Control map · Rev 5, NIST SP 800-53B baseline

NIST 800-53 Moderate

Code evidence for controls from access enforcement to protection at rest, and configuration change control from every merge.

Book an audit pilot See a sample report

NIST SP 800-53 Rev 5 · Moderate baseline (SP 800-53B)37 controls in scope · as mapped in v1.4.1

Code 12
Process 2
Planned 23

Code evidence

12controls checked on every pull request

Live (process)

2from merges, approvals, rule changes, and deployments and releases recorded by GitHub

Planned

23can be evidenced from code or GitHub; not built yet

Organisation-level controls

Policies, people, vendors, physical security and the like, listed below.Toevan gives supporting evidence for 4 of these.Managed by your organisation’s workflows

NIST SP 800-53 Moderate is the baseline FedRAMP builds on; Toevan maps the baseline without FedRAMP’s additions. Configuration change control asks that changes are reviewed, approved and documented, and that only authorised people can make them.

The NIST 800-53 Moderate blueprint gives code evidence for controls from access enforcement to protection at rest. Change records give evidence for CM-3 Configuration Change Control and SA-10 Developer Configuration Management, with supporting evidence for separation of duties, access restrictions for change and integrity.

Toevan gives evidence for controls; it never certifies them or claims a framework is covered. Whether the evidence is sufficient is your auditor’s judgement.

Code evidence12

Sealed on every pull request. Always partial: the control also asks for things outside code. Rules in the NIST 800-53 Moderate blueprint check part of each on every pull request.

AC-2Account ManagementAC Access Control
AC-3Access EnforcementAC Access Control
AC-4Information Flow EnforcementAC Access Control
AC-6Least PrivilegeAC Access Control
CM-2Baseline ConfigurationCM Configuration Management
CM-6Configuration SettingsCM Configuration Management
IA-5Authenticator ManagementIA Identification and Authentication
SA-11Developer Testing and EvaluationSA System and Services Acquisition
SC-7Boundary ProtectionSC System and Communications Protection
SC-8Transmission Confidentiality and IntegritySC System and Communications Protection
SC-28Protection of Information at RestSC System and Communications Protection
SI-2Flaw RemediationSI System and Information Integrity

Live (process)2

Merged pull requests, approvals, required checks, branch protection, rulesets and bypasses, and deployments and releases recorded by GitHub, each sealed.

CM-3Configuration Change ControlCM Configuration ManagementProcess evidence: every pull request merged into the default branch is sealed as a change record with its approvals on the final commit, the required checks at merge, who merged it, its signatures and the code verdicts it carried.
SA-10Developer Configuration ManagementSA System and Services AcquisitionProcess evidence: change records and control changes for the source repository.

Change record rec_5b81d4e

example data

Pull request payments-api #1921 · Add tenant check to refund handlerReported + sealed

Approvals 9d07…e3a4, c58f…71d0 · both on final commit e81b2d0Reported + sealed

Independent of author Yes, by GitHub account idRecomputed

Required checks ci/test ✓ · ci/lint ✓ · toevan/gate ✓Reported + sealed

Rules in force main-protection: 2 approvals, required checks, signed commitsReported + sealed

Supporting4

Toevan records related evidence, but the duty is organisational, so it never counts as covered.

AC-5Separation of DutiesAC Access ControlSeparation of duties per change: the author against the approvers, computed from GitHub account ids. The wider duty stays organisational.
CM-5Access Restrictions for ChangeCM Configuration ManagementWho may change protected branches, and every bypass, sealed as control changes. Access management itself stays organisational.
SI-7Software, Firmware, and Information IntegritySI System and Information IntegrityCommit signature facts on each merged change.
SR-11Component AuthenticitySR Supply Chain Risk ManagementSupporting evidence: A GitHub attestation naming the commit. Toevan does not verify the attestation’s signature. The authenticity of third-party components is not shown.

Planned23

Can be evidenced from code or GitHub. No rule checks these yet; each is planned, and none counts as evidence today.

AC-7Unsuccessful Logon AttemptsAC Access Control
AC-11Device LockAC Access Control
AC-12Session TerminationAC Access Control
AC-17Remote AccessAC Access Control
AU-2Event LoggingAU Audit and Accountability
AU-3Content of Audit RecordsAU Audit and Accountability
AU-8Time StampsAU Audit and Accountability
AU-9Protection of Audit InformationAU Audit and Accountability
AU-11Audit Record RetentionAU Audit and Accountability
AU-12Audit Record GenerationAU Audit and Accountability
CM-7Least FunctionalityCM Configuration Management
CP-9System BackupCP Contingency Planning
IA-2Identification and Authentication (Organizational Users)IA Identification and Authentication
IA-4Identifier ManagementIA Identification and Authentication
IA-6Authentication FeedbackIA Identification and Authentication
IA-8Identification and Authentication (Non-organizational Users)IA Identification and Authentication
RA-5Vulnerability Monitoring and ScanningRA Risk Assessment
SC-12Cryptographic Key Establishment and ManagementSC System and Communications Protection
SC-13Cryptographic ProtectionSC System and Communications Protection
SC-23Session AuthenticitySC System and Communications Protection
SI-10Information Input ValidationSI System and Information Integrity
SI-11Error HandlingSI System and Information Integrity
SI-12Information Management and RetentionSI System and Information Integrity

Organisation-level controls

Organisation-level controls (policies, people, vendors, physical security and the like) stay with your organisation’s own process; Toevan does not cover them.

Show the list

AC Access Control

AC-1Policy and Proceduresorganisational policy

AC-8System Use Notificationan operational process

AC-14Permitted Actions Without Identification or Authenticationan operational process

AC-18Wireless Accessan operational process

AC-19Access Control for Mobile Devicesan operational process

AC-20Use of External Systemsan operational process

AC-21Information Sharingan operational process

AC-22Publicly Accessible Contentan operational process

AT Awareness and Training

AT-1Policy and Proceduresorganisational policy

AT-2Literacy Training and Awarenesspeople and HR

AT-3Role-based Trainingpeople and HR

AT-4Training Recordspeople and HR

AU Audit and Accountability

AU-1Policy and Proceduresorganisational policy

AU-4Audit Log Storage Capacityan operational process

AU-5Response to Audit Logging Process Failuresan operational process

AU-6Audit Record Review, Analysis, and Reportingan operational process

AU-7Audit Record Reduction and Report Generationan operational process

CA Assessment, Authorization, and Monitoring

CA-1Policy and Proceduresorganisational policy

CA-2Control Assessmentsan external assessment

CA-3Information Exchangean external assessment

CA-5Plan of Action and Milestonesan external assessment

CA-6Authorizationan external assessment

CA-7Continuous Monitoringan external assessment

CA-9Internal System Connectionsan external assessment

CM Configuration Management

CM-1Policy and Proceduresorganisational policy

CM-4Impact Analysesan operational process

CM-8System Component Inventoryan operational process

CM-9Configuration Management Planan operational process

CM-10Software Usage Restrictionsan operational process

CM-11User-installed Softwarean operational process

CM-12Information Locationan operational process

CP Contingency Planning

CP-1Policy and Proceduresorganisational policy

CP-2Contingency Planan operational process

CP-3Contingency Trainingan operational process

CP-4Contingency Plan Testingan operational process

CP-6Alternate Storage Sitean operational process

CP-7Alternate Processing Sitean operational process

CP-8Telecommunications Servicesan operational process

CP-10System Recovery and Reconstitutionan operational process

IA Identification and Authentication

IA-1Policy and Proceduresorganisational policy

IA-3Device Identification and Authenticationan operational process

IA-7Cryptographic Module Authenticationan operational process

IA-11Re-authenticationan operational process

IA-12Identity Proofingan operational process

IR Incident Response

IR-1Policy and Proceduresorganisational policy

IR-2Incident Response Trainingan operational process

IR-3Incident Response Testingan operational process

IR-4Incident Handlingan operational process

IR-5Incident Monitoringan operational process

IR-6Incident Reportingan operational process

IR-7Incident Response Assistancean operational process

IR-8Incident Response Planan operational process

MA Maintenance

MA-1Policy and Proceduresorganisational policy

MA-2Controlled Maintenancephysical security

MA-3Maintenance Toolsphysical security

MA-4Nonlocal Maintenancephysical security

MA-5Maintenance Personnelphysical security

MA-6Timely Maintenancephysical security

MP Media Protection

MP-1Policy and Proceduresorganisational policy

MP-2Media Accessphysical security

MP-3Media Markingphysical security

MP-4Media Storagephysical security

MP-5Media Transportphysical security

MP-6Media Sanitizationphysical security

MP-7Media Usephysical security

PE Physical and Environmental Protection

PE-1Policy and Proceduresorganisational policy

PE-2Physical Access Authorizationsphysical security

PE-3Physical Access Controlphysical security

PE-4Access Control for Transmissionphysical security

PE-5Access Control for Output Devicesphysical security

PE-6Monitoring Physical Accessphysical security

PE-8Visitor Access Recordsphysical security

PE-9Power Equipment and Cablingphysical security

PE-10Emergency Shutoffphysical security

PE-11Emergency Powerphysical security

PE-12Emergency Lightingphysical security

PE-13Fire Protectionphysical security

PE-14Environmental Controlsphysical security

PE-15Water Damage Protectionphysical security

PE-16Delivery and Removalphysical security

PE-17Alternate Work Sitephysical security

PL Planning

PL-1Policy and Proceduresorganisational policy

PL-2System Security and Privacy Plansorganisational policy

PL-4Rules of Behaviororganisational policy

PL-8Security and Privacy Architecturesorganisational policy

PL-10Baseline Selectionorganisational policy

PL-11Baseline Tailoringorganisational policy

PS Personnel Security

PS-1Policy and Proceduresorganisational policy

PS-2Position Risk Designationpeople and HR

PS-3Personnel Screeningpeople and HR

PS-4Personnel Terminationpeople and HR

PS-5Personnel Transferpeople and HR

PS-6Access Agreementspeople and HR

PS-7External Personnel Securitypeople and HR

PS-8Personnel Sanctionspeople and HR

PS-9Position Descriptionspeople and HR

RA Risk Assessment

RA-1Policy and Proceduresorganisational policy

RA-2Security Categorizationorganisational policy

RA-3Risk Assessmentorganisational policy

RA-7Risk Responseorganisational policy

RA-9Criticality Analysisorganisational policy

SA System and Services Acquisition

SA-1Policy and Proceduresorganisational policy

SA-2Allocation of Resourcesorganisational policy

SA-3System Development Life Cycleorganisational policy

SA-4Acquisition Processcontracts and vendors

SA-5System Documentationorganisational policy

SA-8Security and Privacy Engineering Principlesorganisational policy

SA-9External System Servicescontracts and vendors

SA-15Development Process, Standards, and Toolsorganisational policy

SA-22Unsupported System Componentsorganisational policy

SC System and Communications Protection

SC-1Policy and Proceduresorganisational policy

SC-2Separation of System and User Functionalityan operational process

SC-4Information in Shared System Resourcesan operational process

SC-5Denial-of-service Protectionan operational process

SC-10Network Disconnectan operational process

SC-15Collaborative Computing Devices and Applicationsan operational process

SC-17Public Key Infrastructure Certificatesan operational process

SC-18Mobile Codean operational process

SC-20Secure Name/Address Resolution Service (Authoritative Source)an operational process

SC-21Secure Name/Address Resolution Service (Recursive or Caching Resolver)an operational process

SC-22Architecture and Provisioning for Name/Address Resolution Servicean operational process

SC-39Process Isolationan operational process

SI System and Information Integrity

SI-1Policy and Proceduresorganisational policy

SI-3Malicious Code Protectionan operational process

SI-4System Monitoringan operational process

SI-5Security Alerts, Advisories, and Directivesan operational process

SI-8Spam Protectionan operational process

SI-16Memory Protectionan operational process

SR Supply Chain Risk Management

SR-1Policy and Proceduresorganisational policy

SR-2Supply Chain Risk Management Plancontracts and vendors

SR-3Supply Chain Controls and Processescontracts and vendors

SR-5Acquisition Strategies, Tools, and Methodscontracts and vendors

SR-6Supplier Assessments and Reviewscontracts and vendors

SR-8Notification Agreementscontracts and vendors

SR-10Inspection of Systems or Componentscontracts and vendors

SR-12Component Disposalcontracts and vendors

Using it in an audit

Take the population from the change records
Every pull request merged into the default branch and every push to a protected branch that no merged pull request explains, in the period, captured from GitHub as it happened, is a sealed record you can export for sampling. You can re-perform the default branch’s population from git history; designated production branches are planned.
Read the code evidence for the period
Each pull request carries sealed code results against the blueprint’s rules, pinned to the commit and the rule-set version in force.
Test a sample
For each sampled record, check its results, then verify it offline against the published key with openssl and the shell: get the evidence, confirm the key, check the record. To replay the whole chain, Toevan provides the toevan command on request; it is not yet public.
The three steps, with the exact commands

How each fact was obtained6 labels

Recomputed: Toevan computed it from the code or git history itself.
Reported + sealed: GitHub reported it; Toevan captured it at the event and signed it.
Declared + sealed: The organisation declared it, such as a change to what is checked; Toevan signed the declaration and its history.
Toevan record, not sealed: Held in Toevan’s database but not sealed in the ledger, such as a waiver today. Nothing protects it by a signature.
Consumed: Taken from GitHub’s deployment and release records and linked by commit or digest.
Not captured: No reliable source was available. Toevan does not infer it.

CM-3Change approvalsTest sheet · example data

Population148 changes: 146 merged pull requests and 2 direct pushes
Recomputed listed from git history and matched to the sealed records

Sample25 drawn by the auditor, each a sealed record

ApprovalsReported + sealed from GitHub at merge, independent of the author

ExceptionsNo PR 2 direct pushes on 19 SepGap review requirement off for 29 minutesBoth are in the record.

Signatures25 / 25 ✓ Verified OK

The sample change evidence report shows the evidence as your auditor receives it, with every fact labelled.Open the sample report

Test the mapping on a real audit.

Bring one repository and an upcoming audit. We’ll set up the blueprint and walk your auditor through verification.

Book an audit pilot See a sample report

One repository, one framework
Evidence from the first pull request
Verifiable without a Toevan account