# CRO-036 — GAISSF–FedRAMP Mapping

**Version:** 1.0  
**Status:** Publication Candidate  
**Publisher:** ODA3 Institute  
**Verified:** 29 June 2026

## Executive Summary

This crosswalk maps the 59 GAISSF v1.0 controls to the 20 NIST SP 800-53 Revision 5 control families used by the FedRAMP Rev5 security-control model. It is intended for cloud-security planning, evidence rationalization and preliminary gap analysis.

The mapping is deliberately family-level. It does not establish implementation of individual FedRAMP controls or enhancements, satisfaction of FedRAMP-defined parameters, completion of assessment objectives, FedRAMP Certification, Marketplace listing, or an agency Authorization to Operate.

## Source Baseline

- GAISSF-NOR-001 and GAISSF-NOR-004, version 1.0.
- FedRAMP Consolidated Rules for 2026, officially launched 24 June 2026.
- NIST SP 800-53 Revision 5 control families for the FedRAMP Rev5/Class D path.
- FedRAMP 20x Classes A–C are treated as a separate current pathway; Class D 20x remains planned.
- OMB Memorandum M-24-15 and the FedRAMP Authorization Act define authority and authorization responsibilities.

## Mapping Method

Each GAISSF control was mapped to one or more FedRAMP/NIST control families by comparing intended security outcome, system lifecycle relevance, evidence expectations and cloud shared-responsibility implications. Relationship strength and confidence are recorded independently.

## Coverage Summary

- GAISSF controls assessed: **59**
- FedRAMP/NIST control families assessed: **20**
- Forward mapping records: **258**

| Family | Title | GAISSF controls | Coverage |
|---|---|---:|---|
| AC | Access Control | 14 | Substantially Addressed |
| AT | Awareness and Training | 5 | Substantially Addressed |
| AU | Audit and Accountability | 9 | Substantially Addressed |
| CA | Assessment, Authorization and Monitoring | 13 | Substantially Addressed |
| CM | Configuration Management | 9 | Substantially Addressed |
| CP | Contingency Planning | 9 | Substantially Addressed |
| IA | Identification and Authentication | 12 | Substantially Addressed |
| IR | Incident Response | 15 | Substantially Addressed |
| MA | Maintenance | 0 | Not Addressed |
| MP | Media Protection | 3 | Partially Addressed |
| PE | Physical and Environmental Protection | 7 | Substantially Addressed |
| PL | Planning | 12 | Substantially Addressed |
| PM | Program Management | 12 | Substantially Addressed |
| PS | Personnel Security | 0 | Not Addressed |
| PT | Personally Identifiable Information Processing and Transparency | 6 | Substantially Addressed |
| RA | Risk Assessment | 27 | Substantially Addressed |
| SA | System and Services Acquisition | 25 | Substantially Addressed |
| SC | System and Communications Protection | 20 | Substantially Addressed |
| SI | System and Information Integrity | 43 | Substantially Addressed |
| SR | Supply Chain Risk Management | 17 | Substantially Addressed |

## Detailed Mapping Register

| GAISSF Control | Title | FedRAMP Family | Relationship | Confidence |
|---|---|---|---|---|
| D1-CTL-01 | Dataset Provenance & Poisoning Prevention | RA — Risk Assessment | P | Medium |
| D1-CTL-01 | Dataset Provenance & Poisoning Prevention | SI — System and Information Integrity | P | Medium |
| D1-CTL-01 | Dataset Provenance & Poisoning Prevention | SA — System and Services Acquisition | P | Medium |
| D1-CTL-01 | Dataset Provenance & Poisoning Prevention | SR — Supply Chain Risk Management | S | Medium |
| D1-CTL-02 | Model Extraction Resistance | RA — Risk Assessment | P | Medium |
| D1-CTL-02 | Model Extraction Resistance | SI — System and Information Integrity | P | Medium |
| D1-CTL-02 | Model Extraction Resistance | SA — System and Services Acquisition | P | Medium |
| D1-CTL-02 | Model Extraction Resistance | SR — Supply Chain Risk Management | S | Medium |
| D1-CTL-03 | Behavioral Drift Detection | RA — Risk Assessment | P | Medium |
| D1-CTL-03 | Behavioral Drift Detection | SI — System and Information Integrity | SP | Medium-High |
| D1-CTL-03 | Behavioral Drift Detection | SA — System and Services Acquisition | P | Medium |
| D1-CTL-03 | Behavioral Drift Detection | SR — Supply Chain Risk Management | S | Medium |
| D1-CTL-04 | Federated Learning Poisoning Prevention | RA — Risk Assessment | P | Medium |
| D1-CTL-04 | Federated Learning Poisoning Prevention | SI — System and Information Integrity | P | Medium |
| D1-CTL-04 | Federated Learning Poisoning Prevention | SA — System and Services Acquisition | P | Medium |
| D1-CTL-04 | Federated Learning Poisoning Prevention | SR — Supply Chain Risk Management | S | Medium |
| D1-CTL-05 | Embedding Space Robustness | RA — Risk Assessment | P | Medium |
| D1-CTL-05 | Embedding Space Robustness | SI — System and Information Integrity | P | Medium |
| D1-CTL-05 | Embedding Space Robustness | SA — System and Services Acquisition | P | Medium |
| D1-CTL-05 | Embedding Space Robustness | SR — Supply Chain Risk Management | S | Medium |
| D1-CTL-06 | Post-Quantum Model Signing & Crypto Hardening | RA — Risk Assessment | P | Medium |
| D1-CTL-06 | Post-Quantum Model Signing & Crypto Hardening | SI — System and Information Integrity | P | Medium |
| D1-CTL-06 | Post-Quantum Model Signing & Crypto Hardening | SA — System and Services Acquisition | P | Medium |
| D1-CTL-06 | Post-Quantum Model Signing & Crypto Hardening | SR — Supply Chain Risk Management | S | Medium |
| D1-CTL-06 | Post-Quantum Model Signing & Crypto Hardening | SC — System and Communications Protection | SP | Medium-High |
| D1-CTL-07 | Lora/Adapter Integrity Verification | RA — Risk Assessment | P | Medium |
| D1-CTL-07 | Lora/Adapter Integrity Verification | SI — System and Information Integrity | SP | Medium-High |
| D1-CTL-07 | Lora/Adapter Integrity Verification | SA — System and Services Acquisition | P | Medium |
| D1-CTL-07 | Lora/Adapter Integrity Verification | SR — Supply Chain Risk Management | S | Medium |
| D1-CTL-08 | Model Merge Attack Detection | RA — Risk Assessment | P | Medium |
| D1-CTL-08 | Model Merge Attack Detection | SI — System and Information Integrity | SP | Medium-High |
| D1-CTL-08 | Model Merge Attack Detection | SA — System and Services Acquisition | P | Medium |
| D1-CTL-08 | Model Merge Attack Detection | SR — Supply Chain Risk Management | S | Medium |
| D1-CTL-09 | Quantization Backdoor Screening | RA — Risk Assessment | P | Medium |
| D1-CTL-09 | Quantization Backdoor Screening | SI — System and Information Integrity | SP | Medium-High |
| D1-CTL-09 | Quantization Backdoor Screening | SA — System and Services Acquisition | P | Medium |
| D1-CTL-09 | Quantization Backdoor Screening | SR — Supply Chain Risk Management | S | Medium |
| D2-CTL-01 | Direct Prompt Injection Prevention | AC — Access Control | SP | Medium-High |
| D2-CTL-01 | Direct Prompt Injection Prevention | SC — System and Communications Protection | P | Medium |
| D2-CTL-01 | Direct Prompt Injection Prevention | SI — System and Information Integrity | P | Medium |
| D2-CTL-01 | Direct Prompt Injection Prevention | RA — Risk Assessment | S | Medium |
| D2-CTL-02 | Indirect Prompt Injection Prevention | AC — Access Control | SP | Medium-High |
| D2-CTL-02 | Indirect Prompt Injection Prevention | SC — System and Communications Protection | P | Medium |
| D2-CTL-02 | Indirect Prompt Injection Prevention | SI — System and Information Integrity | P | Medium |
| D2-CTL-02 | Indirect Prompt Injection Prevention | RA — Risk Assessment | S | Medium |
| D2-CTL-03 | Jailbreak Resistance Testing | AC — Access Control | P | Medium |
| D2-CTL-03 | Jailbreak Resistance Testing | SC — System and Communications Protection | P | Medium |
| D2-CTL-03 | Jailbreak Resistance Testing | SI — System and Information Integrity | P | Medium |
| D2-CTL-03 | Jailbreak Resistance Testing | RA — Risk Assessment | S | Medium |
| D2-CTL-04 | Multi-Modal Injection Defense | AC — Access Control | P | Medium |
| D2-CTL-04 | Multi-Modal Injection Defense | SC — System and Communications Protection | P | Medium |
| D2-CTL-04 | Multi-Modal Injection Defense | SI — System and Information Integrity | P | Medium |
| D2-CTL-04 | Multi-Modal Injection Defense | RA — Risk Assessment | S | Medium |
| D2-CTL-05 | Function Call/Tool Call Injection Prevention | AC — Access Control | SP | Medium-High |
| D2-CTL-05 | Function Call/Tool Call Injection Prevention | SC — System and Communications Protection | P | Medium |
| D2-CTL-05 | Function Call/Tool Call Injection Prevention | SI — System and Information Integrity | P | Medium |
| D2-CTL-05 | Function Call/Tool Call Injection Prevention | RA — Risk Assessment | S | Medium |
| D2-CTL-06 | Cross-Context Hijacking Mitigation | AC — Access Control | P | Medium |
| D2-CTL-06 | Cross-Context Hijacking Mitigation | SC — System and Communications Protection | P | Medium |
| D2-CTL-06 | Cross-Context Hijacking Mitigation | SI — System and Information Integrity | P | Medium |
| D2-CTL-06 | Cross-Context Hijacking Mitigation | RA — Risk Assessment | S | Medium |
| D3-CTL-01 | Least Agency Enforcement | AC — Access Control | SP | Medium-High |
| D3-CTL-01 | Least Agency Enforcement | IA — Identification and Authentication | P | Medium |
| D3-CTL-01 | Least Agency Enforcement | SC — System and Communications Protection | P | Medium |
| D3-CTL-01 | Least Agency Enforcement | SI — System and Information Integrity | S | Medium |
| D3-CTL-01 | Least Agency Enforcement | SA — System and Services Acquisition | S | Medium |
| D3-CTL-02 | Inter-Agent Communication Security | AC — Access Control | P | Medium |
| D3-CTL-02 | Inter-Agent Communication Security | IA — Identification and Authentication | P | Medium |
| D3-CTL-02 | Inter-Agent Communication Security | SC — System and Communications Protection | SP | Medium-High |
| D3-CTL-02 | Inter-Agent Communication Security | SI — System and Information Integrity | S | Medium |
| D3-CTL-02 | Inter-Agent Communication Security | SA — System and Services Acquisition | S | Medium |
| D3-CTL-03 | Agentic Prompt Chaining Detection | AC — Access Control | SP | Medium-High |
| D3-CTL-03 | Agentic Prompt Chaining Detection | IA — Identification and Authentication | P | Medium |
| D3-CTL-03 | Agentic Prompt Chaining Detection | SC — System and Communications Protection | P | Medium |
| D3-CTL-03 | Agentic Prompt Chaining Detection | SI — System and Information Integrity | SP | Medium-High |
| D3-CTL-03 | Agentic Prompt Chaining Detection | SA — System and Services Acquisition | S | Medium |
| D3-CTL-03 | Agentic Prompt Chaining Detection | RA — Risk Assessment | S | Medium |
| D3-CTL-04 | Embodied Ai Safety Controls | AC — Access Control | P | Medium |
| D3-CTL-04 | Embodied Ai Safety Controls | IA — Identification and Authentication | P | Medium |
| D3-CTL-04 | Embodied Ai Safety Controls | SC — System and Communications Protection | P | Medium |
| D3-CTL-04 | Embodied Ai Safety Controls | SI — System and Information Integrity | S | Medium |
| D3-CTL-04 | Embodied Ai Safety Controls | SA — System and Services Acquisition | S | Medium |
| D3-CTL-05 | Multi-Agent Trust Chain Attestation | AC — Access Control | P | Medium |
| D3-CTL-05 | Multi-Agent Trust Chain Attestation | IA — Identification and Authentication | SP | Medium-High |
| D3-CTL-05 | Multi-Agent Trust Chain Attestation | SC — System and Communications Protection | P | Medium |
| D3-CTL-05 | Multi-Agent Trust Chain Attestation | SI — System and Information Integrity | S | Medium |
| D3-CTL-05 | Multi-Agent Trust Chain Attestation | SA — System and Services Acquisition | S | Medium |
| D3-CTL-06 | Persistent Memory Exfiltration Prevention | AC — Access Control | P | Medium |
| D3-CTL-06 | Persistent Memory Exfiltration Prevention | IA — Identification and Authentication | P | Medium |
| D3-CTL-06 | Persistent Memory Exfiltration Prevention | SC — System and Communications Protection | SP | Medium-High |
| D3-CTL-06 | Persistent Memory Exfiltration Prevention | SI — System and Information Integrity | S | Medium |
| D3-CTL-06 | Persistent Memory Exfiltration Prevention | SA — System and Services Acquisition | S | Medium |
| D3-CTL-06 | Persistent Memory Exfiltration Prevention | MP — Media Protection | S | Medium |
| D3-CTL-07 | Secure Memory Lifecycle Management | AC — Access Control | P | Medium |
| D3-CTL-07 | Secure Memory Lifecycle Management | IA — Identification and Authentication | P | Medium |
| D3-CTL-07 | Secure Memory Lifecycle Management | SC — System and Communications Protection | P | Medium |
| D3-CTL-07 | Secure Memory Lifecycle Management | SI — System and Information Integrity | S | Medium |
| D3-CTL-07 | Secure Memory Lifecycle Management | SA — System and Services Acquisition | S | Medium |
| D3-CTL-07 | Secure Memory Lifecycle Management | MP — Media Protection | S | Medium |
| D4-CTL-01 | Ai Bill Of Materials (Ai Bom) Maintenance | SR — Supply Chain Risk Management | SP | Medium-High |
| D4-CTL-01 | Ai Bill Of Materials (Ai Bom) Maintenance | SA — System and Services Acquisition | P | Medium |
| D4-CTL-01 | Ai Bill Of Materials (Ai Bom) Maintenance | RA — Risk Assessment | P | Medium |
| D4-CTL-01 | Ai Bill Of Materials (Ai Bom) Maintenance | CM — Configuration Management | S | Medium |
| D4-CTL-02 | Model File & Artifact Scanning | SR — Supply Chain Risk Management | SP | Medium-High |
| D4-CTL-02 | Model File & Artifact Scanning | SA — System and Services Acquisition | P | Medium |
| D4-CTL-02 | Model File & Artifact Scanning | RA — Risk Assessment | P | Medium |
| D4-CTL-02 | Model File & Artifact Scanning | CM — Configuration Management | S | Medium |
| D4-CTL-02 | Model File & Artifact Scanning | SI — System and Information Integrity | SP | Medium-High |
| D4-CTL-03 | Model Hub & Registry Vetting | SR — Supply Chain Risk Management | SP | Medium-High |
| D4-CTL-03 | Model Hub & Registry Vetting | SA — System and Services Acquisition | P | Medium |
| D4-CTL-03 | Model Hub & Registry Vetting | RA — Risk Assessment | P | Medium |
| D4-CTL-03 | Model Hub & Registry Vetting | CM — Configuration Management | S | Medium |
| D4-CTL-04 | Mcp Server Behavioral Monitoring | SR — Supply Chain Risk Management | P | Medium |
| D4-CTL-04 | Mcp Server Behavioral Monitoring | SA — System and Services Acquisition | P | Medium |
| D4-CTL-04 | Mcp Server Behavioral Monitoring | RA — Risk Assessment | P | Medium |
| D4-CTL-04 | Mcp Server Behavioral Monitoring | CM — Configuration Management | S | Medium |
| D4-CTL-04 | Mcp Server Behavioral Monitoring | SI — System and Information Integrity | SP | Medium-High |
| D4-CTL-05 | Third-Party Ai Api Security Assessment | SR — Supply Chain Risk Management | P | Medium |
| D4-CTL-05 | Third-Party Ai Api Security Assessment | SA — System and Services Acquisition | P | Medium |
| D4-CTL-05 | Third-Party Ai Api Security Assessment | RA — Risk Assessment | P | Medium |
| D4-CTL-05 | Third-Party Ai Api Security Assessment | CM — Configuration Management | S | Medium |
| D4-CTL-06 | Shadow Ai Discovery & Governance | SR — Supply Chain Risk Management | P | Medium |
| D4-CTL-06 | Shadow Ai Discovery & Governance | SA — System and Services Acquisition | P | Medium |
| D4-CTL-06 | Shadow Ai Discovery & Governance | RA — Risk Assessment | P | Medium |
| D4-CTL-06 | Shadow Ai Discovery & Governance | CM — Configuration Management | S | Medium |
| D4-CTL-07 | Ai Software Composition Analysis (Sca) | SR — Supply Chain Risk Management | SP | Medium-High |
| D4-CTL-07 | Ai Software Composition Analysis (Sca) | SA — System and Services Acquisition | P | Medium |
| D4-CTL-07 | Ai Software Composition Analysis (Sca) | RA — Risk Assessment | P | Medium |
| D4-CTL-07 | Ai Software Composition Analysis (Sca) | CM — Configuration Management | S | Medium |
| D5-CTL-01 | Harmful Content Blocking | SI — System and Information Integrity | P | Medium |
| D5-CTL-01 | Harmful Content Blocking | PT — Personally Identifiable Information Processing and Transparency | P | Medium |
| D5-CTL-01 | Harmful Content Blocking | SC — System and Communications Protection | P | Medium |
| D5-CTL-02 | Pii Leakage Prevention | SI — System and Information Integrity | P | Medium |
| D5-CTL-02 | Pii Leakage Prevention | PT — Personally Identifiable Information Processing and Transparency | SP | Medium-High |
| D5-CTL-02 | Pii Leakage Prevention | SC — System and Communications Protection | P | Medium |
| D5-CTL-03 | Copyright Detection | SI — System and Information Integrity | SP | Medium-High |
| D5-CTL-03 | Copyright Detection | PT — Personally Identifiable Information Processing and Transparency | P | Medium |
| D5-CTL-03 | Copyright Detection | SC — System and Communications Protection | P | Medium |
| D5-CTL-03 | Copyright Detection | RA — Risk Assessment | S | Medium |
| D5-CTL-04 | Ai Watermarking Robustness | SI — System and Information Integrity | P | Medium |
| D5-CTL-04 | Ai Watermarking Robustness | PT — Personally Identifiable Information Processing and Transparency | P | Medium |
| D5-CTL-04 | Ai Watermarking Robustness | SC — System and Communications Protection | P | Medium |
| D5-CTL-05 | Privacy-By-Design Verification | SI — System and Information Integrity | P | Medium |
| D5-CTL-05 | Privacy-By-Design Verification | PT — Personally Identifiable Information Processing and Transparency | SP | Medium-High |
| D5-CTL-05 | Privacy-By-Design Verification | SC — System and Communications Protection | P | Medium |
| D5-CTL-06 | Privacy-Preserving Ml Validation | SI — System and Information Integrity | P | Medium |
| D5-CTL-06 | Privacy-Preserving Ml Validation | PT — Personally Identifiable Information Processing and Transparency | SP | Medium-High |
| D5-CTL-06 | Privacy-Preserving Ml Validation | SC — System and Communications Protection | P | Medium |
| D6-CTL-01 | Human-In-The-Loop For High-Risk Actions | PM — Program Management | P | Medium |
| D6-CTL-01 | Human-In-The-Loop For High-Risk Actions | PL — Planning | P | Medium |
| D6-CTL-01 | Human-In-The-Loop For High-Risk Actions | CA — Assessment, Authorization and Monitoring | P | Medium |
| D6-CTL-01 | Human-In-The-Loop For High-Risk Actions | AU — Audit and Accountability | S | Medium |
| D6-CTL-02 | Audit Trail Completeness | PM — Program Management | P | Medium |
| D6-CTL-02 | Audit Trail Completeness | PL — Planning | P | Medium |
| D6-CTL-02 | Audit Trail Completeness | CA — Assessment, Authorization and Monitoring | P | Medium |
| D6-CTL-02 | Audit Trail Completeness | AU — Audit and Accountability | SP | Medium-High |
| D6-CTL-03 | Ai Model Card Completeness | PM — Program Management | P | Medium |
| D6-CTL-03 | Ai Model Card Completeness | PL — Planning | SP | Medium-High |
| D6-CTL-03 | Ai Model Card Completeness | CA — Assessment, Authorization and Monitoring | P | Medium |
| D6-CTL-03 | Ai Model Card Completeness | AU — Audit and Accountability | S | Medium |
| D6-CTL-04 | Ai Incident Response Readiness | PM — Program Management | P | Medium |
| D6-CTL-04 | Ai Incident Response Readiness | PL — Planning | P | Medium |
| D6-CTL-04 | Ai Incident Response Readiness | CA — Assessment, Authorization and Monitoring | P | Medium |
| D6-CTL-04 | Ai Incident Response Readiness | AU — Audit and Accountability | S | Medium |
| D6-CTL-04 | Ai Incident Response Readiness | IR — Incident Response | SP | Medium-High |
| D6-CTL-05 | Model Deprecation & Decommissioning | PM — Program Management | P | Medium |
| D6-CTL-05 | Model Deprecation & Decommissioning | PL — Planning | P | Medium |
| D6-CTL-05 | Model Deprecation & Decommissioning | CA — Assessment, Authorization and Monitoring | P | Medium |
| D6-CTL-05 | Model Deprecation & Decommissioning | AU — Audit and Accountability | S | Medium |
| D6-CTL-05 | Model Deprecation & Decommissioning | CM — Configuration Management | S | Medium |
| D6-CTL-05 | Model Deprecation & Decommissioning | MP — Media Protection | S | Medium |
| D6-CTL-06 | Third-Party Ai Vendor Governance | PM — Program Management | P | Medium |
| D6-CTL-06 | Third-Party Ai Vendor Governance | PL — Planning | P | Medium |
| D6-CTL-06 | Third-Party Ai Vendor Governance | CA — Assessment, Authorization and Monitoring | P | Medium |
| D6-CTL-06 | Third-Party Ai Vendor Governance | AU — Audit and Accountability | S | Medium |
| D6-CTL-06 | Third-Party Ai Vendor Governance | SR — Supply Chain Risk Management | SP | Medium-High |
| D6-CTL-06 | Third-Party Ai Vendor Governance | SA — System and Services Acquisition | S | Medium |
| D6-CTL-07 | Ai Resilience & Business Continuity | PM — Program Management | P | Medium |
| D6-CTL-07 | Ai Resilience & Business Continuity | PL — Planning | P | Medium |
| D6-CTL-07 | Ai Resilience & Business Continuity | CA — Assessment, Authorization and Monitoring | P | Medium |
| D6-CTL-07 | Ai Resilience & Business Continuity | AU — Audit and Accountability | S | Medium |
| D6-CTL-07 | Ai Resilience & Business Continuity | CP — Contingency Planning | SP | Medium-High |
| D6-CTL-07 | Ai Resilience & Business Continuity | IR — Incident Response | S | Medium |
| D7-CTL-H01 | Ai-Generated Phishing Simulation | AT — Awareness and Training | SP | Medium-High |
| D7-CTL-H01 | Ai-Generated Phishing Simulation | IR — Incident Response | P | Medium |
| D7-CTL-H01 | Ai-Generated Phishing Simulation | IA — Identification and Authentication | P | Medium |
| D7-CTL-H01 | Ai-Generated Phishing Simulation | SI — System and Information Integrity | S | Medium |
| D7-CTL-H02 | Deepfake Detection Training | AT — Awareness and Training | SP | Medium-High |
| D7-CTL-H02 | Deepfake Detection Training | IR — Incident Response | P | Medium |
| D7-CTL-H02 | Deepfake Detection Training | IA — Identification and Authentication | P | Medium |
| D7-CTL-H02 | Deepfake Detection Training | SI — System and Information Integrity | SP | Medium-High |
| D7-CTL-H02 | Deepfake Detection Training | RA — Risk Assessment | S | Medium |
| D7-CTL-H03 | Out-Of-Band Authentication | AT — Awareness and Training | P | Medium |
| D7-CTL-H03 | Out-Of-Band Authentication | IR — Incident Response | P | Medium |
| D7-CTL-H03 | Out-Of-Band Authentication | IA — Identification and Authentication | SP | Medium-High |
| D7-CTL-H03 | Out-Of-Band Authentication | SI — System and Information Integrity | S | Medium |
| D7-CTL-H03 | Out-Of-Band Authentication | AC — Access Control | S | Medium |
| D7-CTL-H04 | Ai Social Engineering Ir | AT — Awareness and Training | P | Medium |
| D7-CTL-H04 | Ai Social Engineering Ir | IR — Incident Response | SP | Medium-High |
| D7-CTL-H04 | Ai Social Engineering Ir | IA — Identification and Authentication | P | Medium |
| D7-CTL-H04 | Ai Social Engineering Ir | SI — System and Information Integrity | S | Medium |
| D7-CTL-H05 | Ai-Enhanced External Attack Defense | AT — Awareness and Training | P | Medium |
| D7-CTL-H05 | Ai-Enhanced External Attack Defense | IR — Incident Response | P | Medium |
| D7-CTL-H05 | Ai-Enhanced External Attack Defense | IA — Identification and Authentication | P | Medium |
| D7-CTL-H05 | Ai-Enhanced External Attack Defense | SI — System and Information Integrity | S | Medium |
| D8-CTL-01 | Eu Ai Act Risk Tier Mapping | PM — Program Management | P | Medium |
| D8-CTL-01 | Eu Ai Act Risk Tier Mapping | PL — Planning | P | Medium |
| D8-CTL-01 | Eu Ai Act Risk Tier Mapping | CA — Assessment, Authorization and Monitoring | P | Medium |
| D8-CTL-02 | Iso 42001 Gap Analysis | PM — Program Management | P | Medium |
| D8-CTL-02 | Iso 42001 Gap Analysis | PL — Planning | SP | Medium-High |
| D8-CTL-02 | Iso 42001 Gap Analysis | CA — Assessment, Authorization and Monitoring | P | Medium |
| D8-CTL-03 | Gpai Technical Documentation Verification | PM — Program Management | P | Medium |
| D8-CTL-03 | Gpai Technical Documentation Verification | PL — Planning | SP | Medium-High |
| D8-CTL-03 | Gpai Technical Documentation Verification | CA — Assessment, Authorization and Monitoring | SP | Medium-High |
| D8-CTL-04 | Dora Ict Incident Reporting (Financial Sector) | PM — Program Management | P | Medium |
| D8-CTL-04 | Dora Ict Incident Reporting (Financial Sector) | PL — Planning | P | Medium |
| D8-CTL-04 | Dora Ict Incident Reporting (Financial Sector) | CA — Assessment, Authorization and Monitoring | P | Medium |
| D8-CTL-04 | Dora Ict Incident Reporting (Financial Sector) | IR — Incident Response | SP | Medium-High |
| D8-CTL-04 | Dora Ict Incident Reporting (Financial Sector) | AU — Audit and Accountability | S | Medium |
| D8-CTL-04 | Dora Ict Incident Reporting (Financial Sector) | CP — Contingency Planning | S | Medium |
| D8-CTL-05 | Nist Sp 800-218A Compliance Check | PM — Program Management | P | Medium |
| D8-CTL-05 | Nist Sp 800-218A Compliance Check | PL — Planning | P | Medium |
| D8-CTL-05 | Nist Sp 800-218A Compliance Check | CA — Assessment, Authorization and Monitoring | SP | Medium-High |
| D8-CTL-05 | Nist Sp 800-218A Compliance Check | SA — System and Services Acquisition | S | Medium |
| D8-CTL-05 | Nist Sp 800-218A Compliance Check | CM — Configuration Management | S | Medium |
| D8-CTL-05 | Nist Sp 800-218A Compliance Check | SI — System and Information Integrity | S | Medium |
| D9-CTL-01 | Physical Harm Boundary Enforcement | PE — Physical and Environmental Protection | SP | Medium-High |
| D9-CTL-01 | Physical Harm Boundary Enforcement | CP — Contingency Planning | P | Medium |
| D9-CTL-01 | Physical Harm Boundary Enforcement | IR — Incident Response | P | Medium |
| D9-CTL-01 | Physical Harm Boundary Enforcement | SI — System and Information Integrity | S | Medium |
| D9-CTL-02 | Safe State And Graceful Degradation | PE — Physical and Environmental Protection | P | Medium |
| D9-CTL-02 | Safe State And Graceful Degradation | CP — Contingency Planning | SP | Medium-High |
| D9-CTL-02 | Safe State And Graceful Degradation | IR — Incident Response | P | Medium |
| D9-CTL-02 | Safe State And Graceful Degradation | SI — System and Information Integrity | S | Medium |
| D9-CTL-03 | Human Override And Emergency Stop | PE — Physical and Environmental Protection | SP | Medium-High |
| D9-CTL-03 | Human Override And Emergency Stop | CP — Contingency Planning | P | Medium |
| D9-CTL-03 | Human Override And Emergency Stop | IR — Incident Response | P | Medium |
| D9-CTL-03 | Human Override And Emergency Stop | SI — System and Information Integrity | S | Medium |
| D9-CTL-04 | Cyber-Physical Attack Detection | PE — Physical and Environmental Protection | SP | Medium-High |
| D9-CTL-04 | Cyber-Physical Attack Detection | CP — Contingency Planning | P | Medium |
| D9-CTL-04 | Cyber-Physical Attack Detection | IR — Incident Response | P | Medium |
| D9-CTL-04 | Cyber-Physical Attack Detection | SI — System and Information Integrity | SP | Medium-High |
| D9-CTL-04 | Cyber-Physical Attack Detection | RA — Risk Assessment | S | Medium |
| D9-CTL-05 | Physical Environment Integrity Monitoring | PE — Physical and Environmental Protection | SP | Medium-High |
| D9-CTL-05 | Physical Environment Integrity Monitoring | CP — Contingency Planning | P | Medium |
| D9-CTL-05 | Physical Environment Integrity Monitoring | IR — Incident Response | P | Medium |
| D9-CTL-05 | Physical Environment Integrity Monitoring | SI — System and Information Integrity | SP | Medium-High |
| D9-CTL-05 | Physical Environment Integrity Monitoring | RA — Risk Assessment | S | Medium |
| D9-CTL-06 | Actuator Command Verification | PE — Physical and Environmental Protection | SP | Medium-High |
| D9-CTL-06 | Actuator Command Verification | CP — Contingency Planning | P | Medium |
| D9-CTL-06 | Actuator Command Verification | IR — Incident Response | P | Medium |
| D9-CTL-06 | Actuator Command Verification | SI — System and Information Integrity | S | Medium |
| D9-CTL-07 | Physical Incident Evidence Preservation | PE — Physical and Environmental Protection | SP | Medium-High |
| D9-CTL-07 | Physical Incident Evidence Preservation | CP — Contingency Planning | P | Medium |
| D9-CTL-07 | Physical Incident Evidence Preservation | IR — Incident Response | P | Medium |
| D9-CTL-07 | Physical Incident Evidence Preservation | SI — System and Information Integrity | S | Medium |
| D9-CTL-07 | Physical Incident Evidence Preservation | AU — Audit and Accountability | S | Medium |
| D9-CTL-07 | Physical Incident Evidence Preservation | CA — Assessment, Authorization and Monitoring | S | Medium |

## Implementation Use

Organizations may use this crosswalk to identify candidate evidence reuse, assign control-family ownership, plan cloud-boundary analysis and prioritize detailed FedRAMP gap assessment. The authoritative FedRAMP rules, applicable certification class, agency use case and official assessment materials remain controlling.

## Notably Absent
- No FedRAMP Certification, authorization or agency ATO is created by this mapping.
- No individual FedRAMP control is deemed implemented solely because a GAISSF control maps to its family.
- No FedRAMP-recognized independent assessment has been performed.
- No cloud-service boundary, data-impact class, inherited-control model or agency use case is established.
- No SSP, SAP, SAR, POA&M, Security Decision Record or continuous-monitoring package is completed.
- No endorsement, acceptance or recognition by GSA, FedRAMP, OMB, NIST or any federal agency is implied.

## Sources

- https://www.fedramp.gov/2026/
- https://www.fedramp.gov/20x/
- https://www.fedramp.gov/docs/authority/
- https://www.fedramp.gov/docs/authority/m-24-15/process/
- https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final

© 2026 ODA3 Pvt Ltd. Published by ODA3 Institute.