# Security decision record This file is the public security decision record for the selected day and is built from the stored evidence. It is not a FedRAMP certification, an authorization, an assessor report, or a Marketplace listing. ## Reviewing All Training (KSI-CED-RAT) Status: Implemented. The effectiveness of relevant cybersecurity education and training is persistently reviewed, including at least general training for all employees, role-specific training for employees in high risk roles, training for development and engineering staff on secure software delivery, and training for staff involved with incident response or disaster recovery. The combined result is pass. Validation: The result on this report is the result the evidence job wrote for the selected day. Assessment: No independent assessor has reviewed this indicator. In the past 30 days, this indicator was pass on 1 day, partial on 0 days, and fail on 0 days. In the stored days of the past year, the counts are 1 pass, 0 partial, and 0 fail. A full year of daily results is not available yet. ## Logging Changes (KSI-CMT-LMC) Status: Implemented. Modifications to the cloud service offering are logged and monitored. The combined result is pass. Validation: The result on this report is the result the evidence job wrote for the selected day. Assessment: No independent assessor has reviewed this indicator. In the past 30 days, this indicator was pass on 1 day, partial on 0 days, and fail on 0 days. In the stored days of the past year, the counts are 1 pass, 0 partial, and 0 fail. A full year of daily results is not available yet. ## Redeploying vs Modifying (KSI-CMT-RMV) Status: Partially Implemented. Changes to machine-based information resources are executed through the redeployment of version controlled resources rather than direct modification wherever reasonable. The combined result is pass. Validation: The result on this report is the result the evidence job wrote for the selected day. Assessment: No independent assessor has reviewed this indicator. In the past 30 days, this indicator was pass on 1 day, partial on 0 days, and fail on 0 days. In the stored days of the past year, the counts are 1 pass, 0 partial, and 0 fail. A full year of daily results is not available yet. ## Reviewing Change Procedures (KSI-CMT-RVP) Status: Implemented. The effectiveness of documented change management procedures is persistently reviewed. The combined result is pass. Validation: The result on this report is the result the evidence job wrote for the selected day. Assessment: No independent assessor has reviewed this indicator. In the past 30 days, this indicator was pass on 1 day, partial on 0 days, and fail on 0 days. In the stored days of the past year, the counts are 1 pass, 0 partial, and 0 fail. A full year of daily results is not available yet. ## Validating Throughout Deployment (KSI-CMT-VTD) Status: Partially Implemented. Persistent testing and validation of changes throughout deployment is automated. The combined result is pass. Validation: The result on this report is the result the evidence job wrote for the selected day. Assessment: No independent assessor has reviewed this indicator. In the past 30 days, this indicator was pass on 1 day, partial on 0 days, and fail on 0 days. In the stored days of the past year, the counts are 1 pass, 0 partial, and 0 fail. A full year of daily results is not available yet. ## Defining Functionality and Privileges (KSI-CNA-DFP) Status: Partially Implemented. The functionality and privileges for infrastructure and services are strictly defined. The combined result is pass. Validation: The result on this report is the result the evidence job wrote for the selected day. Assessment: No independent assessor has reviewed this indicator. In the past 30 days, this indicator was pass on 1 day, partial on 0 days, and fail on 0 days. In the stored days of the past year, the counts are 1 pass, 0 partial, and 0 fail. A full year of daily results is not available yet. ## Enforcing Intended State (KSI-CNA-EIS) Status: Partially Implemented. Automated services are used to persistently assess the security of all machine-based information resources and automatically enforce their intended operational state. The combined result is pass. Validation: The result on this report is the result the evidence job wrote for the selected day. Assessment: No independent assessor has reviewed this indicator. In the past 30 days, this indicator was pass on 1 day, partial on 0 days, and fail on 0 days. In the stored days of the past year, the counts are 1 pass, 0 partial, and 0 fail. A full year of daily results is not available yet. ## Implementing Best Practices (KSI-CNA-IBP) Status: Implemented. The use and configuration of third-party machine-based information resources is persistently compared against the original provider's best practices and guidance. The combined result is pass. Validation: The result on this report is the result the evidence job wrote for the selected day. Assessment: No independent assessor has reviewed this indicator. In the past 30 days, this indicator was pass on 1 day, partial on 0 days, and fail on 0 days. In the stored days of the past year, the counts are 1 pass, 0 partial, and 0 fail. A full year of daily results is not available yet. ## Minimizing Attack Surface (KSI-CNA-MAT) Status: Partially Implemented. Machine-based information resources are persistently reviewed to ensure they have a minimal attack surface and that lateral movement is minimized if compromised. The combined result is pass. Validation: The result on this report is the result the evidence job wrote for the selected day. Assessment: No independent assessor has reviewed this indicator. In the past 30 days, this indicator was pass on 1 day, partial on 0 days, and fail on 0 days. In the stored days of the past year, the counts are 1 pass, 0 partial, and 0 fail. A full year of daily results is not available yet. ## Optimizing for Availability (KSI-CNA-OFA) Status: Partially Implemented. Machine-based information resources are persistently reviewed to ensure they are appropriately optimized for high availability and rapid recovery. The combined result is pass. Validation: The result on this report is the result the evidence job wrote for the selected day. Assessment: No independent assessor has reviewed this indicator. In the past 30 days, this indicator was pass on 1 day, partial on 0 days, and fail on 0 days. In the stored days of the past year, the counts are 1 pass, 0 partial, and 0 fail. A full year of daily results is not available yet. ## Restricting Network Traffic (KSI-CNA-RNT) Status: Partially Implemented. Machine-based information resources are persistently reviewed to ensure they are appropriately configured to limit inbound and outbound network traffic. The combined result is pass. Validation: The result on this report is the result the evidence job wrote for the selected day. Assessment: No independent assessor has reviewed this indicator. In the past 30 days, this indicator was pass on 1 day, partial on 0 days, and fail on 0 days. In the stored days of the past year, the counts are 1 pass, 0 partial, and 0 fail. A full year of daily results is not available yet. ## Reviewing Protections (KSI-CNA-RVP) Status: Implemented. The effectiveness of protection against denial of service attacks and other unwanted activity for machine-based information resources is persistently reviewed. The combined result is pass. Validation: The result on this report is the result the evidence job wrote for the selected day. Assessment: No independent assessor has reviewed this indicator. In the past 30 days, this indicator was pass on 1 day, partial on 0 days, and fail on 0 days. In the stored days of the past year, the counts are 1 pass, 0 partial, and 0 fail. A full year of daily results is not available yet. ## Using Logical Networking (KSI-CNA-ULN) Status: Partially Implemented. Logical networking and related capabilities are used and persistently reviewed to enforce traffic flow controls. The combined result is pass. Validation: The result on this report is the result the evidence job wrote for the selected day. Assessment: No independent assessor has reviewed this indicator. In the past 30 days, this indicator was pass on 1 day, partial on 0 days, and fail on 0 days. In the stored days of the past year, the counts are 1 pass, 0 partial, and 0 fail. A full year of daily results is not available yet. ## Automating Account Management (KSI-IAM-AAM) Status: Partially Implemented. The lifecycle and privileges of all accounts, roles, and groups are securely managed using automation. The combined result is pass. Validation: The result on this report is the result the evidence job wrote for the selected day. Assessment: No independent assessor has reviewed this indicator. In the past 30 days, this indicator was pass on 1 day, partial on 0 days, and fail on 0 days. In the stored days of the past year, the counts are 1 pass, 0 partial, and 0 fail. A full year of daily results is not available yet. ## Adopting Passwordless Methods (KSI-IAM-APM) Status: Partially Implemented. Secure passwordless methods are used for user authentication and authorization when feasible, otherwise strong passwords with phishing-resistant MFA is used. The combined result is pass. Validation: The result on this report is the result the evidence job wrote for the selected day. Assessment: No independent assessor has reviewed this indicator. In the past 30 days, this indicator was pass on 1 day, partial on 0 days, and fail on 0 days. In the stored days of the past year, the counts are 1 pass, 0 partial, and 0 fail. A full year of daily results is not available yet. ## Ensuring Least Privilege (KSI-IAM-ELP) Status: Partially Implemented. Identity and access management measures are used and persistently reviewed to ensure each user or device can only access the resources they need. The combined result is pass. Validation: The result on this report is the result the evidence job wrote for the selected day. Assessment: No independent assessor has reviewed this indicator. In the past 30 days, this indicator was pass on 1 day, partial on 0 days, and fail on 0 days. In the stored days of the past year, the counts are 1 pass, 0 partial, and 0 fail. A full year of daily results is not available yet. ## Authorizing Just-in-Time (KSI-IAM-JIT) Status: Partially Implemented. A least-privileged, role and attribute-based, and just-in-time security authorization model is used and persistently reviewed for all user and non-user accounts and services. The combined result is pass. Validation: The result on this report is the result the evidence job wrote for the selected day. Assessment: No independent assessor has reviewed this indicator. In the past 30 days, this indicator was pass on 1 day, partial on 0 days, and fail on 0 days. In the stored days of the past year, the counts are 1 pass, 0 partial, and 0 fail. A full year of daily results is not available yet. ## Securing Non-User Authentication (KSI-IAM-SNU) Status: Partially Implemented. Appropriately secure authentication methods are used and persistently reviewed for non-user accounts and services. The combined result is pass. Validation: The result on this report is the result the evidence job wrote for the selected day. Assessment: No independent assessor has reviewed this indicator. In the past 30 days, this indicator was pass on 1 day, partial on 0 days, and fail on 0 days. In the stored days of the past year, the counts are 1 pass, 0 partial, and 0 fail. A full year of daily results is not available yet. ## Responding to Suspicious Activity (KSI-IAM-SUS) Status: Partially Implemented. Accounts with privileged access are disabled or otherwise secured in response to suspicious activity. The combined result is pass. Validation: The result on this report is the result the evidence job wrote for the selected day. Assessment: No independent assessor has reviewed this indicator. In the past 30 days, this indicator was pass on 1 day, partial on 0 days, and fail on 0 days. In the stored days of the past year, the counts are 1 pass, 0 partial, and 0 fail. A full year of daily results is not available yet. ## Generating After Action Reports (KSI-INR-AAR) Status: Implemented. Incident after action reports are generated and lessons learned are persistently incorporated. The combined result is pass. Validation: The result on this report is the result the evidence job wrote for the selected day. Assessment: No independent assessor has reviewed this indicator. In the past 30 days, this indicator was pass on 1 day, partial on 0 days, and fail on 0 days. In the stored days of the past year, the counts are 1 pass, 0 partial, and 0 fail. A full year of daily results is not available yet. ## Reviewing Incident Response Procedures (KSI-INR-RIR) Status: Implemented. The effectiveness of documented incident response procedures is persistently reviewed. The combined result is pass. Validation: The result on this report is the result the evidence job wrote for the selected day. Assessment: No independent assessor has reviewed this indicator. In the past 30 days, this indicator was pass on 1 day, partial on 0 days, and fail on 0 days. In the stored days of the past year, the counts are 1 pass, 0 partial, and 0 fail. A full year of daily results is not available yet. ## Reviewing Past Incidents (KSI-INR-RPI) Status: Implemented. Past incidents are persistently reviewed for patterns or vulnerabilities that were not previously apparent or identified. The combined result is pass. Validation: The result on this report is the result the evidence job wrote for the selected day. Assessment: No independent assessor has reviewed this indicator. In the past 30 days, this indicator was pass on 1 day, partial on 0 days, and fail on 0 days. In the stored days of the past year, the counts are 1 pass, 0 partial, and 0 fail. A full year of daily results is not available yet. ## Authorizing Log Access (KSI-MLA-ALA) Status: Partially Implemented. A least-privileged, role and attribute-based, and just-in-time access authorization model is used and persistently reviewed for access to log data based on organizationally defined data sensitivity. The combined result is pass. Validation: The result on this report is the result the evidence job wrote for the selected day. Assessment: No independent assessor has reviewed this indicator. In the past 30 days, this indicator was pass on 1 day, partial on 0 days, and fail on 0 days. In the stored days of the past year, the counts are 1 pass, 0 partial, and 0 fail. A full year of daily results is not available yet. ## Evaluating Configurations (KSI-MLA-EVC) Status: Partially Implemented. The configuration of machine-based information resources, especially infrastructure as code, is persistently evaluated and tested. The combined result is pass. Validation: The result on this report is the result the evidence job wrote for the selected day. Assessment: No independent assessor has reviewed this indicator. In the past 30 days, this indicator was pass on 1 day, partial on 0 days, and fail on 0 days. In the stored days of the past year, the counts are 1 pass, 0 partial, and 0 fail. A full year of daily results is not available yet. ## Logging Event Types (KSI-MLA-LET) Status: Partially Implemented. A list of information resources and event types that will be logged, monitored, and audited is maintained and persistently reviewed to ensure these activities occur. The combined result is pass. Validation: The result on this report is the result the evidence job wrote for the selected day. Assessment: No independent assessor has reviewed this indicator. In the past 30 days, this indicator was pass on 1 day, partial on 0 days, and fail on 0 days. In the stored days of the past year, the counts are 1 pass, 0 partial, and 0 fail. A full year of daily results is not available yet. ## Operating SIEM Capability (KSI-MLA-OSM) Status: Implemented. A Security Information and Event Management (SIEM) or similar system(s) is used and persistently reviewed for centralized, tamper-resistant logging of events, activities, and changes. The combined result is pass. Validation: The result on this report is the result the evidence job wrote for the selected day. Assessment: No independent assessor has reviewed this indicator. In the past 30 days, this indicator was pass on 1 day, partial on 0 days, and fail on 0 days. In the stored days of the past year, the counts are 1 pass, 0 partial, and 0 fail. A full year of daily results is not available yet. ## Reviewing Logs (KSI-MLA-RVL) Status: Implemented. Logs are persistently reviewed and audited. The combined result is pass. Validation: The result on this report is the result the evidence job wrote for the selected day. Assessment: No independent assessor has reviewed this indicator. In the past 30 days, this indicator was pass on 1 day, partial on 0 days, and fail on 0 days. In the stored days of the past year, the counts are 1 pass, 0 partial, and 0 fail. A full year of daily results is not available yet. ## Generating Inventories (KSI-PIY-GIV) Status: Partially Implemented. Authoritative sources are used to automatically generate real-time inventories of all information resources when needed. The combined result is pass. Validation: The result on this report is the result the evidence job wrote for the selected day. Assessment: No independent assessor has reviewed this indicator. In the past 30 days, this indicator was pass on 1 day, partial on 0 days, and fail on 0 days. In the stored days of the past year, the counts are 1 pass, 0 partial, and 0 fail. A full year of daily results is not available yet. ## Reviewing Executive Support (KSI-PIY-RES) Status: Implemented. Executive support for achieving the provider's security goals is persistently reviewed and demonstrated. The combined result is pass. Validation: The result on this report is the result the evidence job wrote for the selected day. Assessment: No independent assessor has reviewed this indicator. In the past 30 days, this indicator was pass on 1 day, partial on 0 days, and fail on 0 days. In the stored days of the past year, the counts are 1 pass, 0 partial, and 0 fail. A full year of daily results is not available yet. ## Reviewing Investments in Security (KSI-PIY-RIS) Status: Implemented. The effectiveness of the provider's investments in achieving security goals is persistently reviewed. The combined result is pass. Validation: The result on this report is the result the evidence job wrote for the selected day. Assessment: No independent assessor has reviewed this indicator. In the past 30 days, this indicator was pass on 1 day, partial on 0 days, and fail on 0 days. In the stored days of the past year, the counts are 1 pass, 0 partial, and 0 fail. A full year of daily results is not available yet. ## Reviewing Security in the SDLC (KSI-PIY-RSD) Status: Partially Implemented. The effectiveness of building security and privacy considerations into the Software Development Lifecycle and aligning with CISA Secure By Design principles is persistently reviewed. The combined result is pass. Validation: The result on this report is the result the evidence job wrote for the selected day. Assessment: No independent assessor has reviewed this indicator. In the past 30 days, this indicator was pass on 1 day, partial on 0 days, and fail on 0 days. In the stored days of the past year, the counts are 1 pass, 0 partial, and 0 fail. A full year of daily results is not available yet. ## Reviewing Vulnerability Disclosures (KSI-PIY-RVD) Status: Partially Implemented. The effectiveness of the provider's vulnerability disclosure program is persistently reviewed. The combined result is partial. Validation: The result on this report is the result the evidence job wrote for the selected day. Assessment: No independent assessor has reviewed this indicator. In the past 30 days, this indicator was pass on 0 days, partial on 1 day, and fail on 0 days. In the stored days of the past year, the counts are 0 pass, 1 partial, and 0 fail. A full year of daily results is not available yet. ## Aligning Backups with Objectives (KSI-RPL-ABO) Status: Partially Implemented. The alignment of machine-based information resource backups with defined recovery objectives is persistently reviewed. The combined result is pass. Validation: The result on this report is the result the evidence job wrote for the selected day. Assessment: No independent assessor has reviewed this indicator. In the past 30 days, this indicator was pass on 1 day, partial on 0 days, and fail on 0 days. In the stored days of the past year, the counts are 1 pass, 0 partial, and 0 fail. A full year of daily results is not available yet. ## Aligning Recovery Plan (KSI-RPL-ARP) Status: Implemented. The alignment of recovery plans with defined recovery objectives is persistently reviewed. The combined result is pass. Validation: The result on this report is the result the evidence job wrote for the selected day. Assessment: No independent assessor has reviewed this indicator. In the past 30 days, this indicator was pass on 1 day, partial on 0 days, and fail on 0 days. In the stored days of the past year, the counts are 1 pass, 0 partial, and 0 fail. A full year of daily results is not available yet. ## Reviewing Recovery Objectives (KSI-RPL-RRO) Status: Implemented. The desired Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO) are defined and persistently reviewed for alignment with the provider's business needs and capabilities. The combined result is pass. Validation: The result on this report is the result the evidence job wrote for the selected day. Assessment: No independent assessor has reviewed this indicator. In the past 30 days, this indicator was pass on 1 day, partial on 0 days, and fail on 0 days. In the stored days of the past year, the counts are 1 pass, 0 partial, and 0 fail. A full year of daily results is not available yet. ## Testing Recovery Capabilities (KSI-RPL-TRC) Status: Not Implemented. The capability to recover from incidents and contingencies aligned with defined recovery objectives is persistently tested. The combined result is fail. Validation: The result on this report is the result the evidence job wrote for the selected day. Assessment: No independent assessor has reviewed this indicator. In the past 30 days, this indicator was pass on 0 days, partial on 0 days, and fail on 1 day. In the stored days of the past year, the counts are 0 pass, 0 partial, and 1 fail. A full year of daily results is not available yet. ## Mitigating Supply Chain Risk (KSI-SCR-MIT) Status: Implemented. Potential supply chain risks are persistently identified, reviewed, and mitigated. The combined result is pass. Validation: The result on this report is the result the evidence job wrote for the selected day. Assessment: No independent assessor has reviewed this indicator. In the past 30 days, this indicator was pass on 1 day, partial on 0 days, and fail on 0 days. In the stored days of the past year, the counts are 1 pass, 0 partial, and 0 fail. A full year of daily results is not available yet. ## Monitoring Supply Chain Risk (KSI-SCR-MON) Status: Partially Implemented. Third party software information resources are automatically monitored for upstream vulnerabilities using mechanisms that may include contractual notification requirements or active monitoring services. The combined result is partial. Validation: The result on this report is the result the evidence job wrote for the selected day. Assessment: No independent assessor has reviewed this indicator. In the past 30 days, this indicator was pass on 0 days, partial on 1 day, and fail on 0 days. In the stored days of the past year, the counts are 0 pass, 1 partial, and 0 fail. A full year of daily results is not available yet. ## Automating Configuration Management (KSI-SVC-ACM) Status: Implemented. The configuration of machine-based information resources is managed using automation and persistently reviewed for drift. The combined result is pass. Validation: The result on this report is the result the evidence job wrote for the selected day. Assessment: No independent assessor has reviewed this indicator. In the past 30 days, this indicator was pass on 1 day, partial on 0 days, and fail on 0 days. In the stored days of the past year, the counts are 1 pass, 0 partial, and 0 fail. A full year of daily results is not available yet. ## Automating Secret Management (KSI-SVC-ASM) Status: Partially Implemented. Management, protection, and regular rotation of digital keys, certificates, and other secrets is automated and persistently reviewed. The combined result is pass. Validation: The result on this report is the result the evidence job wrote for the selected day. Assessment: No independent assessor has reviewed this indicator. In the past 30 days, this indicator was pass on 1 day, partial on 0 days, and fail on 0 days. In the stored days of the past year, the counts are 1 pass, 0 partial, and 0 fail. A full year of daily results is not available yet. ## Evaluating and Improving Security (KSI-SVC-EIS) Status: Implemented. Information resources are persistently evaluated for opportunities to improve security and those improvements are persistently made. The combined result is pass. Validation: The result on this report is the result the evidence job wrote for the selected day. Assessment: No independent assessor has reviewed this indicator. In the past 30 days, this indicator was pass on 1 day, partial on 0 days, and fail on 0 days. In the stored days of the past year, the counts are 1 pass, 0 partial, and 0 fail. A full year of daily results is not available yet. ## Preventing Residual Risk (KSI-SVC-PRR) Status: Not Implemented. Plans, procedures, and the state of information resources are persistently reviewed after making changes to limit and remove unwanted residual elements that would likely negatively affect the confidentiality, integrity, or availability of federal customer data. The combined result is fail. Validation: The result on this report is the result the evidence job wrote for the selected day. Assessment: No independent assessor has reviewed this indicator. In the past 30 days, this indicator was pass on 0 days, partial on 0 days, and fail on 1 day. In the stored days of the past year, the counts are 0 pass, 0 partial, and 1 fail. A full year of daily results is not available yet. ## Removing Unwanted Data (KSI-SVC-RUD) Status: Not Implemented. Unwanted federal customer data is removed promptly when requested by an agency in alignment with customer agreements, including from backups if appropriate; this typically applies when a customer spills information or when a customer seeks to remove information from a service due to a change in usage. The combined result is fail. Validation: The result on this report is the result the evidence job wrote for the selected day. Assessment: No independent assessor has reviewed this indicator. In the past 30 days, this indicator was pass on 0 days, partial on 0 days, and fail on 1 day. In the stored days of the past year, the counts are 0 pass, 0 partial, and 1 fail. A full year of daily results is not available yet. ## Securing Information (KSI-SVC-SIN) Status: Partially Implemented. Information is encrypted or otherwise secured from unwanted access or modification. The combined result is pass. Validation: The result on this report is the result the evidence job wrote for the selected day. Assessment: No independent assessor has reviewed this indicator. In the past 30 days, this indicator was pass on 1 day, partial on 0 days, and fail on 0 days. In the stored days of the past year, the counts are 1 pass, 0 partial, and 0 fail. A full year of daily results is not available yet. ## Validating Communications (KSI-SVC-VCM) Status: Partially Implemented. The authenticity and integrity of communications between machine-based information resources is persistently validated using automation. The combined result is pass. Validation: The result on this report is the result the evidence job wrote for the selected day. Assessment: No independent assessor has reviewed this indicator. In the past 30 days, this indicator was pass on 1 day, partial on 0 days, and fail on 0 days. In the stored days of the past year, the counts are 1 pass, 0 partial, and 0 fail. A full year of daily results is not available yet. ## Validating Resource Integrity (KSI-SVC-VRI) Status: Partially Implemented. Use cryptographic methods to validate the integrity of machine-based information resources. The combined result is pass. Validation: The result on this report is the result the evidence job wrote for the selected day. Assessment: No independent assessor has reviewed this indicator. In the past 30 days, this indicator was pass on 1 day, partial on 0 days, and fail on 0 days. In the stored days of the past year, the counts are 1 pass, 0 partial, and 0 fail. A full year of daily results is not available yet. # Rules ## AFC-CSO-INB, Maintain a FedRAMP Security Inbox. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## AFC-CSO-NOC, Notification of Changes. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## AFC-CSO-TFG, Trust @fedramp.gov and @gsa.gov. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## AFC-CSO-RCV, Receive Email Without Disruption. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## AFC-CSO-CRA, Complete Required Actions. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## AFC-CSO-EMR, Emergency Message Routing. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## AFC-CSO-IMA, Important Message Actions. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## AFC-CSO-ACK, Acknowledge Receipt. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## CCM-OCR-AVL, Report Availability. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## CCM-OCR-NRD, Next Report Date. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## CCM-OCR-FBM, Feedback Mechanism. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## CCM-OCR-AFS, Anonymized Feedback Summary. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## CCM-OCR-LSI, Limit Sensitive Information. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## CCM-OCR-SOR, Spread Out Reports. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## CCM-OCR-RPS, Responsible Public Certification Report Sharing. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## CCM-QTR-MTG, Quarterly Review Meeting. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## CCM-QTR-REG, Meeting Registration Info. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## CCM-QTR-NRD, Next Review Date. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## CCM-QTR-NID, No Irresponsible Disclosure. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## CCM-QTR-SAR, Schedule Around Reports. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## CCM-QTR-ACT, Additional Content. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## CCM-QTR-RTR, Record/Transcribe Reviews. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## CCM-QTR-RTP, Restrict Third Parties. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## CCM-QTR-SRR, Share Recordings Responsibly. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## CCM-QTR-SCR, Share Content Responsibly. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## CDS-CSO-PUB, Public Information. 1. The public page and the certification package overview share the provider name, service name, description, service model, deployment model, website, logo, FedRAMP ID, security contact, trust center address, and the service list. An assessor, a next report date, a public secure configuration guide, and service security categories are not available. 2. We compared this explanation with the rule. It matches what this tenant does. 3. Opening the record rebuilds this text from the stored evidence, which is how we check that it still matches the result. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## CDS-CSO-SVC, Public Service List. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## CDS-CSO-FID, Always Include FedRAMP ID. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## CDS-CSO-FRC, FedRAMP Certification Reports. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## CDS-CSO-AVR, Availability Reporting. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## CDS-CSO-UTC, Use Trust Centers. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## CDS-CSO-CBF, Consistency Between Formats. 1. The public page and the public JSON files are produced by the same functions from the same stored evidence. There is no separate copy that can drift. 2. We compared this explanation with the rule. It matches what this tenant does. 3. Opening the record rebuilds this text from the stored evidence, which is how we check that it still matches the result. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## CDS-CSO-RIS, Responsible Information Sharing. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## CDS-CSO-IRP, Include Relevant Policies. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## CDS-CSO-HAD, Historical FedRAMP Certification Data. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## CDS-CSO-PSM, Per-Service Certification Materials. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## CDS-CSO-RPS, Responsible Public Package Sharing. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## CDS-TRC-USH, Uninterrupted Sharing. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## CDS-TRC-PAC, Programmatic Access. 1. Every public certification file linked from this page is available with an unauthenticated GET. The HTML page is the human-readable form of the same data. 2. We compared this explanation with the rule. It matches what this tenant does. 3. Opening the record rebuilds this text from the stored evidence, which is how we check that it still matches the result. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## CDS-TRC-AAI, Agency Access Inventory. 1. No federal agency user or system has been granted access to certification data. The current inventory and the history are published at /public/access.json. Public files do not require an agency account. 2. We compared this explanation with the rule. It matches what this tenant does. 3. Opening the record rebuilds this text from the stored evidence, which is how we check that it still matches the result. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## CDS-TRC-ACL, Access Logging. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## CDS-TRC-HMR, Human and Machine-Readable Certification Data. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## CDS-TRC-SSM, Self-Service Access Management. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## CDS-UTC-AAD, Agency Access Denial. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## CDS-UTC-AGA, Agency Access. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## CMU-CSO-CMD, Cryptographic Module Documentation. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## CMU-CSO-UVM, Using Validated Cryptographic Modules. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## CMU-CSO-CAT, Configuration of Agency Tenants. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## CPO-CSO-OVR, Overview of the Cloud Service Offering. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## CPO-CSO-MTD, Certification Package Overview Metadata. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## CPO-CSO-OSA, Overall Summary of Assessment in Certification Package. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## CPO-CSX-CPM, Certification Package Maintenance for 20x. 1. Class C asks that the certification package stay current at least every two weeks. This record is built when the page is opened, from the latest stored evidence for the selected date. The rest of the package is not supplied with it. No senior official has accepted this gap. 2. We compared this explanation with the rule. It matches what this tenant does. 3. Opening the record rebuilds this text from the stored evidence, which is how we check that it still matches the result. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## FRC-CSO-FCP, FedRAMP Certification Profile. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## FRC-CSO-PKG, FedRAMP Certification Package. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## FRC-CSO-JSN, FedRAMP JSON Schemas. 1. Public JSON responses use Content-Type application/json, X-Content-Type-Options nosniff, and Cross-Origin Resource Sharing that allows another website to read them. The certification package overview and the security decision record validate against their FedRAMP schemas. The other package documents are not supplied. 2. We compared this explanation with the rule. It matches what this tenant does. 3. Opening the record rebuilds this text from the stored evidence, which is how we check that it still matches the result. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## FRC-CSO-MRA, Maintain Responsibility and Accountability. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## FRC-CSO-POP, Pick One Program Certification Type. 1. This cloud service offering is not seeking a FedRAMP Rev5 program certification. The rules in use are the FedRAMP 20x set. 2. We compared this explanation with the rule. It matches what this tenant does. 3. Opening the record rebuilds this text from the stored evidence, which is how we check that it still matches the result. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## FRC-CLA-ASF, Approved Alternative Security Frameworks. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## FRC-CLA-EAM, External Assessment Materials. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## FRC-CLA-MFR, Mandatory FedRAMP Rules for Class A. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## FRC-CLA-RFR, Recommended FedRAMP Rules for Class A. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## FRC-CLA-OFR, Address Optional FedRAMP Rules for Class A. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## FRC-CLA-IVV, Optional Independent Verification and Validation. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## FRC-APP-MLF, Marketplace Listing First. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## FRC-APP-AFC, Applying for FedRAMP Certification. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## FRC-APP-FCP, Fresh FedRAMP Certification Package. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## FRC-APP-FIA, Fresh Independent Assessment. 1. Class C requires a fresh assessment by a FedRAMP-recognized independent assessor within the previous three months. There is no such assessment. No senior official has accepted this gap. 2. We compared this explanation with the rule. It matches what this tenant does. 3. Opening the record rebuilds this text from the stored evidence, which is how we check that it still matches the result. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## FRC-APP-NTP, No Third-Party Applicants. 1. No FedRAMP certification application has been submitted. Mog Network LLC will submit any future application itself. No assessor or other third party is authorized to apply. 2. We compared this explanation with the rule. It matches what this tenant does. 3. Opening the record rebuilds this text from the stored evidence, which is how we check that it still matches the result. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## FRC-APP-USA, Updating Stale Assessments. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## FRC-APS-ATO, Agency Authorization to Operate. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## FRC-CCL-UCC, Upgrading Certification Class. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## FRC-CCL-DCC, Downgrading Certification Class. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## FRC-CCL-DNP, Downgrade Notification Period. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## FRC-CSX-VVK, Automated Verification and Validation of Key Security Indicators. 1. Class C requires at least two automated checks for every Key Security Indicator. The record counts them from the catalog on each build and names every indicator whose count is under two. Those indicators are KSI-CED-RAT, KSI-CMT-RVP, KSI-CNA-OFA, KSI-CNA-RVP, KSI-INR-AAR, KSI-INR-RIR, KSI-INR-RPI, KSI-MLA-RVL, KSI-PIY-RES, KSI-PIY-RIS, KSI-PIY-RSD, KSI-PIY-RVD, KSI-RPL-ARP, KSI-RPL-RRO, KSI-RPL-TRC, KSI-SCR-MIT, KSI-SVC-EIS, KSI-SVC-PRR, KSI-SVC-RUD, KSI-SVC-VCM, KSI-SVC-VRI. This stays Not Implemented until every indicator has two automated checks that can actually complete. A second check that does nothing will not be added to change this status. No senior official has accepted this gap. 2. We compared this explanation with the rule. It matches what this tenant does. 3. Opening the record rebuilds this text from the stored evidence, which is how we check that it still matches the result. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## FRC-CSX-VVR, Automated Verification and Validation of FedRAMP Rules. 1. This record is built from the evidence and the rule catalog when the page is opened. Most rules have no automated check. 2. We compared this explanation with the rule. It matches what this tenant does. 3. Opening the record rebuilds this text from the stored evidence, which is how we check that it still matches the result. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## FRC-CSX-MAS, Application within MAS. 1. These checks run in all four accounts, and one failed account fails the combined row. Many checks look only at roles and stacks this baseline deployed. There is no finished minimum-assessment-scope boundary. No senior official has accepted this gap. 2. We compared this explanation with the rule. It matches what this tenant does. 3. Opening the record rebuilds this text from the stored evidence, which is how we check that it still matches the result. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## IEC-CSO-EFR, Evaluate FedRAMP Reportability. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## IEC-CSO-DPR, Default PAIN Rating. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## IEC-CSO-IIR, Initial Incident Report. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## IEC-CSO-OIR, Ongoing Incident Reports. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## IEC-CSO-FIR, Final Incident Report. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## IEC-CSO-EFI, Estimate Federal Impact. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## IEC-CSO-AIR, Automated Incident Reporting. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## IVV-CSO-FIA, FedRAMP Independent Assessments. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## IVV-CSO-SEI, Supply Evidence of Implementation. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## IVV-CSO-SEE, Supply Evidence of Effectiveness. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## IVV-CSO-ICP, Inclusion in Certification Package. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## IVV-CSO-DUS, Document Use of Representative Samples. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## IVV-CSO-STE, Supply Technical Explanations. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## IVV-CSO-USR, Use Representative Samples. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## IVV-CSO-RAA, Receiving Assessor Advice. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## IVV-CSX-AIA, Annual Independent Assessments for 20x. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## MAS-CSO-IIR, Identify Information Resources. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## MAS-CSO-FLO, Information Flows and Security Categories. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## MAS-CSO-TPR, Third-Party Information Resources. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## MAS-CSO-MDI, Metadata Inclusion. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## MAS-CSO-SUP, Supplemental Information. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## MKT-CSO-MLR, Marketplace Listing Requirements. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## MKT-CSO-PML, Provider Marketplace Listing Requests. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## MKT-IIP-AGU, Agency Use Cases. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## MKT-IIP-DCP, Demonstrating Continuous Progress. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## MKT-IIP-DLA, Deadline for Assessment. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## SCG-CSO-RSC, Recommended Secure Configuration. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## SCG-CSO-AUP, Use Instructions. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## SCG-CSO-PUB, Public Secure Configuration Guidance. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## SCG-CSO-SDF, Secure Defaults. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## SCG-ENH-CMP, Comparison Capability. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## SCG-ENH-EXP, Export Capability. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## SCG-ENH-API, API Capability. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## SCG-ENH-MRG, Machine-Readable Guidance. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## SCG-ENH-VRH, Versioning and Release History. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## SCN-CSO-EVA, Evaluate Changes. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## SCN-CSO-MAR, Maintain Audit Records. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## SCN-CSO-INF, Required Information. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## SCN-CSO-HIS, Historical Notifications. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## SCN-CSO-HRM, Human and Machine-Readable Notifications. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## SCN-CSO-ARI, Additional Relevant Information. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## SCN-CSO-NOM, Notification Mechanisms. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## SCN-CSO-EMG, Emergency Changes. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## SCN-ADP-NTF, Notification Requirements. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## SCN-RTR-NNR, No Notification Requirements. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## SCN-TRF-NIP, Notification of Initial Plans. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## SCN-TRF-NFP, Notification of Final Plans. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## SCN-TRF-NAF, Notification After Finishing. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## SCN-TRF-NAV, Notification After Verification. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## SCN-TRF-UPD, Update Documentation. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## SCN-TRF-TPR, Third-Party Review. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## SDR-CSO-FRR, FedRAMP Rules. 1. For each rule, this record says how we follow it or why we do not, and how we check our own work. Nobody outside Mog Network has verified this record. No assessor has sent comments. 2. We compared this explanation with the rule. It matches what this tenant does. 3. Opening the record rebuilds this text from the stored evidence, which is how we check that it still matches the result. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## SDR-CSO-MTD, Security Decision Record Metadata. 1. This record has a version, the time it was built, and the source of that update. The source is the scheduled AWS Lambda function. 2. We compared this explanation with the rule. It matches what this tenant does. 3. Opening the record rebuilds this text from the stored evidence, which is how we check that it still matches the result. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## SDR-CSX-KSI, Key Security Indicators. 1. Each indicator names its checks, how often they run, whether the automation is enough, and how we confirm the result is the one the job produced. A present explanation is not a claim that the indicator itself passed. 2. We compared this explanation with the rule. It matches what this tenant does. 3. Opening the record rebuilds this text from the stored evidence, which is how we check that it still matches the result. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## SDR-CSX-KMT, Key Security Indicator Metrics. 1. Each indicator summarizes the past 30 days, summarizes the stored year, and lists every stored day with its result and whether validation finished. A full year is not available. No agreement to supply the missing history is invented. 2. We compared this explanation with the rule. It matches what this tenant does. 3. Opening the record rebuilds this text from the stored evidence, which is how we check that it still matches the result. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## VDR-CSO-DET, Vulnerability Detection. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## VDR-CSO-RES, Vulnerability Response. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## VDR-CSO-FAV, Failures Are Vulnerabilities. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## VDR-CSO-DFR, Design For Resilience. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## VDR-CSO-ADT, Automate Detection. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## VDR-CSO-DAC, Detect After Changes. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## VDR-CSO-MSP, Maintain Security. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## VDR-CSO-AKE, Avoid KEVs. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## VDR-CSO-SIR, Sampling. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## VDR-TFR-NMV, Non-Machine Verification and Validation. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## VDR-TFR-PDD, Persistent Drift Detection. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## VDR-TFR-PCD, Persistently Complete Detection. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## VDR-TFR-PVR, Mitigation and Remediation Expectations. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## VDR-TFR-RMN, Remaining Vulnerabilities. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## VDR-TFR-KEV, Remediate KEVs. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## VDR-TFR-PSD, Persistent Sample Detection. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## VDR-TFR-MVX, Persistent Machine Verification and Validation for 20x. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## VER-EVA-ELX, Evaluate Exploitability. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## VER-EVA-EIR, Evaluate Internet-Reachability. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## VER-EVA-EPA, Estimate Potential Agency Impact. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## VER-EVA-AIA, Assume It's Automatable. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## VER-EVA-GRV, Group Vulnerabilities. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## VER-EVA-EFP, Evaluate False Positives. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## VER-EVA-EFA, Evaluation Factors. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## VER-RPT-PER, Persistent Reporting. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## VER-RPT-VDT, Vulnerability Details. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## VER-RPT-AVI, Accepted Vulnerability Info. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## VER-RPT-NID, Responsible Disclosure. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## VER-RPT-HLO, High-Level Overviews. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## VER-RPT-RPD, Responsible Public Disclosure. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## VER-TFR-MHR, Monthly Activity Report. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## VER-TFR-MAV, Mark Accepted Vulnerabilities. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## VER-TFR-MRH, Historical Activity. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## VER-TFR-EVU, Evaluate Vulnerabilities Quickly. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## VER-TFR-IRI, Internet-Reachable Incidents. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none. ## VER-TFR-NRI, Non-Internet-Reachable Incidents. 1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap. 2. We looked through the checks. None of them covers this rule, so this is not a finished control. 3. Nothing is running for this rule, so there is no result to confirm. 4. Independent verification: none. 5. Independent validation: none. 6. Assessor comments: none. 7. Rule-specific file: none. Independent verification: none. Independent validation: none. Assessor comments: none.