Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

[Documentation] path-to-authorization.md advertises FedRAMP Moderate baselines for the SCTM and Policies and Procedures templates, but the published template set is FedRAMP High and IL5 only

Aperta Adatta ai principianti
  • Qualcosa non va?
#232 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 2 giorni

@aghassemlouei ci sta già lavorando.

Dal 8/10/2026.

  • #282 di @aghassemlouei — aperta

Valutazione

Difficoltà
1/5
Tempo stimato
1-3 ore
Idoneità per principianti
88/100
Tipo di issue
Documentazione
Chiarezza
Specificata chiaramente
Stato di attività
Attiva
Stack tecnologico
markdown
Ambito
documentation

Direzione di ricerca

Apri docs/path-to-authorization.md e rivedi il sottotitolo e i riferimenti intorno alle righe 70-71, 85 e 113-117. Aggiorna le dichiarazioni sulla copertura in modo che corrispondano ai template IL5 e FedRAMP High disponibili, indica se sono previsti template Moderate e controlla ogni indice per l’insieme di template affinché la descrizione della relativa copertura rimanga coerente.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

documentation Level of Effort - High Priority - Medium

Description of Documentation Need

docs/path-to-authorization.md presents the authorization-package templates as covering three baselines. At main @ 6d7d08c0:

  • Line 3, the document subtitle: Impact Level 5 (H-H-X), FedRAMP High & FedRAMP Moderate
  • Lines 70-71: a link labeled FedRAMP High & Moderate Authorization Boundary
  • Lines 113-114: Security Control Traceability Matrix (SCTM) Templates — (IL5 H-H-X, FedRAMP High, and FedRAMP Moderate Baselines)
  • Lines 116-117: Policies and Procedures Templates — (IL5 HHX, FedRAMP High, and FedRAMP Moderate Baselines)

No Moderate baseline appears to exist for any of the authorization-package artifacts.

The two families that live in this repository can be checked directly — git ls-tree -r main -- docs/artifacts/ at 6d7d08c0 returns four template files and no others:

docs/artifacts/hw-sw-list/FedRAMP_High_HWSWList_Template.xlsx
docs/artifacts/hw-sw-list/IL5_HWSWList_Template.xlsx
docs/artifacts/ppsms/FedRAMP_High_PPSMBoundariesInformationExport_Template.xlsx
docs/artifacts/ppsms/IL5_PPSMBoundariesInformationExport_Template.xlsx

Two regimes, no Moderate.

The remaining families are not in the repository at all — there is no System Security Plan template, no SCTM template and no Policies and Procedures template anywhere in the tree. Those are hosted on Drive, in the ATO Artifacts folder this document's template links resolve to:

https://drive.google.com/drive/folders/1NeWZcOuxysi7kUNRCFDd8CeHnxF14ywp

Every family in it is the same two regimes:

Family What is there Moderate?
Policies and Procedures subfolders FedRAMP High (20 documents) and IL5, plus the Policies and Procedures User Guide no
SSP FedRAMP_High_SSP_System Security Plan_Template, IL5_SSP_System Security Plan_Template no
SCTM SCTM_Burndown_Tool_rev5_FedRAMP_High, SCTM_Burndown_Tool_rev5_IL5_HHX no
PPSM the same FedRAMP_High / IL5 pair also committed to docs/artifacts/ppsms/ no

The Policies and Procedures set is the one line 116 sends a reader to, and it is the largest of the families — twenty documents per regime, one per 800-53 control family, named <Regime>_<Family Code>_<Family Name>_Rev<#>_Template (for example FedRAMP_High_AC_Access Control_Rev5_Template and IL5_HHX_AC_Access Control_Rev5_Template). There is no FedRAMP Moderate subfolder beside them.

So across both hosting locations, and across all five artifact families, the only values of <Regime> in use are FedRAMP_High and IL5 / IL5_HHX.

So a reader who follows this document to assemble a FedRAMP Moderate authorization package is told the Moderate baselines exist and then cannot find them.

This became more visible with v3.0.0. Platform-level FedRAMP Moderate support landed in PR #162 (closing #101): kms_protection_level became a variable across 0-bootstrap, 1-resman, 2-networking and 3-security, and the networking stage is now "FedRAMP High / Moderate". An operator can therefore stand up a Moderate landing zone today, and then finds neither a Moderate workload blueprint (#192) nor a Moderate authorization package.

Target Audience

Anyone assembling an authorization package for a FedRAMP Moderate system: SSP authors, ISSOs and ISSMs, the partners this template set exists to accelerate, and the Authorizing Official who receives the package. Also anyone doing regime selection early in a program, where "is the paperwork ready for Moderate?" is a real input to choosing Moderate over High.

Proposed Location

docs/path-to-authorization.md — the four places listed above. Whatever indexes the template set itself should carry the same statement, so the document and the deliverable cannot drift apart again.

Content Outline / Draft

Correct the four references to name the baselines that are actually available — IL5 (H-H-X) and FedRAMP High — and add one sentence on whether Moderate is planned. A statement of intent is genuinely useful on its own: a team choosing between High and Moderate can plan around "Moderate templates are not available yet," but cannot plan around a promise that does not resolve.

Stating the regimes each artifact family covers at the point of the link is what stops this recurring. Today the coverage claim appears only in the subtitle and in two parenthetical notes, and the System Security Plan link at line 85 carries no regime note at all, so its coverage has to be inferred from the subtitle.

Compliance Context (if applicable)

No control is mis-implemented — this is a documentation-coverage question rather than a control gap. It matters because these are the artifacts an assessor asks for by name: the System Security Plan (PL-2), the traceability matrix that carries control assessment and continuous monitoring (CA-2, CA-7), and the per-family policy and procedure documents required by the -1 control of every 800-53 family (AC-1, AU-1, and so on for all twenty). A Moderate baseline is not a subset of High that a team can safely tailor down by hand: the control selections differ, and starting from the High templates and deleting controls is exactly the kind of undocumented tailoring that costs time in assessment. FedRAMP Moderate is also the larger share of federal and state workloads, so the audience for these artifacts is bigger than the audience for the High ones.

Lingua principale
HCL
Stelle
55
Fork
21
Merge medio
1g 18h
PR unite (30g)
22

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di google/stellar-engine

Tutte le issue di google/stellar-engine

Issue simili

Altre issue su Documentation

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.