[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"detail-sidebar-cat-1-en-105":3,"doc-seo-171371-105":53,"doc-detail-171371-en":126},{"code":4,"msg":5,"data":6},0,"success",[7,14,19,24,29,34,39,44,49],{"id":8,"doc_module":9,"doc_module_name":10,"category_name":11,"show_sort_weight":12,"slug":13},11,1,"Template","Presentations",90,"presentations",{"id":15,"doc_module":9,"doc_module_name":10,"category_name":16,"show_sort_weight":17,"slug":18},12,"Resumes",80,"resumes",{"id":20,"doc_module":9,"doc_module_name":10,"category_name":21,"show_sort_weight":22,"slug":23},14,"Invoices",70,"invoices",{"id":25,"doc_module":9,"doc_module_name":10,"category_name":26,"show_sort_weight":27,"slug":28},15,"Posters",60,"posters",{"id":30,"doc_module":9,"doc_module_name":10,"category_name":31,"show_sort_weight":32,"slug":33},16,"Social Media",50,"social-media",{"id":35,"doc_module":9,"doc_module_name":10,"category_name":36,"show_sort_weight":37,"slug":38},17,"Forms",40,"forms",{"id":40,"doc_module":9,"doc_module_name":10,"category_name":41,"show_sort_weight":42,"slug":43},18,"Letters",30,"letters",{"id":45,"doc_module":9,"doc_module_name":10,"category_name":46,"show_sort_weight":47,"slug":48},21,"Paper Templates",5,"papers-templates",{"id":50,"doc_module":9,"doc_module_name":10,"category_name":51,"show_sort_weight":4,"slug":52},158,"General","general-158",{"code":4,"msg":54,"data":55},"ok",{"site_id":56,"language":57,"slug":58,"title":59,"keywords":60,"description":61,"schema_data":62,"social_meta":119,"head_meta":121,"extra_data":123,"updated_unix":125},105,"en","appendix-a-li-saas-fedramp-security-controls-security-controls-baseline","Appendix A LI-SaaS FedRAMP Security Controls - Security Controls Baseline","","Appendix A defines the minimum FedRAMP Tailored LI-SaaS security control baseline requirements for a CSP. It explains that six control categories—FED, NSO, Required, Conditional, Inherited, and Attestation—are used to tailor controls. Table A-1 provides the control tailoring criteria and links attestation-required responses to the FedRAMP Tailored LI-SaaS CSP Self-Attestation table. Table A-2 summarizes the FedRAMP Tailored LI-SaaS security controls and associates each control with the relevant tailoring criteria.",{"@graph":63,"@context":118},[64,80,101],{"@type":65,"itemListElement":66},"BreadcrumbList",[67,71,74,77],{"item":68,"name":69,"@type":70,"position":9},"https://docshare.wps.com","Home","ListItem",{"item":72,"name":10,"@type":70,"position":73},"https://docshare.wps.com/template/",2,{"item":75,"name":11,"@type":70,"position":76},"https://docshare.wps.com/template/presentations/",3,{"item":78,"name":59,"@type":70,"position":79},"https://docshare.wps.com/template/appendix-a-li-saas-fedramp-security-controls-security-controls-baseline/171371/",4,{"url":78,"name":59,"@type":81,"image":82,"author":87,"headline":59,"publisher":90,"fileFormat":93,"inLanguage":57,"description":61,"dateModified":94,"datePublished":95,"encodingFormat":93,"isAccessibleForFree":96,"interactionStatistic":97},"DigitalDocument",{"url":83,"@type":84,"width":85,"height":86},"https://docshare.wps.com/thumbnails/appendix-a-li-saas-fedramp-security-controls-security-controls-baseline/171371.png","ImageObject",442,249,{"name":88,"@type":89},"Violet","Person",{"url":68,"name":91,"@type":92},"DocShare","Organization","application/vnd.openxmlformats-officedocument.wordprocessingml.document","2026-10-19","2026-09-01",true,{"@type":98,"interactionType":99,"userInteractionCount":40},"InteractionCounter",{"@type":100},"ViewAction",{"@type":102,"mainEntity":103},"FAQPage",[104,110,114],{"name":105,"@type":106,"acceptedAnswer":107},"What does Appendix A LI-SaaS FedRAMP security controls specify?","Question",{"text":108,"@type":109},"It specifies minimum FedRAMP Tailored LI-SaaS security control baseline requirements for a CSP and how controls are tailored by criteria.","Answer",{"name":111,"@type":106,"acceptedAnswer":112},"Which six categories are used for FedRAMP Tailored LI-SaaS controls?",{"text":113,"@type":109},"The categories are FED, NSO, Required, Conditional, Inherited, and Attestation.",{"name":115,"@type":106,"acceptedAnswer":116},"How are attestation-required controls handled in the baseline?",{"text":117,"@type":109},"CSP responses for controls requiring attestation are defined in the FedRAMP Tailored LI-SaaS CSP Self-Attestation table.","https://schema.org",{"og:url":78,"og:type":120,"og:title":59,"og:site_name":91,"og:description":61},"article",{"robots":122,"canonical":78},"index,follow",{"doc_id":124,"site_id":56},171371,1788282165,{"code":4,"msg":5,"data":127},{"doc_id":124,"user_id":128,"nickname":88,"user_avatar":129,"doc_module":9,"category_id":8,"category_name":11,"doc_title":59,"doc_description":61,"doc_content":130,"file_id":131,"file_url":132,"file_type":133,"file_size":134,"view_count":40,"is_deleted":4,"is_public":9,"is_downloadable":9,"audit_status":9,"page_count":135,"language":136,"language_code":57,"site_id":56,"html_lang":57,"table_of_contents":137,"faqs":138,"seo_title":139,"seo_description":61,"update_tm":125,"read_time":140},4398048950312,"https://ap-avatar.wpscdn.com/avatar/400002538284de19e3c?_k=1778320343897328908","TEMPLATE REVISION HISTORY\nHow to contact us\nFor questions about FedRAMP, or for questions about this document including how to use it, contact \u0013 HYPERLINK \"mailto:info@FedRAMP.gov\" \\h \u0014info@FedRAMP.gov.\u0015\nFor more information about FedRAMP, see \u0013 HYPERLINK \"http://www.fedramp.gov\" \\h \u0014www.FedRAMP.gov\u0015.\nDelete this Template Revision History page and all other instructional text from your final version of this document.\n\u000eAppendix A LI-SaaS: \u003CCSO Name> FedRAMP Security Controls\nSecurity controls must meet minimum security control baseline requirements. The following table contains the FedRAMP Tailored LI-SaaS Security Controls Baseline (by family).\nThere are six (6) categories of FedRAMP Tailored LI-SaaS controls: FED, NSO, Required, Conditional, Inherited, and Attestation. Table A-1, Control Tailoring Criteria, provides definitions of the tailoring criteria utilized for the determination of the FedRAMP Tailored LI-SaaS baseline.\nTable A-1.  Control Tailoring Criteria\nA CSP response, for all controls requiring an attestation of the status and implementation of the security requirements, is defined in the FedRAMP Tailored LI-SaaS CSP Self-Attestation table. (See Section 3, FedRAMP Tailored Low Impact Software as a Service [LI-SaaS] Self-Attestation Requirements).\nTable A-2, Summary of FedRAMP Tailored LI-SaaS Security Controls, lists all the controls required for the FedRAMP Low Impact Baseline and the associated tailoring criteria for each control.\nTable A-2.  Summary of FedRAMP Tailored LI-SaaS Security Controls\n\u000eTABLE OF CONTENTS\u0013 TOC \\h \\z \\t \"Heading 1,1,Heading 2,2,Heading 3-AC title,3,Heading 4- AC,4\" \u0014\n\u0013 HYPERLINK \\l \"_Toc144300871\" \u00141.0 Documented and Assessed Controls\t\u0013 PAGEREF _Toc144300871 \\h \u001423\u0015\u0015\n\u0013 HYPERLINK \\l \"_Toc144300872\" \u0014Access Control (AC)\t\u0013 PAGEREF _Toc144300872 \\h \u001427\u0015\u0015\n\u0013 HYPERLINK \\l \"_Toc144300873\" \u0014AC-2 Account Management\t\u0013 PAGEREF _Toc144300873 \\h \u001427\u0015\u0015\n\u0013 HYPERLINK \\l \"_Toc144300874\" \u0014AC-3 Access Enforcement\t\u0013 PAGEREF _Toc144300874 \\h \u001431\u0015\u0015\n\u0013 HYPERLINK \\l \"_Toc144300875\" \u0014AC-7 Unsuccessful Logon Attempts\t\u0013 PAGEREF _Toc144300875 \\h \u001432\u0015\u0015\n\u0013 HYPERLINK \\l \"_Toc144300876\" \u0014AC-17 Remote Access\t\u0013 PAGEREF _Toc144300876 \\h \u001435\u0015\u0015\n\u0013 HYPERLINK \\l \"_Toc144300877\" \u0014AC-22 Publicly Accessible Content\t\u0013 PAGEREF _Toc144300877 \\h \u001437\u0015\u0015\n\u0013 HYPERLINK \\l \"_Toc144300878\" \u0014Audit and Accountability (AU)\t\u0013 PAGEREF _Toc144300878 \\h \u001439\u0015\u0015\n\u0013 HYPERLINK \\l \"_Toc144300879\" \u0014AU-3 Content of Audit Records\t\u0013 PAGEREF _Toc144300879 \\h \u001439\u0015\u0015\n\u0013 HYPERLINK \\l \"_Toc144300880\" \u0014AU-5 Response to Audit Logging Process Failures\t\u0013 PAGEREF _Toc144300880 \\h \u001442\u0015\u0015\n\u0013 HYPERLINK \\l \"_Toc144300881\" \u0014AU-6 Audit Record Review, Analysis, and Reporting\t\u0013 PAGEREF _Toc144300881 \\h \u001444\u0015\u0015\n\u0013 HYPERLINK \\l \"_Toc144300882\" \u0014Security Assessment and Authorization (CA)\t\u0013 PAGEREF _Toc144300882 \\h \u001446\u0015\u0015\n\u0013 HYPERLINK \\l \"_Toc144300883\" \u0014CA-2 Control Assessments\t\u0013 PAGEREF _Toc144300883 \\h \u001446\u0015\u0015\n\u0013 HYPERLINK \\l \"_Toc144300884\" \u0014CA-3 Information Exchange (Conditional)\t\u0013 PAGEREF _Toc144300884 \\h \u001449\u0015\u0015\n\u0013 HYPERLINK \\l \"_Toc144300885\" \u0014CA-6 Authorization\t\u0013 PAGEREF _Toc144300885 \\h \u001452\u0015\u0015\n\u0013 HYPERLINK \\l \"_Toc144300886\" \u0014CA-7 Continuous Monitoring\t\u0013 PAGEREF _Toc144300886 \\h \u001454\u0015\u0015\n\u0013 HYPERLINK \\l \"_Toc144300887\" \u0014CA-7(4) Risk Monitoring\t\u0013 PAGEREF _Toc144300887 \\h \u001458\u0015\u0015\n\u0013 HYPERLINK \\l \"_Toc144300888\" \u0014CA-8 Penetration Testing\t\u0013 PAGEREF _Toc144300888 \\h \u001460\u0015\u0015\n\u0013 HYPERLINK \\l \"_Toc144300889\" \u0014CA-9 Internal System Connections (Conditional)\t\u0013 PAGEREF _Toc144300889 \\h \u001462\u0015\u0015\n\u0013 HYPERLINK \\l \"_Toc144300890\" \u0014Configuration Management (CM)\t\u0013 PAGEREF _Toc144300890 \\h \u001464\u0015\u0015\n\u0013 HYPERLINK \\l \"_Toc144300891\" \u0014CM-4 Impact Analysis\t\u0013 PAGEREF _Toc144300891 \\h \u001464\u0015\u0015\n\u0013 HYPERLINK \\l \"_Toc144300892\" \u0014CM-5 Access Restrictions for Change\t\u0013 PAGEREF _Toc144300892 \\h \u001467\u0015\u0015\n\u0013 HYPERLINK \\l \"_Toc144300893\" \u0014CM-6 Configuration Settings\t\u0013 PAGEREF _Toc144300893 \\h \u001469\u0015\u0015\n\u0013 HYPERLINK \\l \"_Toc144300894\" \u0014CM-8 System Component Inventory\t\u0013 PAGEREF _Toc144300894 \\h \u001472\u0015\u0015\n\u0013 HYPERLINK \\l \"_Toc144300895\" \u0014Contingency Planning (CP)\t\u0013 ","cbCaijGTFydOBjNG","https://ap.wps.com/l/cbCaijGTFydOBjNG","docx",390199,292,"English","# 1.0 Documented and Assessed Controls\n## Access Control (AC)\n## Audit and Accountability (AU)\n## Security Assessment and Authorization (CA)\n## Configuration Management (CM)\n## Contingency Planning (CP)\n## Identification and Authentication (IA)\n## Incident Response (IR)\n## Maintenance (MA)\n## Media Protection (MP)","[{\"question\":\"What does Appendix A LI-SaaS FedRAMP security controls specify?\",\"answer\":\"It specifies minimum FedRAMP Tailored LI-SaaS security control baseline requirements for a CSP and how controls are tailored by criteria.\"},{\"question\":\"Which six categories are used for FedRAMP Tailored LI-SaaS controls?\",\"answer\":\"The categories are FED, NSO, Required, Conditional, Inherited, and Attestation.\"},{\"question\":\"How are attestation-required controls handled in the baseline?\",\"answer\":\"CSP responses for controls requiring attestation are defined in the FedRAMP Tailored LI-SaaS CSP Self-Attestation table.\"}]","Appendix A LI-SaaS FedRAMP Security Controls - Security Controls Baseline | DOCX",102]