[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6P30TFS2CMKG6R14E1KFSQ8":3,"skill-same:01M6P30TFS2CMKG6R14E1KFSQ8":77},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":22,"publishedAt":43,"linkOnly":44,"markdownContent":45,"markdownBody":46,"frontMatter":47,"refName":32,"commitSha":58,"skillDirectory":59,"forksCount":13,"repositoryHtmlUrl":60,"repositoryHomepageUrl":6,"ownerHtmlUrl":61,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":62,"install":63,"resources":76},"01M6P30TFS2CMKG6R14E1KFSQ8","fedramp-compliance",null,"Implement FedRAMP requirements for federal cloud services. Configure NIST 800-53 controls and continuous monitoring. Use when providing cloud services to US federal agencies.","duc-duy-1612\u002FOnline-Delivery-Systems-Web","duc-duy-1612","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F192231384?v=4","01M6NSDKQQDKVTHZ8DZMZ1VYY6","01M6NSDKW8DDVTQHBT1HBDDJPT",0,"MIT","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Ffedramp-compliance\u002FSKILL.md",[17],{"categoryNo":18,"categoryName":19,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000037","律师与法务","PROFESSION","适用职业",[23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42],"fedramp compliance","compliance","fedramp","use","us federal","apply","for","controls","requirements","main","community","agent-skills","github","configure","devops-security","services","monitoring","license","change","implement","2026-11-10 10:12:30",false,"---\nname: fedramp-compliance\ndescription: Implement FedRAMP requirements for federal cloud services. Configure\n  NIST 800-53 controls and continuous monitoring. Use when providing cloud services\n  to US federal agencies.\ncategory: security\nrisk: safe\nsource: https:\u002F\u002Fgithub.com\u002FBagelHole\u002FDevOps-Security-Agent-Skills\nsource_repo: BagelHole\u002FDevOps-Security-Agent-Skills\nsource_type: community\ndate_added: '2026-09-20'\nlicense: MIT\nlicense_source: https:\u002F\u002Fgithub.com\u002FBagelHole\u002FDevOps-Security-Agent-Skills\u002Fblob\u002Fmain\u002FLICENSE\ncompatibility: Checklist and framework guidance; no privileged tooling required. Apply\n  controls through your own change process.\nmetadata:\n  author: devops-skills\n  version: '1.0'\n---\n\n# FedRAMP Compliance\n\nImplement FedRAMP (Federal Risk and Authorization Management Program) requirements for cloud service providers serving US federal agencies.\n\n## When to Use\n\n- Pursuing FedRAMP authorization for a cloud service offering\n- Implementing NIST 800-53 security controls for federal workloads\n- Establishing continuous monitoring (ConMon) processes\n- Managing Plan of Action and Milestones (POA&M) tracking\n- Preparing for a Third-Party Assessment Organization (3PAO) audit\n- Operating a FedRAMP-authorized system and maintaining authorization\n\n## Impact Levels\n\n```yaml\nimpact_levels:\n  low:\n    control_count: ~125\n    use_case: \"Publicly available federal information\"\n    examples:\n      - Public-facing websites with no sensitive data\n      - Open data portals\n      - Marketing and informational systems\n    data_types: \"No PII, no CUI, publicly releasable only\"\n    authorization_path: \"FedRAMP Tailored (Li-SaaS) or standard Low\"\n\n  moderate:\n    control_count: ~325\n    use_case: \"Most federal systems, including CUI\"\n    examples:\n      - Email and collaboration platforms\n      - Case management systems\n      - Financial management systems\n      - HR and personnel systems\n    data_types: \"CUI, PII, law enforcement sensitive (LES)\"\n    authorization_path: \"Agency or JAB P-ATO\"\n    note: \"~80% of FedRAMP authorizations are at Moderate\"\n\n  high:\n    control_count: ~425\n    use_case: \"High-impact federal systems\"\n    examples:\n      - Law enforcement and criminal justice systems\n      - Emergency services and public safety\n      - Financial systems with significant impact\n      - Healthcare systems with PHI\n    data_types: \"Classified-adjacent, life-safety, critical infrastructure\"\n    authorization_path: \"JAB P-ATO required\"\n```\n\n## NIST 800-53 Control Families\n\n```yaml\ncontrol_families:\n  AC:\n    name: \"Access Control\"\n    key_controls:\n      AC-2: \"Account Management - manage system accounts lifecycle\"\n      AC-3: \"Access Enforcement - enforce approved authorizations\"\n      AC-6: \"Least Privilege - employ principle of least privilege\"\n      AC-17: \"Remote Access - establish usage restrictions for remote access\"\n    implementation_notes: \"Map to IAM policies, RBAC, MFA enforcement\"\n\n  AU:\n    name: \"Audit and Accountability\"\n    key_controls:\n      AU-2: \"Audit Events - define auditable events\"\n      AU-3: \"Content of Audit Records - ensure records contain required info\"\n      AU-6: \"Audit Review, Analysis, and Reporting\"\n      AU-12: \"Audit Generation - generate audit records\"\n    implementation_notes: \"Map to CloudTrail, CloudWatch Logs, SIEM\"\n\n  AT:\n    name: \"Awareness and Training\"\n    key_controls:\n      AT-2: \"Security Awareness Training - provide training to users\"\n      AT-3: \"Role-Based Security Training - for personnel with security roles\"\n    implementation_notes: \"Annual security training, role-specific training\"\n\n  CM:\n    name: \"Configuration Management\"\n    key_controls:\n      CM-2: \"Baseline Configuration - develop and maintain baseline\"\n      CM-6: \"Configuration Settings - establish mandatory settings\"\n      CM-7: \"Least Functionality - restrict to essential capabilities\"\n      CM-8: \"Information System Component Inventory\"\n    implementation_notes: \"Map to AWS Config, SSM, hardened AMIs\"\n\n  CP:\n    name: \"Contingency Planning\"\n    key_controls:\n      CP-2: \"Contingency Plan - develop and maintain plan\"\n      CP-4: \"Contingency Plan Testing - test plan annually\"\n      CP-9: \"Information System Backup\"\n      CP-10: \"Information System Recovery and Reconstitution\"\n    implementation_notes: \"Map to DR plan, backup strategy, failover testing\"\n\n  IA:\n    name: \"Identification and Authentication\"\n    key_controls:\n      IA-2: \"Identification and Authentication (Org Users)\"\n      IA-5: \"Authenticator Management\"\n      IA-8: \"Identification and Authentication (Non-Org Users)\"\n    implementation_notes: \"Map to SSO, MFA, certificate-based auth, PIV\u002FCAC\"\n\n  IR:\n    name: \"Incident Response\"\n    key_controls:\n      IR-2: \"Incident Response Training\"\n      IR-4: \"Incident Handling - implement incident handling capability\"\n      IR-6: \"Incident Reporting - report incidents to US-CERT\"\n      IR-8: \"Incident Response Plan\"\n    implementation_notes: \"US-CERT reporting within 1 hour for federal incidents\"\n\n  MA:\n    name: \"Maintenance\"\n    key_controls:\n      MA-2: \"Controlled Maintenance\"\n      MA-4: \"Nonlocal Maintenance - authorize nonlocal maintenance\"\n    implementation_notes: \"Patching procedures, remote maintenance controls\"\n\n  MP:\n    name: \"Media Protection\"\n    key_controls:\n      MP-2: \"Media Access - restrict access to media\"\n      MP-6: \"Media Sanitization - sanitize media prior to disposal\"\n    implementation_notes: \"Encryption at rest, secure disposal procedures\"\n\n  PE:\n    name: \"Physical and Environmental Protection\"\n    key_controls:\n      PE-2: \"Physical Access Authorizations\"\n      PE-3: \"Physical Access Control\"\n      PE-6: \"Monitoring Physical Access\"\n    implementation_notes: \"Inherit from CSP for IaaS\u002FPaaS, document inheritance\"\n\n  PL:\n    name: \"Planning\"\n    key_controls:\n      PL-2: \"System Security Plan (SSP)\"\n    implementation_notes: \"SSP is the core FedRAMP deliverable\"\n\n  PS:\n    name: \"Personnel Security\"\n    key_controls:\n      PS-3: \"Personnel Screening\"\n      PS-4: \"Personnel Termination\"\n      PS-5: \"Personnel Transfer\"\n    implementation_notes: \"Background checks, access revocation on termination\"\n\n  RA:\n    name: \"Risk Assessment\"\n    key_controls:\n      RA-3: \"Risk Assessment - conduct risk assessment\"\n      RA-5: \"Vulnerability Scanning\"\n    implementation_notes: \"Annual risk assessment, monthly vulnerability scans\"\n\n  CA:\n    name: \"Security Assessment and Authorization\"\n    key_controls:\n      CA-2: \"Security Assessments\"\n      CA-6: \"Security Authorization\"\n      CA-7: \"Continuous Monitoring\"\n    implementation_notes: \"Annual assessment by 3PAO, ConMon program\"\n\n  SC:\n    name: \"System and Communications Protection\"\n    key_controls:\n      SC-7: \"Boundary Protection\"\n      SC-8: \"Transmission Confidentiality and Integrity\"\n      SC-12: \"Cryptographic Key Establishment and Management\"\n      SC-13: \"Cryptographic Protection - FIPS 140-2 validated\"\n      SC-28: \"Protection of Information at Rest\"\n    implementation_notes: \"FIPS 140-2 validated modules required\"\n\n  SI:\n    name: \"System and Information Integrity\"\n    key_controls:\n      SI-2: \"Flaw Remediation\"\n      SI-3: \"Malicious Code Protection\"\n      SI-4: \"Information System Monitoring\"\n      SI-5: \"Security Alerts, Advisories, and Directives\"\n    implementation_notes: \"Patching SLAs, antimalware, IDS\u002FIPS, SIEM\"\n\n  SA:\n    name: \"System and Services Acquisition\"\n    key_controls:\n      SA-4: \"Acquisition Process - security requirements in contracts\"\n      SA-9: \"External Information System Services\"\n      SA-11: \"Developer Security Testing\"\n    implementation_notes: \"Supply chain risk management, SBOM\"\n\n  PM:\n    name: \"Program Management\"\n    key_controls:\n      PM-1: \"Information Security Program Plan\"\n      PM-9: \"Risk Management Strategy\"\n    implementation_notes: \"Organization-wide security program\"\n```\n\n## System Security Plan (SSP) Outline\n\n```yaml\nssp_sections:\n  section_1: \"Information System Name and Title\"\n  section_2: \"Information System Categorization (FIPS 199)\"\n  section_3: \"Information System Owner\"\n  section_4: \"Authorizing Official\"\n  section_5: \"Other Designated Contacts\"\n  section_6: \"Assignment of Security Responsibility\"\n  section_7: \"Information System Operational Status\"\n  section_8: \"Information System Type (cloud service model)\"\n  section_9: \"General System Description\"\n  section_10: \"System Environment and Special Considerations\"\n  section_11: \"System Interconnections\"\n  section_12: \"Laws, Regulations, Policies Applicable\"\n  section_13: \"Minimum Security Controls\"\n\n  key_attachments:\n    - \"Control Implementation Summary (CIS) workbook\"\n    - \"Network architecture diagrams\"\n    - \"Data flow diagrams\"\n    - \"Interconnection security agreements (ISAs)\"\n    - \"Incident response plan\"\n    - \"Contingency plan\"\n    - \"Configuration management plan\"\n```\n\n## POA&M (Plan of Action and Milestones) Tracking\n\n```yaml\n# poam_template.yaml\npoam_entry:\n  - id: \"POAM-2025-001\"\n    weakness: \"AC-2(3) - Automated account disable after 90 days inactivity not implemented\"\n    control: \"AC-2\"\n    risk_level: \"moderate\"\n    finding_source: \"3PAO Annual Assessment - 2025\"\n    date_identified: \"2025-03-15\"\n    scheduled_completion: \"2025-06-15\"\n    milestone_1:\n      description: \"Configure IdP inactivity policy\"\n      target_date: \"2025-04-15\"\n      status: \"complete\"\n    milestone_2:\n      description: \"Test automated disable in staging\"\n      target_date: \"2025-05-01\"\n      status: \"in_progress\"\n    milestone_3:\n      description: \"Deploy to production and validate\"\n      target_date: \"2025-06-15\"\n      status: \"not_started\"\n    responsible_party: \"IAM Team\"\n    status: \"open\"\n    vendor_dependency: false\n\n  - id: \"POAM-2025-002\"\n    weakness: \"RA-5 - Vulnerability scan coverage does not include container images\"\n    control: \"RA-5\"\n    risk_level: \"high\"\n    finding_source: \"3PAO Annual Assessment - 2025\"\n    date_identified: \"2025-03-15\"\n    scheduled_completion: \"2025-05-15\"\n    milestone_1:\n      description: \"Evaluate and select container scanning tool\"\n      target_date: \"2025-04-01\"\n      status: \"complete\"\n    milestone_2:\n      description: \"Integrate scanning into CI\u002FCD pipeline\"\n      target_date: \"2025-04-30\"\n      status: \"in_progress\"\n    milestone_3:\n      description: \"Demonstrate full coverage to 3PAO\"\n      target_date: \"2025-05-15\"\n      status: \"not_started\"\n    responsible_party: \"Security Engineering\"\n    status: \"open\"\n    vendor_dependency: false\n\npoam_aging_thresholds:\n  high: \"Must be resolved within 30 days\"\n  moderate: \"Must be resolved within 90 days\"\n  low: \"Must be resolved within 180 days\"\n  overdue_escalation: \"Reported to authorizing official monthly\"\n```\n\n## Continuous Monitoring (ConMon) Procedures\n\n```yaml\ncontinuous_monitoring:\n  monthly:\n    vulnerability_scanning:\n      scope: \"All operating systems, databases, web applications, and containers\"\n      tool: \"Tenable.io, Qualys, or equivalent\"\n      deliverable: \"Monthly scan report with remediation status\"\n      sla:\n        critical_cvss_9_plus: \"Remediate within 30 days\"\n        high_cvss_7_to_9: \"Remediate within 30 days\"\n        moderate_cvss_4_to_7: \"Remediate within 90 days\"\n        low_cvss_below_4: \"Remediate within 180 days\"\n\n    poam_updates:\n      action: \"Update all open POA&M items with current status\"\n      deliverable: \"Updated POA&M spreadsheet submitted to agency\"\n      content:\n        - \"Milestone completion updates\"\n        - \"New POA&M items from scans\"\n        - \"Closed POA&M items with evidence\"\n\n    inventory_updates:\n      action: \"Review and update system component inventory\"\n      deliverable: \"Updated hardware and software inventory\"\n\n  quarterly:\n    - \"Review and update SSP with any system changes\"\n    - \"Submit ConMon deliverables package to agency\"\n    - \"Review access control lists and user accounts\"\n    - \"Update network diagrams if changes occurred\"\n\n  annual:\n    security_assessment:\n      performed_by: \"3PAO\"\n      scope: \"Subset of controls (~1\u002F3 each year, full coverage in 3 years)\"\n      deliverable: \"Security Assessment Report (SAR)\"\n\n    penetration_testing:\n      performed_by: \"3PAO or qualified third party\"\n      scope: \"External and internal network, web applications\"\n      deliverable: \"Penetration test report with findings\"\n\n    contingency_plan_test:\n      scope: \"Full DR\u002FBCP test including failover\"\n      deliverable: \"Contingency plan test report\"\n\n    incident_response_test:\n      scope: \"Tabletop exercise or functional exercise\"\n      deliverable: \"IR test report with lessons learned\"\n```\n\n## FedRAMP FIPS 140-2 Cryptography Requirements\n\n```bash\n# Verify FIPS mode is enabled on Linux systems\ncat \u002Fproc\u002Fsys\u002Fcrypto\u002Ffips_enabled\n# Output should be: 1\n\n# Check OpenSSL FIPS module\nopenssl version\nopenssl list -providers  # Should show FIPS provider\n\n# AWS: Use FIPS endpoints\n# Example: Use FIPS endpoint for S3\naws s3 ls --endpoint-url https:\u002F\u002Fs3-fips.us-east-1.amazonaws.com\n\n# Configure AWS CLI for FIPS\n# ~\u002F.aws\u002Fconfig\n# [default]\n# use_fips_endpoint = true\n\n# Verify TLS configuration meets FedRAMP requirements\nopenssl s_client -connect your-service.example.com:443 -tls1_2 \u003C \u002Fdev\u002Fnull 2>\u002Fdev\u002Fnull | \\\n  grep -E \"Protocol|Cipher\"\n# Must be TLS 1.2 or higher with FIPS-approved cipher suites\n```\n\n## FedRAMP Authorization Checklist\n\n```yaml\nauthorization_checklist:\n  pre_authorization:\n    - [ ] Determine impact level (Low, Moderate, High)\n    - [ ] Choose authorization path (Agency ATO or JAB P-ATO)\n    - [ ] Engage FedRAMP PMO for readiness assessment\n    - [ ] Select 3PAO from FedRAMP marketplace\n    - [ ] Complete SSP with all control implementations documented\n    - [ ] Develop required policies and procedures\n    - [ ] Implement all applicable NIST 800-53 controls\n    - [ ] Ensure FIPS 140-2 validated cryptographic modules in use\n\n  assessment:\n    - [ ] 3PAO conducts readiness assessment (optional but recommended)\n    - [ ] 3PAO conducts full security assessment\n    - [ ] 3PAO delivers Security Assessment Report (SAR)\n    - [ ] Develop POA&M for all findings\n    - [ ] Remediate critical and high findings before authorization\n\n  authorization_package:\n    - [ ] System Security Plan (SSP)\n    - [ ] Security Assessment Report (SAR)\n    - [ ] Plan of Action and Milestones (POA&M)\n    - [ ] Continuous Monitoring Plan\n    - [ ] Incident Response Plan\n    - [ ] Contingency Plan\n    - [ ] Configuration Management Plan\n    - [ ] Control Implementation Summary (CIS)\n    - [ ] Interconnection Security Agreements\n\n  post_authorization:\n    - [ ] Establish ConMon program with monthly deliverables\n    - [ ] Monthly vulnerability scanning and POA&M updates\n    - [ ] Annual 3PAO assessment of control subset\n    - [ ] Annual penetration testing\n    - [ ] Report significant changes to authorizing official\n    - [ ] Report security incidents to US-CERT within 1 hour\n    - [ ] Maintain authorization by meeting ConMon requirements\n```\n\n## Best Practices\n\n- Start with a FedRAMP Readiness Assessment to identify gaps before the formal 3PAO assessment\n- Use the FedRAMP SSP template exactly as provided to avoid review delays\n- Inherit controls from your IaaS provider (AWS GovCloud, Azure Government) and document the inheritance clearly\n- Implement FIPS 140-2 validated cryptographic modules for all encryption (TLS, at-rest, key management)\n- Automate continuous monitoring deliverables to reduce manual effort and human error\n- Maintain POA&M items within aging thresholds; overdue items risk losing authorization\n- Report significant system changes to the authorizing official before implementation\n- Treat the SSP as a living document and update it with every change to the system boundary\n- Use US-CERT reporting procedures and maintain the 1-hour incident notification requirement\n- Engage the FedRAMP PMO early and often for guidance on the authorization process\n\n## Limitations\n\n- Guidance and checklists only; not legal advice and not a substitute for a qualified auditor.\n- Docs-only import: upstream templates and scripts not bundled.\n\n### Example\n\n```markdown\nMap this skill's control checklist to our current evidence and list gaps.\n```\n\n> Adapted from [BagelHole\u002FDevOps-Security-Agent-Skills](https:\u002F\u002Fgithub.com\u002FBagelHole\u002FDevOps-Security-Agent-Skills) (MIT); frontmatter, When to Use\u002FLimitations, and safety boundaries added for upstream compliance. Docs-only import: helper scripts and templates not bundled.\n","# FedRAMP Compliance\n\nImplement FedRAMP (Federal Risk and Authorization Management Program) requirements for cloud service providers serving US federal agencies.\n\n## When to Use\n\n- Pursuing FedRAMP authorization for a cloud service offering\n- Implementing NIST 800-53 security controls for federal workloads\n- Establishing continuous monitoring (ConMon) processes\n- Managing Plan of Action and Milestones (POA&M) tracking\n- Preparing for a Third-Party Assessment Organization (3PAO) audit\n- Operating a FedRAMP-authorized system and maintaining authorization\n\n## Impact Levels\n\n```yaml\nimpact_levels:\n  low:\n    control_count: ~125\n    use_case: \"Publicly available federal information\"\n    examples:\n      - Public-facing websites with no sensitive data\n      - Open data portals\n      - Marketing and informational systems\n    data_types: \"No PII, no CUI, publicly releasable only\"\n    authorization_path: \"FedRAMP Tailored (Li-SaaS) or standard Low\"\n\n  moderate:\n    control_count: ~325\n    use_case: \"Most federal systems, including CUI\"\n    examples:\n      - Email and collaboration platforms\n      - Case management systems\n      - Financial management systems\n      - HR and personnel systems\n    data_types: \"CUI, PII, law enforcement sensitive (LES)\"\n    authorization_path: \"Agency or JAB P-ATO\"\n    note: \"~80% of FedRAMP authorizations are at Moderate\"\n\n  high:\n    control_count: ~425\n    use_case: \"High-impact federal systems\"\n    examples:\n      - Law enforcement and criminal justice systems\n      - Emergency services and public safety\n      - Financial systems with significant impact\n      - Healthcare systems with PHI\n    data_types: \"Classified-adjacent, life-safety, critical infrastructure\"\n    authorization_path: \"JAB P-ATO required\"\n```\n\n## NIST 800-53 Control Families\n\n```yaml\ncontrol_families:\n  AC:\n    name: \"Access Control\"\n    key_controls:\n      AC-2: \"Account Management - manage system accounts lifecycle\"\n      AC-3: \"Access Enforcement - enforce approved authorizations\"\n      AC-6: \"Least Privilege - employ principle of least privilege\"\n      AC-17: \"Remote Access - establish usage restrictions for remote access\"\n    implementation_notes: \"Map to IAM policies, RBAC, MFA enforcement\"\n\n  AU:\n    name: \"Audit and Accountability\"\n    key_controls:\n      AU-2: \"Audit Events - define auditable events\"\n      AU-3: \"Content of Audit Records - ensure records contain required info\"\n      AU-6: \"Audit Review, Analysis, and Reporting\"\n      AU-12: \"Audit Generation - generate audit records\"\n    implementation_notes: \"Map to CloudTrail, CloudWatch Logs, SIEM\"\n\n  AT:\n    name: \"Awareness and Training\"\n    key_controls:\n      AT-2: \"Security Awareness Training - provide training to users\"\n      AT-3: \"Role-Based Security Training - for personnel with security roles\"\n    implementation_notes: \"Annual security training, role-specific training\"\n\n  CM:\n    name: \"Configuration Management\"\n    key_controls:\n      CM-2: \"Baseline Configuration - develop and maintain baseline\"\n      CM-6: \"Configuration Settings - establish mandatory settings\"\n      CM-7: \"Least Functionality - restrict to essential capabilities\"\n      CM-8: \"Information System Component Inventory\"\n    implementation_notes: \"Map to AWS Config, SSM, hardened AMIs\"\n\n  CP:\n    name: \"Contingency Planning\"\n    key_controls:\n      CP-2: \"Contingency Plan - develop and maintain plan\"\n      CP-4: \"Contingency Plan Testing - test plan annually\"\n      CP-9: \"Information System Backup\"\n      CP-10: \"Information System Recovery and Reconstitution\"\n    implementation_notes: \"Map to DR plan, backup strategy, failover testing\"\n\n  IA:\n    name: \"Identification and Authentication\"\n    key_controls:\n      IA-2: \"Identification and Authentication (Org Users)\"\n      IA-5: \"Authenticator Management\"\n      IA-8: \"Identification and Authentication (Non-Org Users)\"\n    implementation_notes: \"Map to SSO, MFA, certificate-based auth, PIV\u002FCAC\"\n\n  IR:\n    name: \"Incident Response\"\n    key_controls:\n      IR-2: \"Incident Response Training\"\n      IR-4: \"Incident Handling - implement incident handling capability\"\n      IR-6: \"Incident Reporting - report incidents to US-CERT\"\n      IR-8: \"Incident Response Plan\"\n    implementation_notes: \"US-CERT reporting within 1 hour for federal incidents\"\n\n  MA:\n    name: \"Maintenance\"\n    key_controls:\n      MA-2: \"Controlled Maintenance\"\n      MA-4: \"Nonlocal Maintenance - authorize nonlocal maintenance\"\n    implementation_notes: \"Patching procedures, remote maintenance controls\"\n\n  MP:\n    name: \"Media Protection\"\n    key_controls:\n      MP-2: \"Media Access - restrict access to media\"\n      MP-6: \"Media Sanitization - sanitize media prior to disposal\"\n    implementation_notes: \"Encryption at rest, secure disposal procedures\"\n\n  PE:\n    name: \"Physical and Environmental Protection\"\n    key_controls:\n      PE-2: \"Physical Access Authorizations\"\n      PE-3: \"Physical Access Control\"\n      PE-6: \"Monitoring Physical Access\"\n    implementation_notes: \"Inherit from CSP for IaaS\u002FPaaS, document inheritance\"\n\n  PL:\n    name: \"Planning\"\n    key_controls:\n      PL-2: \"System Security Plan (SSP)\"\n    implementation_notes: \"SSP is the core FedRAMP deliverable\"\n\n  PS:\n    name: \"Personnel Security\"\n    key_controls:\n      PS-3: \"Personnel Screening\"\n      PS-4: \"Personnel Termination\"\n      PS-5: \"Personnel Transfer\"\n    implementation_notes: \"Background checks, access revocation on termination\"\n\n  RA:\n    name: \"Risk Assessment\"\n    key_controls:\n      RA-3: \"Risk Assessment - conduct risk assessment\"\n      RA-5: \"Vulnerability Scanning\"\n    implementation_notes: \"Annual risk assessment, monthly vulnerability scans\"\n\n  CA:\n    name: \"Security Assessment and Authorization\"\n    key_controls:\n      CA-2: \"Security Assessments\"\n      CA-6: \"Security Authorization\"\n      CA-7: \"Continuous Monitoring\"\n    implementation_notes: \"Annual assessment by 3PAO, ConMon program\"\n\n  SC:\n    name: \"System and Communications Protection\"\n    key_controls:\n      SC-7: \"Boundary Protection\"\n      SC-8: \"Transmission Confidentiality and Integrity\"\n      SC-12: \"Cryptographic Key Establishment and Management\"\n      SC-13: \"Cryptographic Protection - FIPS 140-2 validated\"\n      SC-28: \"Protection of Information at Rest\"\n    implementation_notes: \"FIPS 140-2 validated modules required\"\n\n  SI:\n    name: \"System and Information Integrity\"\n    key_controls:\n      SI-2: \"Flaw Remediation\"\n      SI-3: \"Malicious Code Protection\"\n      SI-4: \"Information System Monitoring\"\n      SI-5: \"Security Alerts, Advisories, and Directives\"\n    implementation_notes: \"Patching SLAs, antimalware, IDS\u002FIPS, SIEM\"\n\n  SA:\n    name: \"System and Services Acquisition\"\n    key_controls:\n      SA-4: \"Acquisition Process - security requirements in contracts\"\n      SA-9: \"External Information System Services\"\n      SA-11: \"Developer Security Testing\"\n    implementation_notes: \"Supply chain risk management, SBOM\"\n\n  PM:\n    name: \"Program Management\"\n    key_controls:\n      PM-1: \"Information Security Program Plan\"\n      PM-9: \"Risk Management Strategy\"\n    implementation_notes: \"Organization-wide security program\"\n```\n\n## System Security Plan (SSP) Outline\n\n```yaml\nssp_sections:\n  section_1: \"Information System Name and Title\"\n  section_2: \"Information System Categorization (FIPS 199)\"\n  section_3: \"Information System Owner\"\n  section_4: \"Authorizing Official\"\n  section_5: \"Other Designated Contacts\"\n  section_6: \"Assignment of Security Responsibility\"\n  section_7: \"Information System Operational Status\"\n  section_8: \"Information System Type (cloud service model)\"\n  section_9: \"General System Description\"\n  section_10: \"System Environment and Special Considerations\"\n  section_11: \"System Interconnections\"\n  section_12: \"Laws, Regulations, Policies Applicable\"\n  section_13: \"Minimum Security Controls\"\n\n  key_attachments:\n    - \"Control Implementation Summary (CIS) workbook\"\n    - \"Network architecture diagrams\"\n    - \"Data flow diagrams\"\n    - \"Interconnection security agreements (ISAs)\"\n    - \"Incident response plan\"\n    - \"Contingency plan\"\n    - \"Configuration management plan\"\n```\n\n## POA&M (Plan of Action and Milestones) Tracking\n\n```yaml\n# poam_template.yaml\npoam_entry:\n  - id: \"POAM-2025-001\"\n    weakness: \"AC-2(3) - Automated account disable after 90 days inactivity not implemented\"\n    control: \"AC-2\"\n    risk_level: \"moderate\"\n    finding_source: \"3PAO Annual Assessment - 2025\"\n    date_identified: \"2025-03-15\"\n    scheduled_completion: \"2025-06-15\"\n    milestone_1:\n      description: \"Configure IdP inactivity policy\"\n      target_date: \"2025-04-15\"\n      status: \"complete\"\n    milestone_2:\n      description: \"Test automated disable in staging\"\n      target_date: \"2025-05-01\"\n      status: \"in_progress\"\n    milestone_3:\n      description: \"Deploy to production and validate\"\n      target_date: \"2025-06-15\"\n      status: \"not_started\"\n    responsible_party: \"IAM Team\"\n    status: \"open\"\n    vendor_dependency: false\n\n  - id: \"POAM-2025-002\"\n    weakness: \"RA-5 - Vulnerability scan coverage does not include container images\"\n    control: \"RA-5\"\n    risk_level: \"high\"\n    finding_source: \"3PAO Annual Assessment - 2025\"\n    date_identified: \"2025-03-15\"\n    scheduled_completion: \"2025-05-15\"\n    milestone_1:\n      description: \"Evaluate and select container scanning tool\"\n      target_date: \"2025-04-01\"\n      status: \"complete\"\n    milestone_2:\n      description: \"Integrate scanning into CI\u002FCD pipeline\"\n      target_date: \"2025-04-30\"\n      status: \"in_progress\"\n    milestone_3:\n      description: \"Demonstrate full coverage to 3PAO\"\n      target_date: \"2025-05-15\"\n      status: \"not_started\"\n    responsible_party: \"Security Engineering\"\n    status: \"open\"\n    vendor_dependency: false\n\npoam_aging_thresholds:\n  high: \"Must be resolved within 30 days\"\n  moderate: \"Must be resolved within 90 days\"\n  low: \"Must be resolved within 180 days\"\n  overdue_escalation: \"Reported to authorizing official monthly\"\n```\n\n## Continuous Monitoring (ConMon) Procedures\n\n```yaml\ncontinuous_monitoring:\n  monthly:\n    vulnerability_scanning:\n      scope: \"All operating systems, databases, web applications, and containers\"\n      tool: \"Tenable.io, Qualys, or equivalent\"\n      deliverable: \"Monthly scan report with remediation status\"\n      sla:\n        critical_cvss_9_plus: \"Remediate within 30 days\"\n        high_cvss_7_to_9: \"Remediate within 30 days\"\n        moderate_cvss_4_to_7: \"Remediate within 90 days\"\n        low_cvss_below_4: \"Remediate within 180 days\"\n\n    poam_updates:\n      action: \"Update all open POA&M items with current status\"\n      deliverable: \"Updated POA&M spreadsheet submitted to agency\"\n      content:\n        - \"Milestone completion updates\"\n        - \"New POA&M items from scans\"\n        - \"Closed POA&M items with evidence\"\n\n    inventory_updates:\n      action: \"Review and update system component inventory\"\n      deliverable: \"Updated hardware and software inventory\"\n\n  quarterly:\n    - \"Review and update SSP with any system changes\"\n    - \"Submit ConMon deliverables package to agency\"\n    - \"Review access control lists and user accounts\"\n    - \"Update network diagrams if changes occurred\"\n\n  annual:\n    security_assessment:\n      performed_by: \"3PAO\"\n      scope: \"Subset of controls (~1\u002F3 each year, full coverage in 3 years)\"\n      deliverable: \"Security Assessment Report (SAR)\"\n\n    penetration_testing:\n      performed_by: \"3PAO or qualified third party\"\n      scope: \"External and internal network, web applications\"\n      deliverable: \"Penetration test report with findings\"\n\n    contingency_plan_test:\n      scope: \"Full DR\u002FBCP test including failover\"\n      deliverable: \"Contingency plan test report\"\n\n    incident_response_test:\n      scope: \"Tabletop exercise or functional exercise\"\n      deliverable: \"IR test report with lessons learned\"\n```\n\n## FedRAMP FIPS 140-2 Cryptography Requirements\n\n```bash\n# Verify FIPS mode is enabled on Linux systems\ncat \u002Fproc\u002Fsys\u002Fcrypto\u002Ffips_enabled\n# Output should be: 1\n\n# Check OpenSSL FIPS module\nopenssl version\nopenssl list -providers  # Should show FIPS provider\n\n# AWS: Use FIPS endpoints\n# Example: Use FIPS endpoint for S3\naws s3 ls --endpoint-url https:\u002F\u002Fs3-fips.us-east-1.amazonaws.com\n\n# Configure AWS CLI for FIPS\n# ~\u002F.aws\u002Fconfig\n# [default]\n# use_fips_endpoint = true\n\n# Verify TLS configuration meets FedRAMP requirements\nopenssl s_client -connect your-service.example.com:443 -tls1_2 \u003C \u002Fdev\u002Fnull 2>\u002Fdev\u002Fnull | \\\n  grep -E \"Protocol|Cipher\"\n# Must be TLS 1.2 or higher with FIPS-approved cipher suites\n```\n\n## FedRAMP Authorization Checklist\n\n```yaml\nauthorization_checklist:\n  pre_authorization:\n    - [ ] Determine impact level (Low, Moderate, High)\n    - [ ] Choose authorization path (Agency ATO or JAB P-ATO)\n    - [ ] Engage FedRAMP PMO for readiness assessment\n    - [ ] Select 3PAO from FedRAMP marketplace\n    - [ ] Complete SSP with all control implementations documented\n    - [ ] Develop required policies and procedures\n    - [ ] Implement all applicable NIST 800-53 controls\n    - [ ] Ensure FIPS 140-2 validated cryptographic modules in use\n\n  assessment:\n    - [ ] 3PAO conducts readiness assessment (optional but recommended)\n    - [ ] 3PAO conducts full security assessment\n    - [ ] 3PAO delivers Security Assessment Report (SAR)\n    - [ ] Develop POA&M for all findings\n    - [ ] Remediate critical and high findings before authorization\n\n  authorization_package:\n    - [ ] System Security Plan (SSP)\n    - [ ] Security Assessment Report (SAR)\n    - [ ] Plan of Action and Milestones (POA&M)\n    - [ ] Continuous Monitoring Plan\n    - [ ] Incident Response Plan\n    - [ ] Contingency Plan\n    - [ ] Configuration Management Plan\n    - [ ] Control Implementation Summary (CIS)\n    - [ ] Interconnection Security Agreements\n\n  post_authorization:\n    - [ ] Establish ConMon program with monthly deliverables\n    - [ ] Monthly vulnerability scanning and POA&M updates\n    - [ ] Annual 3PAO assessment of control subset\n    - [ ] Annual penetration testing\n    - [ ] Report significant changes to authorizing official\n    - [ ] Report security incidents to US-CERT within 1 hour\n    - [ ] Maintain authorization by meeting ConMon requirements\n```\n\n## Best Practices\n\n- Start with a FedRAMP Readiness Assessment to identify gaps before the formal 3PAO assessment\n- Use the FedRAMP SSP template exactly as provided to avoid review delays\n- Inherit controls from your IaaS provider (AWS GovCloud, Azure Government) and document the inheritance clearly\n- Implement FIPS 140-2 validated cryptographic modules for all encryption (TLS, at-rest, key management)\n- Automate continuous monitoring deliverables to reduce manual effort and human error\n- Maintain POA&M items within aging thresholds; overdue items risk losing authorization\n- Report significant system changes to the authorizing official before implementation\n- Treat the SSP as a living document and update it with every change to the system boundary\n- Use US-CERT reporting procedures and maintain the 1-hour incident notification requirement\n- Engage the FedRAMP PMO early and often for guidance on the authorization process\n\n## Limitations\n\n- Guidance and checklists only; not legal advice and not a substitute for a qualified auditor.\n- Docs-only import: upstream templates and scripts not bundled.\n\n### Example\n\n```markdown\nMap this skill's control checklist to our current evidence and list gaps.\n```\n\n> Adapted from [BagelHole\u002FDevOps-Security-Agent-Skills](https:\u002F\u002Fgithub.com\u002FBagelHole\u002FDevOps-Security-Agent-Skills) (MIT); frontmatter, When to Use\u002FLimitations, and safety boundaries added for upstream compliance. Docs-only import: helper scripts and templates not bundled.\n",{"name":5,"risk":48,"source":49,"license":14,"category":50,"metadata":51,"date_added":54,"description":7,"source_repo":55,"source_type":33,"compatibility":56,"license_source":57},"safe","https:\u002F\u002Fgithub.com\u002FBagelHole\u002FDevOps-Security-Agent-Skills","security",{"author":52,"version":53},"devops-skills","1.0","2026-09-20","BagelHole\u002FDevOps-Security-Agent-Skills","Checklist and framework guidance; no privileged tooling required. Apply controls through your own change process.","https:\u002F\u002Fgithub.com\u002FBagelHole\u002FDevOps-Security-Agent-Skills\u002Fblob\u002Fmain\u002FLICENSE","f3312ba749561b6159f477dbfc9313c875d40a56",".agents\u002Fskills_archive\u002Ffedramp-compliance","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612","2026-10-25 23:50:58",{"source":8,"skillName":5,"commands":64,"prompt":74,"zipAvailable":75},[65,68,71],{"tool":66,"command":67},"npx","npx skills add duc-duy-1612\u002FOnline-Delivery-Systems-Web --skill fedramp-compliance",{"tool":69,"command":70},"bunx","bunx skills add duc-duy-1612\u002FOnline-Delivery-Systems-Web --skill fedramp-compliance",{"tool":72,"command":73},"pnpm","pnpm dlx skills add duc-duy-1612\u002FOnline-Delivery-Systems-Web --skill fedramp-compliance","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Ffedramp-compliance\u002FSKILL.md",true,[],[78,105,129,151,177,201],{"skillNo":79,"name":80,"nameZh":6,"description":81,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":82,"categories":83,"keywords":89,"publishedAt":43},"01M6Q0FA5FZ410Z33Z3TFQ4DBA","zero-trust","Implement zero-trust network architecture. Configure identity-based access, micro-segmentation, and continuous verification. Use when implementing modern security architectures.","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fzero-trust\u002FSKILL.md",[84],{"categoryNo":85,"categoryName":86,"taxonomyType":87,"taxonomyTypeDesc":88},"01JBSEEDCAT000000000000011","运维与部署","SCENARIO","使用场景",[90,91,92,93,94,95,80,96,37,97,36,98,33,32,99,100,101,102,103,104],"ZeRO","trust","zero trust","architecture","assessment","verification","segmentation","access","only","active","critical","scope","scripts","relevant","implementing",{"skillNo":106,"name":107,"nameZh":6,"description":108,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":109,"categories":110,"keywords":111,"publishedAt":43},"01M6Q0F1YZJW3KX5FBKEVZ8CV4","zcode-delegate","Delegate coding tasks to the Z.AI ZCode CLI only when the user explicitly requests it, while the orchestrator retains review and landing responsibility.","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fzcode-delegate\u002FSKILL.md",[],[112,113,114,115,116,117,118,119,120,121,122,123,124,98,125,33,126,127,100,128],"delegate","zcode","zcode delegate","review","cli","orchestration","tasks","run","Bash","model","node","read","orchestrator","files","desktop app","app","agent-orchestration",{"skillNo":130,"name":131,"nameZh":6,"description":132,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":133,"categories":134,"keywords":135,"publishedAt":43},"01M6Q0ETK41VGNMYEXW0T00AJN","youtube-transcript","Fetch YouTube transcripts through DeepAPI or local fallback tooling and save clean text output.","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fyoutube-transcript\u002FSKILL.md",[],[136,137,138,48,35,139,140,40,141,142,143,144,145,33,32,146,147,148,149,150],"transcript","youtube transcript","youtube","codex","research","https","text","fetch","tooling","clean","local","output","deepapi","youtube transcripts","blob",{"skillNo":152,"name":153,"nameZh":6,"description":154,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":155,"categories":156,"keywords":166,"publishedAt":43},"01M6Q0EPPH2PVMDW40017F8WX0","youtube-transcript-skills","Fetch YouTube video transcripts, search videos\u002Fchannels, browse channels, and extract playlists via the getyoutubetranscript.com API - free tier, no card required.","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fyoutube-transcript-skills\u002FSKILL.md",[157,160,163],{"categoryNo":158,"categoryName":159,"taxonomyType":87,"taxonomyTypeDesc":88},"01JBSEEDCAT000000000000010","后端与接口",{"categoryNo":161,"categoryName":162,"taxonomyType":87,"taxonomyTypeDesc":88},"01JBSEEDCAT000000000000016","图像与多媒体",{"categoryNo":164,"categoryName":165,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000030","开发工程师",[136,137,138,167,48,168,35,139,40,169,170,171,172,143,173,33,32,174,175,176],"youtube transcript skills","gemini","search","api","Video","browse","api-integration","free","card","channels",{"skillNo":178,"name":179,"nameZh":6,"description":180,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":181,"categories":182,"keywords":187,"publishedAt":43},"01M6Q0EAB96PX83W5PTE8A0R8D","youtube-notetaker","Turn YouTube talks into local study notes with slides, transcripts, editable annotations, and a markdown-backed viewer.","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fyoutube-notetaker\u002FSKILL.md",[183,186],{"categoryNo":184,"categoryName":185,"taxonomyType":87,"taxonomyTypeDesc":88},"01JBSEEDCAT000000000000003","演示文稿",{"categoryNo":161,"categoryName":162,"taxonomyType":87,"taxonomyTypeDesc":88},[138,188,189,116,48,190,191,192,193,40,171,194,195,196,197,32,198,146,199,200],"youtube notetaker","notetaker","workflow","official","notes","code","markdown","slides","annotations","README","study","dair-academy","viewer",{"skillNo":202,"name":203,"nameZh":6,"description":204,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":205,"categories":206,"keywords":208,"publishedAt":43},"01M6Q0E55F0GW5MX48V8HXS8B5","youtube-full","Fetch YouTube transcripts, search videos, browse channels, and extract playlists via TranscriptAPI — no yt-dlp, no Google API key, works from any cloud server.","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fyoutube-full\u002FSKILL.md",[207],{"categoryNo":158,"categoryName":159,"taxonomyType":87,"taxonomyTypeDesc":88},[209,138,210,211,48,168,169,212,213,170,171,172,143,214,173,33,32,174,215,149],"youtube full","full","google","server","dlp","credits","automatic"]