Class FedRampRules

java.lang.Object
com.cloudforgeci.api.core.rules.FedRampRules
All Implemented Interfaces:
FrameworkRules<SystemContext>
@ComplianceFramework(value="FEDRAMP", priority=25, displayName="FedRAMP Moderate", description="Federal Risk and Authorization Management Program - NIST 800-53 Rev 5 Moderate Baseline") public class FedRampRules extends Object implements FrameworkRules<SystemContext>
FedRAMP Moderate compliance validation. Validates FedRAMP requirements based on NIST SP 800-53 Rev 5 controls. FedRAMP (Federal Risk and Authorization Management Program) provides a standardized approach to security assessment, authorization, and continuous monitoring for cloud products and services used by U.S. federal agencies.

Control Family Coverage (11 Technical Families):

  • AC - Access Control (AC-2 through AC-22)
  • AU - Audit and Accountability (AU-2 through AU-12)
  • CA - Assessment, Authorization, and Monitoring (CA-7, CA-9)
  • CM - Configuration Management (CM-2 through CM-8)
  • CP - Contingency Planning (CP-6 through CP-10)
  • IA - Identification and Authentication (IA-2 through IA-8)
  • IR - Incident Response (IR-4 through IR-6)
  • MP - Media Protection (MP-2 through MP-7)
  • RA - Risk Assessment (RA-5)
  • SC - System and Communications Protection (SC-7 through SC-28)
  • SI - System and Information Integrity (SI-2 through SI-7)

FedRAMP Baseline Levels:

  • Low - 156 controls (not implemented here)
  • Moderate - 323 controls (this implementation)
  • High - 410 controls (see FedRampHighRules)

Key Differences from Other Frameworks:

  • 3-year log retention requirement (vs HIPAA 6-year, PCI-DSS 1-year)
  • FIPS 140-2 cryptographic module validation required
  • Continuous monitoring (ConMon) with monthly vulnerability scans
  • Annual penetration testing required
Since:
3.1.0
See Also:

  • Constructor Details

    • FedRampRules

      public FedRampRules()

  • Method Details

    • install

      public void install(SystemContext ctx)
      Install FedRAMP compliance validation rules for production and staging environments. Federal systems require strict controls even in pre-production environments.
      Specified by:
      install in interface FrameworkRules<SystemContext>
      Parameters:
      ctx - the system context containing deployment configuration and CDK stack

    • claimedControls

      public Set<String> claimedControls()
      Controls checked across every validate* method above -- see FrameworkRules.claimedControls(). Controls the matrix marks REQUIRED for FedRAMP but left off this list belong to always-load cross-framework classes instead (KMS_KEY_ROTATION, SECRETS_MANAGER, SECRETS_ROTATION, DATABASE_PITR, DATABASE_LOGGING, CONTAINER_SECURITY, API_SECURITY, CDN_SECURITY, INSTANCE_METADATA_SECURITY, ROOT_ACCOUNT_PROTECTION, CREDENTIAL_ROTATION, SNS_KMS_ENCRYPTION, SECURITY_HUB, VULNERABILITY_SCANNING -- see KeyManagementRules, DatabaseSecurityRules, IamSecurityRules, ComputeSecurityRules, MessagingSecurityRules and similar), except LAMBDA_SECURITY and DATABASE_ACCESS_CONTROL, which are genuine gaps: no class anywhere checks them.
      Specified by:
      claimedControls in interface FrameworkRules<SystemContext>
      Returns:
      the control identifiers this framework's install() validates; empty if undeclared

    • generateComplianceReport

      public String generateComplianceReport(SystemContext ctx)
      Generate FedRAMP Moderate compliance report.