KSI-AFR-MAS—Minimum Assessment Scope
Formerly KSI-AFR-01
>Control Description
>NIST 800-53 Controls
>FRMR Requirements8
Normative requirements from the FedRAMP Requirements and Recommendations document — 5 mandatory, 1 recommended, 2 optional.
Identify Information Resources
Providers MUST identify a set of information resources to assess for FedRAMP authorization that includes all information resources that are likely to handle federal customer data or likely to impact the confidentiality, integrity, or availability of federal customer data handled by the cloud service offering; this set of information resources is the cloud service offering.
Certain categories of cloud computing products and services are specified as entirely outside the scope of FedRAMP by the Director of the Office of Management and Budget. All such products and services are therefore not included in the cloud service offering for FedRAMP. For more, see https://fedramp.gov/scope.
Software produced by cloud service providers that is delivered separately for installation on agency systems and not operated in a shared responsibility model (typically including agents, application clients, mobile applications, etc. that are not fully managed by the cloud service provider) is not a cloud computing product or service and is entirely outside the scope of FedRAMP under the FedRAMP Authorization Act. All such software is therefore not included in the cloud service offering for FedRAMP. For more, see fedramp.gov/scope.
All aspects of the cloud service offering are determined and maintained by the cloud service provider in accordance with related FedRAMP authorization requirements and documented by the cloud service provider in their assessment and authorization materials.
Information Flows and Security Objectives
Providers MUST clearly identify, document, and explain information flows and security objectives for ALL information resources or sets of information resources in the cloud service offering.
Third-Party Information Resources
Providers MUST address the potential impact to federal customer data from third-party information resources used by the cloud service offering, ONLY IF MAS-CSO-IIR APPLIES, by documenting the following information about each applicable third-party information resource:
- General usage and configuration
- Explanation or justification for use
- Mitigation measures in place to reduce the potential impact to federal customer data
- Compensating controls in place to reduce the potential impact to federal customer data
Metadata Inclusion
Providers MUST include metadata (including metadata about federal customer data) in the Minimum Assessment Scope ONLY IF MAS-CSO-IIR APPLIES.
Implementation Summaries
Providers MUST maintain simple high-level summaries of at least the following for each Key Security Indicator:
- Goals for how it will be implemented and validated, including clear pass/fail criteria and traceability
- The consolidated _information resources_ that will be validated (this should include consolidated summaries such as "all employees with privileged access that are members of the Admin group")
- The machine-based processes for _validation_ and the _persistent_ cycle on which they will be performed (or an explanation of why this doesn't apply)
- The non-machine-based processes for _validation_ and the _persistent_ cycle on which they will be performed (or an explanation of why this doesn't apply)
- Current implementation status
- Any clarifications or responses to the assessment summary
Application within MAS
Providers SHOULD apply ALL Key Security Indicators to ALL aspects of their cloud service offering that are within the FedRAMP Minimum Assessment Scope.
2 optional guidance (MAY)
Supplemental Information
Providers MAY include additional materials about other information resources that are not part of the cloud service offering in a FedRAMP assessment and authorization package supplement; these resources will not be FedRAMP authorized and MUST be clearly marked and separated from the cloud service offering.
AFR Order of Criticality
Providers MAY use the following order of criticality for approaching Authorization by FedRAMP Key Security Indicators for an initial authorization package:
- Minimum Assessment Scope (MAS)
- Authorization Data Sharing (ADS)
- Using Cryptographic Modules (UCM)
- Vulnerability Detection and Response (VDR)
- Significant Change Notifications (SCN)
- Persistent Validation and Assessment (PVA)
- Secure Configuration Guide (RSC)
- Collaborative Continuous Monitoring (CCM)
- FedRAMP Security Inbox (FSI)
- Incident Communications Procedures (ICP)
>Trust Center Components3
Ways to express your implementation of this indicator — approaches vary by organization size, complexity, and data sensitivity.
From the field: Mature implementations express authorization boundaries as machine-readable inventories — IaC-defined boundaries synced to OSCAL system descriptions, auto-discovered asset inventories overlaid on architecture diagrams, and boundary change detection triggering 3PAO re-assessment workflows. The boundary becomes a living, verified artifact rather than an annual PDF.
System Boundary Diagram
Architecture expressing all components within the authorization boundary — zone-based with CIA impact ratings and asset categorization
Assessment Scope Documentation
Scope of third-party assessments including system boundaries, components, and services covered
3PAO Assessment Reports
Summary of 3PAO assessment findings and scope — demonstrates external validation of the boundary
>Programmatic Queries
CLI Commands
aws configservice describe-configuration-recorder-status --query "ConfigurationRecordersStatus[].{Name:name,Recording:recording,LastStatus:lastStatus}" --output tableaws configservice get-discovered-resource-counts --query "resourceCounts[].{Type:resourceType,Count:count}" --output table>20x Assessment Focus Areas
Aligned with FedRAMP 20x Phase Two assessment methodology
Completeness & Coverage:
- •Does your documented authorization boundary include all interconnected systems, inherited services, and external APIs, or are there components not yet accounted for?
- •How do you confirm that every deployed resource (compute, storage, networking, SaaS dependencies) is reflected in the assessment scope?
- •What process catches scope changes introduced by engineering teams deploying new services or regions before the next assessment cycle?
- •Are there any components you consider out of scope that handle, process, or transmit federal customer data — and how is that exclusion justified?
Automation & Validation:
- •What automated discovery tools continuously compare deployed infrastructure against your documented authorization boundary, and what fires when a mismatch is found?
- •How do you validate that network diagrams and data flow diagrams match actual traffic patterns — do you use flow logs or network mapping tools?
- •What happens if a new cloud account, subscription, or VPC is created outside the documented scope — is it automatically flagged?
- •How do you test that boundary enforcement controls (firewalls, network policies) actually restrict traffic to the documented scope?
Inventory & Integration:
- •How does your CMDB or asset inventory tool integrate with cloud provider APIs to produce a real-time view of in-scope resources?
- •Are inherited service boundaries (e.g., IaaS provider shared responsibility) tracked in the same inventory system, or maintained separately?
- •How do you track interconnections and data flows between your CSO and external systems, and is this tracking automated or manual?
- •What tools reconcile your documented scope against actual deployment artifacts (Terraform state, CloudFormation stacks, Kubernetes namespaces)?
Continuous Evidence & Schedules:
- •How often is the authorization boundary formally reviewed, and how do you demonstrate that every review was completed on schedule?
- •Is scope documentation maintained as machine-readable artifacts (e.g., IaC, structured JSON), or only as static diagrams and Word documents?
- •How do you detect scope drift — resources entering or leaving the boundary — between formal review cycles?
- •What evidence shows the documented scope matched the actual environment at the time of the most recent assessment?
Update History
Ask AI
Configure your API key to use AI features.