ACSETalk to us
  1. Home
  2. Frameworks
  3. FedRAMP Moderate

FedRAMP Moderate

The Moderate baseline, watched between assessments.

FedRAMP Moderate is the NIST SP 800-53 Rev. 5 Moderate baseline, and continuous monitoring is part of the deal. ACSE checks the cloud configuration behind the baseline’s technical controls on every scan, and keeps a signed record of how each finding was fixed.

Talk to usSee how it works
Controls mapped to checksA layer of framework controls for PCI DSS, NIST, ISO, SOC 2 and CIS sits above the layer of checks that evaluate them; one failing check is traced to the control it affects.PCINISTISOSOC 2CISCONTROLSeach framework versioned and signedCHECKSone check can satisfy many controls
01

Continuous monitoring with less effort

Configuration drift against the baseline shows up on the next scan, tied to the control it affects.

02

Changes that hold up to review

Every fix is proposed as code, approved by a second person with MFA and verified after it applies.

03

Evidence that stays in your boundary

Findings and evidence stay in your own cloud. ACSE’s hosted service sees shapes and counts, not resource names.

Coverage

Tracked controls with a check behind them

ACSE tracks 45 technical controls of the Moderate baseline, from the AC, AU, CA, CM, CP, IA, IR, RA, SC and SI families, not the whole baseline. Controls without a check are listed as manual, beside the score, so nothing quietly drops out of view.

AWS
24 of 45 tracked controls
Google Cloud
15 of 45 tracked controls
Azure
12 of 45 tracked controls

Inside your boundary

Detail stays where it belongs

The ACSE runtime runs in your own environment. It reads configuration, evaluates checks, writes evidence and opens pull requests from there.

Only projections cross to ACSE’s hosted service: shapes and counts, never resource names, ARNs or ids. A deny-by-default registry decides what may leave.

Your data stays yoursA wall separates the customer’s cloud, holding resource names, ids, configuration and credentials, from what ACSE’s control plane receives: shapes and counts, such as seven buckets of which two are public.7 buckets · 2 publicno names, no idsYOUR CLOUDnames · ids · configcredentials · raw evidenceWHAT ACSE SEES · SHAPES AND COUNTS

What the checks support

Baseline families in practice

01

Access control

Administrator rights, MFA, guest access and credentials that are unused or unrotated.

02

Audit and configuration

Audit trails, log integrity, flow logs and secure defaults on compute and storage.

03

Boundary and encryption

Network exposure, encryption in transit and at rest, and key rotation.

Questions

What people ask us

Is ACSE FedRAMP authorized?

ACSE does not claim a FedRAMP authorization. This page is about checking your own environment against the Moderate baseline’s technical controls.

How is this different from the NIST 800-53 framework?

NIST SP 800-53 in ACSE tracks technical controls from the full Rev. 5 catalogue. FedRAMP Moderate tracks them as the Moderate baseline selects them. Each reports separately, under its own name and version.

Does ACSE cover the whole baseline?

No. ACSE tracks the technical controls cloud configuration can speak to and lists those. Controls without a check show as manual.

Keep reading

Related

Frameworks

NIST SP 800-53

ACSE maps cloud checks to the NIST SP 800-53 Rev. 5 technical controls it tracks across ten families, and shows each control as evaluated or manual.

ReadSolutions

Public sector

ACSE maps your cloud to CCCS Medium, NIST 800-53 Rev 5 and FedRAMP Moderate, fixes through your own code and keeps sovereign evidence in your account.

ReadTrust

Data boundary

ACSE runs in your account and sends only shapes and counts. Names, ids and credentials stay with you, and a deny-by-default registry governs what leaves.

Read

Talk to us

See ACSE on your cloud.

Tell us what you run and what your auditors ask for. We’ll show you the loop end to end: a real finding, a fix as code, an approval with MFA and the sealed record.

Talk to usExplore the platform