FedRAMP Control Families:
├── AC  — Access Control (25 controls at Moderate)
├── AU  — Audit and Accountability (16 controls)
├── CA  — Assessment, Authorization, Monitoring (9 controls)
├── CM  — Configuration Management (11 controls)
├── CP  — Contingency Planning (13 controls)
├── IA  — Identification and Authentication (11 controls)
├── IR  — Incident Response (10 controls)
├── MA  — Maintenance (6 controls)
├── MP  — Media Protection (8 controls)
├── PE  — Physical and Environmental Protection (20 controls)
├── PL  — Planning (4 controls)
├── PS  — Personnel Security (8 controls)
├── RA  — Risk Assessment (5 controls)
├── SA  — System and Services Acquisition (22 controls)
├── SC  — System and Communications Protection (44 controls)
├── SI  — System and Information Integrity (16 controls)
└── SR  — Supply Chain Risk Management (new in Rev 5)

{
  "system-security-plan": {
    "uuid": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
    "metadata": {
      "title": "System Security Plan — CloudApp",
      "last-modified": "2026-03-01T00:00:00Z",
      "version": "1.0",
      "oscal-version": "1.1.2"
    },
    "import-profile": {
      "href": "https://raw.githubusercontent.com/usnistgov/oscal-content/main/nist.gov/SP800-53/rev5/json/NIST_SP-800-53_rev5_MODERATE-baseline_profile.json"
    },
    "system-characteristics": {
      "system-name": "CloudApp Production",
      "security-sensitivity-level": "moderate",
      "system-information": {
        "information-types": [{
          "title": "Controlled Unclassified Information",
          "categorization": "moderate"
        }]
      },
      "authorization-boundary": {
        "description": "AWS VPC boundary with defined ingress/egress"
      }
    },
    "control-implementation": {
      "description": "FedRAMP Moderate baseline implementation",
      "implemented-requirements": []
    }
  }
}

# AC-2: Account Management — list inactive accounts
lastlog -b 90 | awk 'NR>1 && $2 != "Never" {print $1}'

# AU-2: Audit Events — verify audit daemon
systemctl is-active auditd && auditctl -l | wc -l

# CM-6: Configuration Settings — check SSH hardening
sshd -T | grep -E "^(permitrootlogin|passwordauthentication|maxauthtries)"

# IA-5: Authenticator Management — password aging
grep -E "^PASS_(MAX|MIN|WARN)_AGE" /etc/login.defs

# SC-28: Protection of Information at Rest
lsblk -o NAME,FSTYPE,MOUNTPOINT | grep crypt

# SI-2: Flaw Remediation — check pending patches
apt list --upgradable 2>/dev/null | grep -c security

node scripts/agent.js --action init --level moderate \
  --system-name "CloudApp Production" --output /tmp/fedramp-init.json

node scripts/agent.js --action assess --level moderate \
  --families ac,au,cm,ia,sc,si --output /tmp/fedramp-assess.json

node scripts/agent.js --action report --input /tmp/fedramp-assess.json \
  --format poam --output /tmp/fedramp-poam.json