configuration Management, Audit and Accountability, Contingency Planning, and Incident Response generate the findings that delay or prevent authorization.
• Inheritance Shifts the Burden. Physical and Environmental Protection, Media Protection, and portions of infrastructure-layer families can be inherited. Application-layer families like Incident Response and Planning cannot.

The 20 Control Families and How They Organize Every FedRAMP Authorization

FedRAMP control families come directly from NIST SP 800-53 Rev5, Table 1. FedRAMP adopts the structure wholesale, then adds parameter settings, requirements, and guidance on top. The families break into three categories: technical, operational, and management.

Technical Families

Technical controls are implemented through system capabilities and software configuration, verifiable through authenticated scans and penetration testing.

1. Access Control (AC): Governs Identity and Access Management (IAM), role-based permissions, multi-factor authentication (MFA), session management, and least privilege.
2. Audit and Accountability (AU): Requires generation, protection, and retention of audit logs covering authentication, privileged actions, and data changes.
3. Configuration Management (CM): Defines authorization boundaries, hardened baselines, component inventory, and change control gates.
4. Identification and Authentication (IA): Manages user and device identity, credential lifecycle, and phishing-resistant authenticators.
5. System and Services Acquisition (SA): Governs secure software development, supplier review, and acquisition of third-party components.
6. System and Communications Protection (SC): Requires FIPS-validated cryptography, boundary protection, and secure transport.
7. System and Information Integrity (SI): Covers vulnerability scanning, flaw remediation, malware protection, and file integrity monitoring.

Operational Families

Operational controls are implemented through organizational processes and verified primarily through document review and interviews.

8. Awareness and Training (AT): Requires role-based security training and completion records for every user with system access.
9. Assessment, Authorization, and Monitoring (CA): Covers continuous monitoring strategy, internal assessments, and Plan of Action and Milestones (POA&M) management.
10. Contingency Planning (CP): Requires backup, recovery, and annually tested contingency exercises.
11. Incident Response (IR): Defines detection, escalation, reporting, and post-incident analysis procedures.
12. Maintenance (MA): Governs controlled, logged, and authorized system maintenance.
13. Media Protection (MP): Covers handling, transport, sanitization, and destruction of digital and physical media.
14. Physical and Environmental Protection (PE): Requires facility access controls, environmental monitoring, and power/fire protections.
15. Personnel Security (PS): Mandates background investigations before access is granted, and termination procedures.
16. Supply Chain Risk Management (SR): Addresses vendor risk, component provenance, and supply chain integrity.

Management Families

Management controls govern the program-level structures that make security operational over time.

17. Planning (PL): Establishes the SSP, rules of behavior, and overall security architecture documentation.
18. Program Management (PM): Defines enterprise-wide governance, resourcing, and security strategy.
19. PII Processing and Transparency (PT): New in Rev5, governs collection, processing, and disclosure of Personally Identifiable Information (PII).
20. Risk Assessment (RA): Requires categorization, ongoing risk assessment, and monthly authenticated vulnerability scanning.

How Control Counts Scale Across Low, Moderate, and High Baselines

The same 20 families appear at every impact level, but the depth of implementation changes substantially. Per the approved Rev5 baseline documents and Schellman's Rev5 analysis:

FedRAMP adds approximately 36 controls above NIST at Moderate and 40 at High. The additions take three forms: FedRAMP-defined parameters that replace NIST's "organization-defined" placeholders, additional requirements beyond the NIST control text, and cloud-specific implementation guidance.

The 5 Families That Most Often Block Authorization

Not every family carries equal authorization risk. A handful generate findings that most often delay authorization for predictable reasons: they require architectural decisions that are expensive to retrofit, evidence that cannot be backfilled, and proof of execution that documentation cannot substitute for.

1. System and Communications Protection (SC) - Requires FIPS 140-3-validated cryptographic modules wherever cryptography is implemented within the authorization boundary: data encryption and decryption, OTP generation for MFA, and Transport Layer Security (TLS)/Secure Shell (SSH)/Hypertext Transfer Protocol Secure (HTTPS).

2. Configuration Management (CM) - Boundary definition errors invalidate the assessment scope, leading to common drift triggers, incorrect component inventory, insufficient log scope, and FIPS coverage gaps.

3. Audit and Accountability (AU) - Generates Moderate-severity findings requiring high-effort remediation, lacking architecture gaps that can fail multiple controls.

4. Contingency Planning (CP) - Must be tested annually before assessments and require documented results, lessons learned, and corrective actions.

5. Incident Response (IR) - Requires timely notification of stakeholders and proof of execution through exercises and reporting workflows.

Supporting Families Quietly Compound the Authorization Burden

Several other families do not block authorization on their own but routinely surface findings that compound the burden of the five above:

• Access Control (AC): Requires automated support for account management.
• Identification and Authentication (IA): Enforces MFA for all organizational users.
• System and Information Integrity (SI): Monthly authenticated scanning is required.
• Personnel Security (PS): Background investigations must be completed prior to access.
• Awareness and Training (AT): Training completion records are required for all users with system access.

What Running All 20 Families Independently Costs

Independent authorization is expensive. The November 2025 American University study found that total costs including consulting, staff effort, technology upgrades, assessment fees, and ongoing compliance can exceed $250,000 and can reach $1 million or more.

How Control Inheritance Reduces Scope and Which Families Qualify

FedRAMP allows SaaS vendors to inherit controls from a pre-existing FedRAMP authorization, reducing the burden for vendors.

• Physical and Environmental Protection (PE): Fully inheritable from authorized IaaS.
• Media Protection (MP): Fully inheritable for handling and sanitization of media.
• Access Control (AC): Shared with the provider covering infrastructure ACLs.
• Configuration Management (CM): Shared with platform configuration managed by the provider.
• System and Communications Protection (SC): Shared with network encryption managed by the provider.

The Right Architecture Lifts the Heaviest Part of the Burden

Knox Systems operates a FedRAMP-as-a-Service model enabling clients to achieve authorization efficiently, allowing vendors to inherit significant aspects of the control families.