{ "$schema": "./catalog.schema.json", "name": "CFA Key Accountability Indicators", "version": "0.5.0", "updated": "2026-10-24", "evidence_tiers": { "P1": "Observed: what anyone can see from the internet with ordinary requests", "P2": "Published government data sets", "P3": "Published documents", "F": "A named record requested under FOIA" }, "themes": [ { "id": "KAI-GOV", "name": "Cybersecurity Governance", "csf_function": "Govern", "ig_fisma_domain": "Cybersecurity Governance", "cr26_ksi_themes": [ "KSI-PIY" ], "fiscam": "Security management", "cfa_scoring_area": "FISMA information security" }, { "id": "KAI-SCR", "name": "Supply Chain Risk", "csf_function": "Govern", "ig_fisma_domain": "Cybersecurity Supply Chain Risk Management", "cr26_ksi_themes": [ "KSI-SCR" ], "fiscam": "Security management", "cfa_scoring_area": null }, { "id": "KAI-RAM", "name": "Risk and Asset Management", "csf_function": "Identify", "ig_fisma_domain": "Risk and Asset Management", "cr26_ksi_themes": [ "KSI-PIY", "KSI-SCR" ], "fiscam": "Security management", "cfa_scoring_area": "System inventory honesty; FedRAMP and shadow IT" }, { "id": "KAI-CFG", "name": "Configuration Management", "csf_function": "Protect", "ig_fisma_domain": "Configuration Management", "cr26_ksi_themes": [ "KSI-CMT", "KSI-CNA", "KSI-SVC" ], "fiscam": "Configuration management", "cfa_scoring_area": "Cybersecurity risk" }, { "id": "KAI-IAM", "name": "Identity and Access", "csf_function": "Protect", "ig_fisma_domain": "Identity and Access Management", "cr26_ksi_themes": [ "KSI-IAM" ], "fiscam": "Access controls; segregation of duties", "cfa_scoring_area": null }, { "id": "KAI-DPP", "name": "Data Protection", "csf_function": "Protect", "ig_fisma_domain": "Data Protection and Privacy", "cr26_ksi_themes": [ "KSI-INR", "KSI-SVC" ], "fiscam": "Access controls", "cfa_scoring_area": null }, { "id": "KAI-TRN", "name": "Security Training", "csf_function": "Protect", "ig_fisma_domain": "Security Training", "cr26_ksi_themes": [ "KSI-CED" ], "fiscam": "Security management", "cfa_scoring_area": null }, { "id": "KAI-MON", "name": "Continuous Monitoring", "csf_function": "Detect", "ig_fisma_domain": "Information Security Continuous Monitoring", "cr26_ksi_themes": [ "KSI-MLA" ], "fiscam": "Security management; configuration management", "cfa_scoring_area": "Cybersecurity risk" }, { "id": "KAI-INR", "name": "Incident Response", "csf_function": "Respond", "ig_fisma_domain": "Incident Response", "cr26_ksi_themes": [ "KSI-INR" ], "fiscam": "Security management", "cfa_scoring_area": null }, { "id": "KAI-RPL", "name": "Contingency Planning", "csf_function": "Recover", "ig_fisma_domain": "Contingency Planning", "cr26_ksi_themes": [ "KSI-RPL" ], "fiscam": "Contingency planning", "cfa_scoring_area": null }, { "id": "KAI-EXP", "name": "Public Exposure", "csf_function": "Protect", "ig_fisma_domain": "(Configuration Management)", "cr26_ksi_themes": [ "KSI-CNA", "KSI-PIY", "KSI-SVC" ], "fiscam": "Configuration management", "cfa_scoring_area": null }, { "id": "KAI-PRV", "name": "Privacy and Information Collection", "csf_function": "Govern", "ig_fisma_domain": "(Data Protection and Privacy)", "cr26_ksi_themes": [ "KSI-PIY" ], "fiscam": null, "cfa_scoring_area": "SORN integrity; PIA currency; consent and sharing; privacy workforce; PRA compliance" }, { "id": "KAI-FIN", "name": "Financial System Controls", "csf_function": null, "ig_fisma_domain": null, "cr26_ksi_themes": [ "KSI-PIY" ], "fiscam": "Business process controls plus all five general categories", "cfa_scoring_area": null }, { "id": "KAI-ITM", "name": "IT Management and Acquisition", "csf_function": "Govern", "ig_fisma_domain": null, "cr26_ksi_themes": [ "KSI-PIY" ], "fiscam": "Security management", "cfa_scoring_area": "IT acquisition management" }, { "id": "KAI-AIG", "name": "AI Governance", "csf_function": "Govern", "ig_fisma_domain": null, "cr26_ksi_themes": [ "KSI-PIY", "KSI-SCR" ], "fiscam": null, "cfa_scoring_area": null }, { "id": "KAI-DIG", "name": "Digital Public Experience", "csf_function": null, "ig_fisma_domain": null, "cr26_ksi_themes": [], "fiscam": null, "cfa_scoring_area": null }, { "id": "KAI-TRP", "name": "Transparency and FOIA", "csf_function": null, "ig_fisma_domain": null, "cr26_ksi_themes": [ "KSI-PIY" ], "fiscam": null, "cfa_scoring_area": null }, { "id": "KAI-REC", "name": "Federal Records", "csf_function": null, "ig_fisma_domain": null, "cr26_ksi_themes": [ "KSI-PIY" ], "fiscam": null, "cfa_scoring_area": null }, { "id": "KAI-OVR", "name": "Oversight Responsiveness", "csf_function": "Govern", "ig_fisma_domain": "(Cybersecurity Governance)", "cr26_ksi_themes": [ "KSI-PIY" ], "fiscam": "Security management", "cfa_scoring_area": null }, { "id": "KAI-AUT", "name": "Legal Authority", "csf_function": null, "ig_fisma_domain": null, "cr26_ksi_themes": [], "fiscam": null, "cfa_scoring_area": null } ], "indicators": [ { "id": "KAI-GOV-IGR", "theme": "KAI-GOV", "name": "IG's FISMA effectiveness conclusion and maturity level, recorded separately", "authority": [ { "tracker_id": "law-113-283" }, { "tracker_id": "omb-m-25-04" } ], "evidence": { "tiers": [ "P3" ], "description": "P3 IG report", "expected_access": "public" }, "validation": { "methods": [ "analyst" ], "cycle": "yearly" }, "crosswalk": { "cr26_ksi": [], "fiscam": "SM" }, "criticality": "major", "result_rule": "auditor", "ig_subscore": false, "status": "draft" }, { "id": "KAI-GOV-RPT", "theme": "KAI-GOV", "name": "IG FISMA evaluation exists and the agency appears in OMB's FISMA report to Congress", "authority": [ { "tracker_id": "law-113-283" }, { "tracker_id": "cisa-fy2026-cio-fisma-metrics" } ], "evidence": { "tiers": [ "P3" ], "description": "P3 Oversight.gov, OMB report", "expected_access": "public" }, "validation": { "methods": [ "analyst" ], "cycle": "yearly" }, "crosswalk": { "cr26_ksi": [ "KSI-PIY-RES" ], "fiscam": "SM" }, "criticality": "major", "result_rule": "any_failure", "ig_subscore": false, "status": "draft" }, { "id": "KAI-GOV-SAI", "theme": "KAI-GOV", "name": "A senior information security officer is designated", "authority": [ { "tracker_id": "law-113-283" } ], "evidence": { "tiers": [ "P1", "P3" ], "description": "P1 agency site, P3", "expected_access": "public" }, "validation": { "methods": [ "analyst" ], "cycle": "yearly" }, "crosswalk": { "cr26_ksi": [ "KSI-PIY-RES" ], "fiscam": "SM" }, "criticality": "major", "result_rule": "any_failure", "ig_subscore": false, "status": "draft" }, { "id": "KAI-GOV-ZTA", "theme": "KAI-GOV", "name": "Zero trust progress as rated in the IG's supplemental metric", "authority": [ { "tracker_id": "omb-m-22-09" } ], "evidence": { "tiers": [ "P3" ], "description": "P3 IG report", "expected_access": "public" }, "validation": { "methods": [ "analyst" ], "cycle": "yearly" }, "crosswalk": { "cr26_ksi": [ "KSI-PIY-RES" ], "fiscam": "SM" }, "criticality": "major", "result_rule": "auditor", "ig_subscore": false, "status": "draft" }, { "id": "KAI-GOV-PQC", "theme": "KAI-GOV", "name": "Post-quantum migration plan sent to OMB and ONCD on time", "authority": [ { "tracker_id": "omb-m-26-15" }, { "tracker_id": "law-117-260" }, { "tracker_id": "pd-nsm-10" }, { "tracker_id": "eo-14412" } ], "evidence": { "tiers": [ "F" ], "description": "F transmittal date", "expected_access": "foia_releasable" }, "validation": { "methods": [ "analyst" ], "cycle": null }, "crosswalk": { "cr26_ksi": [ "KSI-PIY-GIV" ], "fiscam": "SM" }, "criticality": "major", "result_rule": "any_failure", "ig_subscore": false, "status": "draft" }, { "id": "KAI-SCR-PRH", "theme": "KAI-SCR", "name": "No direct purchases from legally barred sources (Kaspersky, named telecom firms, FASCSA orders that bind the agency)", "authority": [ { "tracker_id": "law-115-91-sec-1634" }, { "tracker_id": "law-115-232-sec-889" }, { "tracker_id": "law-115-390-title-ii" } ], "evidence": { "tiers": [ "P2" ], "description": "P2 USAspending, SAM.gov orders", "expected_access": "public" }, "validation": { "methods": [ "machine", "analyst" ], "cycle": "30 days" }, "crosswalk": { "cr26_ksi": [ "KSI-SCR-MIT" ], "fiscam": "SM" }, "criticality": "major", "result_rule": "any_failure", "ig_subscore": false, "status": "draft" }, { "id": "KAI-SCR-DRN", "theme": "KAI-SCR", "name": "No covered foreign drones bought or operated", "authority": [ { "tracker_id": "law-118-31-title-xviii-subtitle-b" }, { "tracker_id": "omb-m-26-02" } ], "evidence": { "tiers": [ "P2", "F" ], "description": "P2 awards, F drone inventory", "expected_access": "foia_releasable" }, "validation": { "methods": [ "machine", "analyst" ], "cycle": "30 days" }, "crosswalk": { "cr26_ksi": [ "KSI-SCR-MIT" ], "fiscam": "SM" }, "criticality": "major", "result_rule": "any_failure", "ig_subscore": false, "status": "draft" }, { "id": "KAI-SCR-IOT", "theme": "KAI-SCR", "name": "Waivers for non-compliant connected devices are reported", "authority": [ { "tracker_id": "law-116-207" } ], "evidence": { "tiers": [ "P3", "F" ], "description": "P3 GAO, F waivers", "expected_access": "foia_releasable" }, "validation": { "methods": [ "analyst" ], "cycle": "yearly" }, "crosswalk": { "cr26_ksi": [ "KSI-SCR-MON" ], "fiscam": "SM" }, "criticality": "major", "result_rule": "any_failure", "ig_subscore": false, "status": "draft" }, { "id": "KAI-RAM-INV", "theme": "KAI-RAM", "name": "Reported system inventory is consistent with other public records", "authority": [ { "tracker_id": "law-113-283" } ], "evidence": { "tiers": [ "P3", "F" ], "description": "P3, F", "expected_access": "foia_releasable" }, "validation": { "methods": [ "analyst" ], "cycle": null }, "crosswalk": { "cr26_ksi": [ "KSI-PIY-GIV" ], "fiscam": "SM" }, "criticality": "major", "result_rule": "any_failure", "ig_subscore": false, "status": "draft" }, { "id": "KAI-RAM-ATO", "theme": "KAI-RAM", "name": "Systems operate with a current authorization", "authority": [ { "tracker_id": "omb-a-130-2016" }, { "tracker_id": "nist-fips-199" }, { "tracker_id": "omb-m-02-01" } ], "evidence": { "tiers": [ "P3", "F" ], "description": "P3 IG, F list of authorizations", "expected_access": "foia_releasable" }, "validation": { "methods": [ "analyst" ], "cycle": "yearly" }, "crosswalk": { "cr26_ksi": [ "KSI-PIY-GIV" ], "fiscam": "SM" }, "criticality": "major", "result_rule": "share", "ig_subscore": false, "status": "draft" }, { "id": "KAI-RAM-HVA", "theme": "KAI-RAM", "name": "High value asset protections, as found by IG and GAO audits", "authority": [ { "tracker_id": "cisa-bod-18-02" }, { "tracker_id": "omb-m-19-03" } ], "evidence": { "tiers": [ "P3" ], "description": "P3 IG and GAO audits", "expected_access": "public" }, "validation": { "methods": [ "analyst" ], "cycle": null }, "crosswalk": { "cr26_ksi": [ "KSI-PIY-GIV" ], "fiscam": "SM" }, "criticality": "major", "result_rule": "auditor", "ig_subscore": false, "status": "draft" }, { "id": "KAI-RAM-CLD", "theme": "KAI-RAM", "name": "Cloud services in use are FedRAMP authorized", "authority": [ { "tracker_id": "law-117-263-sec-5921" }, { "tracker_id": "omb-m-24-15" } ], "evidence": { "tiers": [ "P2" ], "description": "P2 Marketplace reuse data, awards", "expected_access": "public" }, "validation": { "methods": [ "analyst" ], "cycle": "90 days" }, "crosswalk": { "cr26_ksi": [ "KSI-SCR-MON" ], "fiscam": "SM" }, "criticality": "major", "result_rule": "share", "ig_subscore": false, "status": "draft" }, { "id": "KAI-RAM-FRP", "theme": "KAI-RAM", "name": "Agency cloud authorization policy issued and sent to OMB", "authority": [ { "tracker_id": "law-117-263-sec-5921", "note": "44 U.S.C. 3613; the FedRAMP Authorization Act's sections are repealed 5 years after 2022-12-23 unless Congress extends them; subsection (d)" }, { "tracker_id": "omb-m-24-15" } ], "evidence": { "tiers": [ "P3", "F" ], "description": "P3 published agency FedRAMP policy, F the policy and its submission to OMB", "expected_access": "foia_releasable" }, "validation": { "methods": [ "analyst" ], "cycle": "yearly" }, "crosswalk": { "cr26_ksi": [ "KSI-SCR-MON" ], "fiscam": "SM" }, "criticality": "major", "result_rule": "any_failure", "ig_subscore": false, "status": "draft" }, { "id": "KAI-RAM-ATR", "theme": "KAI-RAM", "name": "Agency authorizations of FedRAMP cloud services are reported to FedRAMP", "authority": [ { "tracker_id": "law-117-263-sec-5921", "note": "44 U.S.C. 3613; the FedRAMP Authorization Act's sections are repealed 5 years after 2022-12-23 unless Congress extends them; subsections (a) and (c)" }, { "tracker_id": "omb-m-24-15" } ], "evidence": { "tiers": [ "P2" ], "description": "P2 FedRAMP Marketplace agency authorizations, compared with awards to authorized services", "expected_access": "public" }, "validation": { "methods": [ "analyst" ], "cycle": "90 days" }, "crosswalk": { "cr26_ksi": [ "KSI-SCR-MON" ], "fiscam": "SM" }, "criticality": "major", "result_rule": "share", "ig_subscore": false, "status": "draft" }, { "id": "KAI-RAM-AST", "theme": "KAI-RAM", "name": "Asset discovery and scanning on the required cadence", "authority": [ { "tracker_id": "cisa-bod-23-01" } ], "evidence": { "tiers": [ "P3", "F" ], "description": "P3 IG, F likely withheld", "expected_access": "likely_withheld" }, "validation": { "methods": [ "analyst" ], "cycle": null }, "crosswalk": { "cr26_ksi": [ "KSI-PIY-GIV" ], "fiscam": "CM" }, "criticality": "major", "result_rule": "auditor", "ig_subscore": false, "status": "draft" }, { "id": "KAI-CFG-VUL", "theme": "KAI-CFG", "name": "Known exploited vulnerabilities fixed within the required windows", "authority": [ { "tracker_id": "cisa-bod-26-04", "note": "cisa-bod-22-01 before 2026-06-10" } ], "evidence": { "tiers": [ "P3", "F" ], "description": "P3 IG, F likely withheld", "expected_access": "likely_withheld" }, "validation": { "methods": [ "analyst" ], "cycle": null }, "crosswalk": { "cr26_ksi": [ "KSI-SVC-PRR" ], "fiscam": "CM" }, "criticality": "major", "result_rule": "auditor", "ig_subscore": false, "status": "draft" }, { "id": "KAI-CFG-SCB", "theme": "KAI-CFG", "name": "Secure cloud configuration baselines applied", "authority": [ { "tracker_id": "cisa-bod-25-01" } ], "evidence": { "tiers": [ "P3", "F" ], "description": "P3 IG, F likely withheld", "expected_access": "likely_withheld" }, "validation": { "methods": [ "analyst" ], "cycle": null }, "crosswalk": { "cr26_ksi": [ "KSI-SVC-ACM" ], "fiscam": "CM" }, "criticality": "major", "result_rule": "auditor", "ig_subscore": false, "status": "draft" }, { "id": "KAI-CFG-BAS", "theme": "KAI-CFG", "name": "Baseline configurations documented and enforced", "authority": [ { "tracker_id": "law-113-283" } ], "evidence": { "tiers": [ "P3" ], "description": "P3 IG, auditor report", "expected_access": "public" }, "validation": { "methods": [ "analyst" ], "cycle": "yearly" }, "crosswalk": { "cr26_ksi": [ "KSI-CNA-EIS" ], "fiscam": "CM" }, "criticality": "major", "result_rule": "auditor", "ig_subscore": true, "status": "draft" }, { "id": "KAI-IAM-MFA", "theme": "KAI-IAM", "name": "Phishing-resistant multifactor authentication for staff", "authority": [ { "tracker_id": "omb-m-22-09" }, { "tracker_id": "eo-14028" } ], "evidence": { "tiers": [ "P3" ], "description": "P3 IG and OMB report", "expected_access": "public" }, "validation": { "methods": [ "analyst" ], "cycle": "yearly" }, "crosswalk": { "cr26_ksi": [ "KSI-IAM-APM" ], "fiscam": "AC" }, "criticality": "major", "result_rule": "auditor", "ig_subscore": false, "status": "draft" }, { "id": "KAI-IAM-PIV", "theme": "KAI-IAM", "name": "Staff and contractors use PIV credentials", "authority": [ { "tracker_id": "pd-hspd-12" }, { "tracker_id": "nist-fips-201-3" }, { "tracker_id": "omb-m-05-24" } ], "evidence": { "tiers": [ "P3" ], "description": "P3 IG and OMB report", "expected_access": "public" }, "validation": { "methods": [ "analyst" ], "cycle": "yearly" }, "crosswalk": { "cr26_ksi": [ "KSI-IAM-APM" ], "fiscam": "AC" }, "criticality": "major", "result_rule": "auditor", "ig_subscore": false, "status": "draft" }, { "id": "KAI-IAM-PUB", "theme": "KAI-IAM", "name": "Public sign-in uses Login.gov (on schedule until the deadline)", "authority": [ { "tracker_id": "omb-m-26-18" }, { "tracker_id": "eo-13681" } ], "evidence": { "tiers": [ "P1" ], "description": "P1 sign-in pages", "expected_access": "public" }, "validation": { "methods": [ "analyst" ], "cycle": "90 days" }, "crosswalk": { "cr26_ksi": [ "KSI-IAM-APM" ], "fiscam": "AC" }, "criticality": "major", "result_rule": "share", "ig_subscore": false, "status": "draft" }, { "id": "KAI-IAM-PRV", "theme": "KAI-IAM", "name": "Privileged access limited and reviewed", "authority": [ { "tracker_id": "law-113-283" } ], "evidence": { "tiers": [ "P3" ], "description": "P3 IG, auditor report", "expected_access": "public" }, "validation": { "methods": [ "analyst" ], "cycle": "yearly" }, "crosswalk": { "cr26_ksi": [ "KSI-IAM-ELP" ], "fiscam": "AC, SD" }, "criticality": "major", "result_rule": "auditor", "ig_subscore": true, "status": "draft" }, { "id": "KAI-DPP-ENC", "theme": "KAI-DPP", "name": "Data encrypted at rest and in transit with validated modules", "authority": [ { "tracker_id": "eo-14028" }, { "tracker_id": "nist-fips-140-3" } ], "evidence": { "tiers": [ "P3" ], "description": "P3 OMB report and IG", "expected_access": "public" }, "validation": { "methods": [ "analyst" ], "cycle": "yearly" }, "crosswalk": { "cr26_ksi": [ "KSI-SVC-SIN" ], "fiscam": "AC" }, "criticality": "major", "result_rule": "auditor", "ig_subscore": false, "status": "draft" }, { "id": "KAI-DPP-CUI", "theme": "KAI-DPP", "name": "CUI program in place and reported to ISOO each year", "authority": [ { "tracker_id": "cfr-32-2002" }, { "tracker_id": "eo-13556" }, { "tracker_id": "nara-isoo-notice-2026-07" }, { "tracker_id": "nara-isoo-notice-2026-08" } ], "evidence": { "tiers": [ "P3", "F" ], "description": "P3 ISOO annual report, F", "expected_access": "foia_releasable" }, "validation": { "methods": [ "analyst" ], "cycle": "yearly" }, "crosswalk": { "cr26_ksi": [ "KSI-SVC-SIN" ], "fiscam": "AC" }, "criticality": "major", "result_rule": "any_failure", "ig_subscore": false, "status": "draft" }, { "id": "KAI-DPP-BRE", "theme": "KAI-DPP", "name": "Breach response plan exists and is tested", "authority": [ { "tracker_id": "omb-m-17-12" } ], "evidence": { "tiers": [ "F" ], "description": "F, usually released", "expected_access": "foia_releasable" }, "validation": { "methods": [ "analyst" ], "cycle": null }, "crosswalk": { "cr26_ksi": [ "KSI-INR-RIR" ], "fiscam": "SM" }, "criticality": "major", "result_rule": "any_failure", "ig_subscore": false, "status": "draft" }, { "id": "KAI-TRN-AWR", "theme": "KAI-TRN", "name": "All users trained each year", "authority": [ { "tracker_id": "cfr-5-930" }, { "tracker_id": "law-113-283" } ], "evidence": { "tiers": [ "P3" ], "description": "P3 IG", "expected_access": "public" }, "validation": { "methods": [ "analyst" ], "cycle": "yearly" }, "crosswalk": { "cr26_ksi": [ "KSI-CED-RAT" ], "fiscam": "SM" }, "criticality": "major", "result_rule": "auditor", "ig_subscore": true, "status": "draft" }, { "id": "KAI-TRN-RBT", "theme": "KAI-TRN", "name": "Staff with security duties get role-based training", "authority": [ { "tracker_id": "cfr-5-930" } ], "evidence": { "tiers": [ "P3", "F" ], "description": "P3 IG, F", "expected_access": "foia_releasable" }, "validation": { "methods": [ "analyst" ], "cycle": "yearly" }, "crosswalk": { "cr26_ksi": [ "KSI-CED-RAT" ], "fiscam": "SM" }, "criticality": "major", "result_rule": "auditor", "ig_subscore": false, "status": "draft" }, { "id": "KAI-MON-LOG", "theme": "KAI-MON", "name": "Logging maturity meets the current memo", "authority": [ { "tracker_id": "omb-m-26-14" } ], "evidence": { "tiers": [ "P3", "F" ], "description": "P3 IG, F maturity report, likely withheld", "expected_access": "likely_withheld" }, "validation": { "methods": [ "analyst" ], "cycle": null }, "crosswalk": { "cr26_ksi": [ "KSI-MLA-LET" ], "fiscam": "SM" }, "criticality": "major", "result_rule": "auditor", "ig_subscore": false, "status": "draft" }, { "id": "KAI-MON-EDR", "theme": "KAI-MON", "name": "Endpoint detection deployed with CISA access", "authority": [ { "tracker_id": "omb-m-22-01" } ], "evidence": { "tiers": [ "P3" ], "description": "P3 IG and OMB report", "expected_access": "public" }, "validation": { "methods": [ "analyst" ], "cycle": "yearly" }, "crosswalk": { "cr26_ksi": [ "KSI-MLA-OSM" ], "fiscam": "SM" }, "criticality": "major", "result_rule": "auditor", "ig_subscore": false, "status": "draft" }, { "id": "KAI-MON-ISC", "theme": "KAI-MON", "name": "Continuous monitoring program", "authority": [ { "tracker_id": "law-113-283" } ], "evidence": { "tiers": [ "P3" ], "description": "P3 IG", "expected_access": "public" }, "validation": { "methods": [ "analyst" ], "cycle": "yearly" }, "crosswalk": { "cr26_ksi": [ "KSI-MLA-OSM" ], "fiscam": "SM" }, "criticality": "major", "result_rule": "auditor", "ig_subscore": true, "status": "draft" }, { "id": "KAI-INR-RPT", "theme": "KAI-INR", "name": "Incidents reported to CISA and counted in OMB's report", "authority": [ { "tracker_id": "cisa-federal-incident-notification-guidelines" }, { "tracker_id": "law-113-283" } ], "evidence": { "tiers": [ "P3" ], "description": "P3 OMB report", "expected_access": "public" }, "validation": { "methods": [ "analyst" ], "cycle": "yearly" }, "crosswalk": { "cr26_ksi": [], "fiscam": "SM" }, "criticality": "major", "result_rule": "any_failure", "ig_subscore": false, "status": "draft" }, { "id": "KAI-INR-MAJ", "theme": "KAI-INR", "name": "Publicly known major incidents were reported to Congress", "authority": [ { "tracker_id": "law-113-283" }, { "tracker_id": "omb-m-25-04" } ], "evidence": { "tiers": [ "P3", "F" ], "description": "P3, F notification letter", "expected_access": "foia_releasable" }, "validation": { "methods": [ "analyst" ], "cycle": "per incident" }, "crosswalk": { "cr26_ksi": [], "fiscam": "SM" }, "criticality": "major", "result_rule": "any_failure", "ig_subscore": false, "status": "draft" }, { "id": "KAI-INR-EMD", "theme": "KAI-INR", "name": "Emergency directive actions completed on time", "authority": [ { "tracker_id": "cisa-ed-24-01" }, { "tracker_id": "cisa-ed-25-02" }, { "tracker_id": "cisa-ed-25-03" }, { "tracker_id": "cisa-ed-26-01" }, { "tracker_id": "cisa-ed-26-03" } ], "evidence": { "tiers": [ "P3", "F" ], "description": "P3 CISA and IG, F likely withheld", "expected_access": "likely_withheld" }, "validation": { "methods": [ "analyst" ], "cycle": null }, "crosswalk": { "cr26_ksi": [ "KSI-INR-RIR" ], "fiscam": "CM" }, "criticality": "major", "result_rule": "auditor", "ig_subscore": false, "status": "draft" }, { "id": "KAI-RPL-TST", "theme": "KAI-RPL", "name": "Contingency plans tested", "authority": [ { "tracker_id": "law-113-283" } ], "evidence": { "tiers": [ "P3" ], "description": "P3 IG", "expected_access": "public" }, "validation": { "methods": [ "analyst" ], "cycle": "yearly" }, "crosswalk": { "cr26_ksi": [ "KSI-RPL-TRC" ], "fiscam": "CP" }, "criticality": "major", "result_rule": "auditor", "ig_subscore": true, "status": "draft" }, { "id": "KAI-EXP-EML", "theme": "KAI-EXP", "name": "Email domains reject spoofed mail; non-mail domains publish a null policy", "authority": [ { "tracker_id": "cisa-bod-18-01" } ], "evidence": { "tiers": [ "P1", "P2" ], "description": "P2 .gov list (federal executive), P1 DNS", "expected_access": "public" }, "validation": { "methods": [ "machine" ], "cycle": "7 days" }, "crosswalk": { "cr26_ksi": [ "KSI-SVC-VCM" ], "fiscam": "CM" }, "criticality": "major", "result_rule": "share", "ig_subscore": false, "status": "draft" }, { "id": "KAI-EXP-WEB", "theme": "KAI-EXP", "name": "Public websites redirect to HTTPS and send HSTS", "authority": [ { "tracker_id": "cisa-bod-18-01" }, { "tracker_id": "omb-m-15-13" }, { "tracker_id": "omb-m-23-22" } ], "evidence": { "tiers": [ "P1" ], "description": "P1 one ordinary request", "expected_access": "public" }, "validation": { "methods": [ "machine" ], "cycle": "7 days" }, "crosswalk": { "cr26_ksi": [ "KSI-SVC-VCM" ], "fiscam": "CM" }, "criticality": "major", "result_rule": "share", "ig_subscore": false, "status": "draft" }, { "id": "KAI-EXP-DNS", "theme": "KAI-EXP", "name": "Agency domains are signed with DNSSEC (SHOULD; the 2008 memo was rescinded in 2018)", "authority": [ { "tracker_id": "nist-fips-200", "note": "SP 800-53 SC-20" } ], "evidence": { "tiers": [ "P1" ], "description": "P1 DNS", "expected_access": "public" }, "validation": { "methods": [ "machine" ], "cycle": "7 days" }, "crosswalk": { "cr26_ksi": [ "KSI-CNA-MAT" ], "fiscam": "CM" }, "criticality": "major", "result_rule": "share", "ig_subscore": false, "status": "draft" }, { "id": "KAI-EXP-VDP", "theme": "KAI-EXP", "name": "Vulnerability disclosure policy published, scoped to all domains, with a registered security contact", "authority": [ { "tracker_id": "cisa-bod-20-01" }, { "tracker_id": "omb-m-20-32" } ], "evidence": { "tiers": [ "P1", "P2" ], "description": "P1, P2 .gov list", "expected_access": "public" }, "validation": { "methods": [ "machine", "analyst" ], "cycle": "30 days" }, "crosswalk": { "cr26_ksi": [ "KSI-PIY-RVD" ], "fiscam": "SM" }, "criticality": "major", "result_rule": "any_failure", "ig_subscore": false, "status": "draft" }, { "id": "KAI-EXP-EDG", "theme": "KAI-EXP", "name": "Edge devices and management interfaces secured, as found by IG and GAO", "authority": [ { "tracker_id": "cisa-bod-23-02" }, { "tracker_id": "cisa-bod-26-02" } ], "evidence": { "tiers": [ "P3" ], "description": "P3 IG and GAO reports only", "expected_access": "public" }, "validation": { "methods": [ "analyst" ], "cycle": "yearly" }, "crosswalk": { "cr26_ksi": [ "KSI-CNA-MAT" ], "fiscam": "CM" }, "criticality": "major", "result_rule": "auditor", "ig_subscore": false, "status": "draft" }, { "id": "KAI-EXP-GOV", "theme": "KAI-EXP", "name": "Official websites and email use .gov domains", "authority": [ { "tracker_id": "law-116-260-div-u-title-ix" }, { "tracker_id": "omb-m-23-10" } ], "evidence": { "tiers": [ "P1", "P2" ], "description": "P2 .gov list, P1 agency site list", "expected_access": "public" }, "validation": { "methods": [ "analyst" ], "cycle": "90 days" }, "crosswalk": { "cr26_ksi": [], "fiscam": null }, "criticality": "major", "result_rule": "share", "ig_subscore": false, "status": "draft" }, { "id": "KAI-EXP-IP6", "theme": "KAI-EXP", "name": "Public websites reachable over IPv6", "authority": [ { "tracker_id": "omb-m-21-07" } ], "evidence": { "tiers": [ "P1" ], "description": "P1 DNS", "expected_access": "public" }, "validation": { "methods": [ "machine" ], "cycle": "30 days" }, "crosswalk": { "cr26_ksi": [], "fiscam": "CM" }, "criticality": "major", "result_rule": "share", "ig_subscore": false, "status": "draft" }, { "id": "KAI-EXP-TLS", "theme": "KAI-EXP", "name": "Public websites negotiate TLS 1.3 (trend only before the 2030 deadline)", "authority": [ { "tracker_id": "omb-m-26-15" } ], "evidence": { "tiers": [ "P1" ], "description": "P1 ordinary connection", "expected_access": "public" }, "validation": { "methods": [ "machine" ], "cycle": "30 days" }, "crosswalk": { "cr26_ksi": [ "KSI-SVC-SIN" ], "fiscam": "CM" }, "criticality": "major", "result_rule": "share", "ig_subscore": false, "status": "draft" }, { "id": "KAI-EXP-3PT", "theme": "KAI-EXP", "name": "Third-party trackers and assets match what the privacy policy discloses", "authority": [ { "tracker_id": "omb-m-23-22" }, { "tracker_id": "omb-m-10-22" } ], "evidence": { "tiers": [ "P1" ], "description": "P1 page source", "expected_access": "public" }, "validation": { "methods": [ "machine" ], "cycle": "30 days" }, "crosswalk": { "cr26_ksi": [ "KSI-CNA-MAT" ], "fiscam": "CM" }, "criticality": "major", "result_rule": "share", "ig_subscore": false, "status": "draft" }, { "id": "KAI-PRV-SRN", "theme": "KAI-PRV", "name": "SORNs and PIAs describe the same records, and SORNs are reviewed", "authority": [ { "tracker_id": "law-93-579" }, { "tracker_id": "omb-a-108-2016" } ], "evidence": { "tiers": [ "P2", "P3" ], "description": "P2 Federal Register, P3 PIAs", "expected_access": "public" }, "validation": { "methods": [ "machine", "analyst" ], "cycle": "30 days" }, "crosswalk": { "cr26_ksi": [], "fiscam": null }, "criticality": "major", "result_rule": "any_failure", "ig_subscore": false, "status": "draft" }, { "id": "KAI-PRV-SRC", "theme": "KAI-PRV", "name": "New and changed SORNs allow 30 days for comment before taking effect", "authority": [ { "tracker_id": "omb-a-108-2016" } ], "evidence": { "tiers": [ "P2" ], "description": "P2 Federal Register dates", "expected_access": "public" }, "validation": { "methods": [ "machine" ], "cycle": "7 days" }, "crosswalk": { "cr26_ksi": [], "fiscam": null }, "criticality": "major", "result_rule": "any_failure", "ig_subscore": false, "status": "draft" }, { "id": "KAI-PRV-PIA", "theme": "KAI-PRV", "name": "A PIA exists for each system with a SORN", "authority": [ { "tracker_id": "law-107-347" }, { "tracker_id": "omb-m-03-22" } ], "evidence": { "tiers": [ "P2", "P3" ], "description": "P2, P3", "expected_access": "public" }, "validation": { "methods": [ "machine", "analyst" ], "cycle": "90 days" }, "crosswalk": { "cr26_ksi": [], "fiscam": null }, "criticality": "major", "result_rule": "any_failure", "ig_subscore": false, "status": "draft" }, { "id": "KAI-PRV-EXR", "theme": "KAI-PRV", "name": "Every Privacy Act exemption claimed has a final rule", "authority": [ { "tracker_id": "law-93-579" } ], "evidence": { "tiers": [ "P2" ], "description": "P2 eCFR, Federal Register", "expected_access": "public" }, "validation": { "methods": [ "machine", "analyst" ], "cycle": "90 days" }, "crosswalk": { "cr26_ksi": [], "fiscam": null }, "criticality": "major", "result_rule": "any_failure", "ig_subscore": false, "status": "draft" }, { "id": "KAI-PRV-CMA", "theme": "KAI-PRV", "name": "Matching programs have published notices, or the agency states it has none", "authority": [ { "tracker_id": "law-100-503" } ], "evidence": { "tiers": [ "P1", "P2" ], "description": "P2 Federal Register, P1", "expected_access": "public" }, "validation": { "methods": [ "machine" ], "cycle": "30 days" }, "crosswalk": { "cr26_ksi": [], "fiscam": null }, "criticality": "major", "result_rule": "any_failure", "ig_subscore": false, "status": "draft" }, { "id": "KAI-PRV-SAO", "theme": "KAI-PRV", "name": "Senior privacy official designated; privacy program page live", "authority": [ { "tracker_id": "omb-m-16-24" }, { "tracker_id": "eo-13719" } ], "evidence": { "tiers": [ "P1", "P3" ], "description": "P1, P3", "expected_access": "public" }, "validation": { "methods": [ "machine", "analyst" ], "cycle": "90 days" }, "crosswalk": { "cr26_ksi": [ "KSI-PIY-RES" ], "fiscam": "SM" }, "criticality": "major", "result_rule": "any_failure", "ig_subscore": false, "status": "draft" }, { "id": "KAI-PRV-WEB", "theme": "KAI-PRV", "name": "Website privacy policies contain the required elements", "authority": [ { "tracker_id": "omb-m-23-22" }, { "tracker_id": "omb-m-03-22" }, { "tracker_id": "law-107-347" } ], "evidence": { "tiers": [ "P1" ], "description": "P1", "expected_access": "public" }, "validation": { "methods": [ "machine" ], "cycle": "30 days" }, "crosswalk": { "cr26_ksi": [], "fiscam": null }, "criticality": "major", "result_rule": "share", "ig_subscore": false, "status": "draft" }, { "id": "KAI-PRV-EPA", "theme": "KAI-PRV", "name": "Privacy Act requests and consent accepted electronically", "authority": [ { "tracker_id": "omb-m-21-04" } ], "evidence": { "tiers": [ "P1" ], "description": "P1", "expected_access": "public" }, "validation": { "methods": [ "analyst" ], "cycle": "90 days" }, "crosswalk": { "cr26_ksi": [], "fiscam": null }, "criticality": "major", "result_rule": "any_failure", "ig_subscore": false, "status": "draft" }, { "id": "KAI-PRV-ICR", "theme": "KAI-PRV", "name": "No information collections running on expired OMB approvals", "authority": [ { "tracker_id": "law-104-13" } ], "evidence": { "tiers": [ "P2" ], "description": "P2 reginfo.gov", "expected_access": "public" }, "validation": { "methods": [ "machine" ], "cycle": "7 days" }, "crosswalk": { "cr26_ksi": [], "fiscam": null }, "criticality": "major", "result_rule": "any_failure", "ig_subscore": false, "status": "draft" }, { "id": "KAI-PRV-FRM", "theme": "KAI-PRV", "name": "Sampled public forms display a valid OMB control number", "authority": [ { "tracker_id": "law-104-13" } ], "evidence": { "tiers": [ "P1" ], "description": "P1 sample", "expected_access": "public" }, "validation": { "methods": [ "analyst" ], "cycle": "quarterly" }, "crosswalk": { "cr26_ksi": [], "fiscam": null }, "criticality": "major", "result_rule": "share", "ig_subscore": false, "status": "draft" }, { "id": "KAI-FIN-AUD", "theme": "KAI-FIN", "name": "Auditor reports no IT material weakness; significant deficiencies tracked separately", "authority": [ { "citation": "Chief Financial Officers Act", "note": "Not in the FedXchange tracker" } ], "evidence": { "tiers": [ "P3" ], "description": "P3 auditor report", "expected_access": "public" }, "validation": { "methods": [ "analyst" ], "cycle": "yearly" }, "crosswalk": { "cr26_ksi": [], "fiscam": "All general, BP" }, "criticality": "major", "result_rule": "auditor", "ig_subscore": false, "status": "draft" }, { "id": "KAI-FIN-FFM", "theme": "KAI-FIN", "name": "Auditor finds substantial compliance with FFMIA", "authority": [ { "citation": "FFMIA", "note": "Not in the FedXchange tracker" } ], "evidence": { "tiers": [ "P3" ], "description": "P3 auditor report", "expected_access": "public" }, "validation": { "methods": [ "analyst" ], "cycle": "yearly" }, "crosswalk": { "cr26_ksi": [], "fiscam": "All general" }, "criticality": "major", "result_rule": "auditor", "ig_subscore": false, "status": "draft" }, { "id": "KAI-FIN-SOA", "theme": "KAI-FIN", "name": "The agency head's assurance statement matches the auditor's IT findings", "authority": [ { "tracker_id": "omb-a-123-2026" } ], "evidence": { "tiers": [ "P3" ], "description": "P3 agency financial report", "expected_access": "public" }, "validation": { "methods": [ "analyst" ], "cycle": "yearly" }, "crosswalk": { "cr26_ksi": [ "KSI-PIY-RES" ], "fiscam": "SM" }, "criticality": "major", "result_rule": "any_failure", "ig_subscore": false, "status": "draft" }, { "id": "KAI-FIN-PII", "theme": "KAI-FIN", "name": "IG finds the agency compliant with the payment integrity law", "authority": [ { "citation": "PIIA", "note": "Not in the FedXchange tracker" } ], "evidence": { "tiers": [ "P2", "P3" ], "description": "P3 IG report, P2 paymentaccuracy.gov", "expected_access": "public" }, "validation": { "methods": [ "analyst" ], "cycle": "yearly" }, "crosswalk": { "cr26_ksi": [], "fiscam": "BP" }, "criticality": "major", "result_rule": "auditor", "ig_subscore": false, "status": "draft" }, { "id": "KAI-FIN-DAT", "theme": "KAI-FIN", "name": "Spending data submitted on time; IG rates its quality", "authority": [ { "tracker_id": "law-113-101" } ], "evidence": { "tiers": [ "P2", "P3" ], "description": "P2 USAspending, P3 IG audit", "expected_access": "public" }, "validation": { "methods": [ "analyst" ], "cycle": "quarterly" }, "crosswalk": { "cr26_ksi": [], "fiscam": "BP" }, "criticality": "major", "result_rule": "auditor", "ig_subscore": false, "status": "draft" }, { "id": "KAI-ITM-CIO", "theme": "KAI-ITM", "name": "CIO reports to the agency head and approves IT contracts", "authority": [ { "tracker_id": "law-104-106-div-e" }, { "tracker_id": "law-113-291-title-viii-subtitle-d" }, { "tracker_id": "eo-13833" }, { "tracker_id": "omb-m-15-14" }, { "tracker_id": "omb-m-26-10" } ], "evidence": { "tiers": [ "P1", "F" ], "description": "P1 org chart, F monthly CIO reports", "expected_access": "foia_releasable" }, "validation": { "methods": [ "analyst" ], "cycle": "twice a year" }, "crosswalk": { "cr26_ksi": [ "KSI-PIY-RIS" ], "fiscam": "SM" }, "criticality": "major", "result_rule": "any_failure", "ig_subscore": false, "status": "draft" }, { "id": "KAI-ITM-MBY", "theme": "KAI-ITM", "name": "Software license inventory maintained and used", "authority": [ { "tracker_id": "law-114-210" }, { "tracker_id": "omb-m-16-12" }, { "tracker_id": "eo-13103" } ], "evidence": { "tiers": [ "P3", "F" ], "description": "P3 GAO and IG, F inventory", "expected_access": "foia_releasable" }, "validation": { "methods": [ "analyst" ], "cycle": "yearly" }, "crosswalk": { "cr26_ksi": [ "KSI-PIY-GIV" ], "fiscam": "CM" }, "criticality": "major", "result_rule": "auditor", "ig_subscore": false, "status": "draft" }, { "id": "KAI-ITM-SRC", "theme": "KAI-ITM", "name": "Custom source code inventory published", "authority": [ { "tracker_id": "omb-m-16-21" } ], "evidence": { "tiers": [ "P1" ], "description": "P1 code.json", "expected_access": "public" }, "validation": { "methods": [ "machine" ], "cycle": "30 days" }, "crosswalk": { "cr26_ksi": [], "fiscam": null }, "criticality": "major", "result_rule": "any_failure", "ig_subscore": false, "status": "draft" }, { "id": "KAI-AIG-INV", "theme": "KAI-AIG", "name": "AI use-case inventory published at the agency's /ai page", "authority": [ { "tracker_id": "law-117-263-title-lxxii-subtitle-b" }, { "tracker_id": "eo-13960" }, { "tracker_id": "omb-m-25-21" } ], "evidence": { "tiers": [ "P1", "P2" ], "description": "P1, P2", "expected_access": "public" }, "validation": { "methods": [ "machine" ], "cycle": "30 days" }, "crosswalk": { "cr26_ksi": [], "fiscam": null }, "criticality": "major", "result_rule": "any_failure", "ig_subscore": false, "status": "draft" }, { "id": "KAI-AIG-CMP", "theme": "KAI-AIG", "name": "Chief AI Officer named; compliance plan and strategy published where required", "authority": [ { "tracker_id": "omb-m-25-21" } ], "evidence": { "tiers": [ "P1" ], "description": "P1", "expected_access": "public" }, "validation": { "methods": [ "analyst" ], "cycle": "yearly" }, "crosswalk": { "cr26_ksi": [ "KSI-PIY-RES" ], "fiscam": "SM" }, "criticality": "major", "result_rule": "any_failure", "ig_subscore": false, "status": "draft" }, { "id": "KAI-AIG-WVR", "theme": "KAI-AIG", "name": "High-impact AI waivers and practice summaries published", "authority": [ { "tracker_id": "omb-m-25-21" } ], "evidence": { "tiers": [ "P1" ], "description": "P1", "expected_access": "public" }, "validation": { "methods": [ "machine" ], "cycle": "30 days" }, "crosswalk": { "cr26_ksi": [], "fiscam": null }, "criticality": "major", "result_rule": "any_failure", "ig_subscore": false, "status": "draft" }, { "id": "KAI-AIG-ACQ", "theme": "KAI-AIG", "name": "AI contracts protect government data from vendor training use", "authority": [ { "tracker_id": "omb-m-25-22" } ], "evidence": { "tiers": [ "F" ], "description": "F sample contracts", "expected_access": "foia_releasable" }, "validation": { "methods": [ "analyst" ], "cycle": "yearly" }, "crosswalk": { "cr26_ksi": [ "KSI-SCR-MIT" ], "fiscam": "SM" }, "criticality": "major", "result_rule": "share", "ig_subscore": false, "status": "draft" }, { "id": "KAI-DIG-IDA", "theme": "KAI-DIG", "name": "Public websites are accessible, searchable, mobile-friendly and use the federal design system", "authority": [ { "tracker_id": "law-115-336" }, { "tracker_id": "omb-m-23-22" } ], "evidence": { "tiers": [ "P1" ], "description": "P1 page source", "expected_access": "public" }, "validation": { "methods": [ "machine" ], "cycle": "30 days" }, "crosswalk": { "cr26_ksi": [], "fiscam": null }, "criticality": "major", "result_rule": "share", "ig_subscore": false, "status": "draft" }, { "id": "KAI-DIG-REQ", "theme": "KAI-DIG", "name": "The main website shows required links (about, FOIA, accessibility, privacy, disclosure policy, No FEAR)", "authority": [ { "tracker_id": "omb-m-23-22" } ], "evidence": { "tiers": [ "P1" ], "description": "P1", "expected_access": "public" }, "validation": { "methods": [ "machine" ], "cycle": "30 days" }, "crosswalk": { "cr26_ksi": [], "fiscam": null }, "criticality": "major", "result_rule": "any_failure", "ig_subscore": false, "status": "draft" }, { "id": "KAI-DIG-DAP", "theme": "KAI-DIG", "name": "Public websites run the federal Digital Analytics Program", "authority": [ { "tracker_id": "omb-m-23-22" } ], "evidence": { "tiers": [ "P1" ], "description": "P1 page source", "expected_access": "public" }, "validation": { "methods": [ "machine" ], "cycle": "30 days" }, "crosswalk": { "cr26_ksi": [], "fiscam": null }, "criticality": "major", "result_rule": "share", "ig_subscore": false, "status": "draft" }, { "id": "KAI-DIG-CRW", "theme": "KAI-DIG", "name": "Public content is open to search engines and archives", "authority": [ { "tracker_id": "omb-m-23-22" } ], "evidence": { "tiers": [ "P1" ], "description": "P1 robots.txt and sitemap", "expected_access": "public" }, "validation": { "methods": [ "machine" ], "cycle": "30 days" }, "crosswalk": { "cr26_ksi": [], "fiscam": null }, "criticality": "major", "result_rule": "share", "ig_subscore": false, "status": "draft" }, { "id": "KAI-DIG-508", "theme": "KAI-DIG", "name": "Section 508 program maturity and website conformance", "authority": [ { "tracker_id": "law-105-220-sec-408" }, { "tracker_id": "cfr-36-1194" }, { "tracker_id": "omb-m-24-08" } ], "evidence": { "tiers": [ "P2" ], "description": "P2 section508.gov assessment", "expected_access": "public" }, "validation": { "methods": [ "analyst" ], "cycle": "yearly" }, "crosswalk": { "cr26_ksi": [], "fiscam": null }, "criticality": "major", "result_rule": "share", "ig_subscore": false, "status": "draft" }, { "id": "KAI-DIG-ELC", "theme": "KAI-DIG", "name": "Forms and services offered digitally", "authority": [ { "tracker_id": "law-105-277-div-c-title-xvii" }, { "tracker_id": "law-115-336" }, { "tracker_id": "omb-m-00-10" } ], "evidence": { "tiers": [ "P1" ], "description": "P1 sample", "expected_access": "public" }, "validation": { "methods": [ "analyst" ], "cycle": "yearly" }, "crosswalk": { "cr26_ksi": [], "fiscam": null }, "criticality": "major", "result_rule": "share", "ig_subscore": false, "status": "draft" }, { "id": "KAI-DIG-AGV", "theme": "KAI-DIG", "name": "Covered services connected to America.gov (not yet due)", "authority": [ { "tracker_id": "eo-14432" } ], "evidence": { "tiers": [ "P1" ], "description": "P1", "expected_access": "public" }, "validation": { "methods": [ "analyst" ], "cycle": "90 days" }, "crosswalk": { "cr26_ksi": [], "fiscam": null }, "criticality": "major", "result_rule": "any_failure", "ig_subscore": false, "status": "draft" }, { "id": "KAI-DIG-PLW", "theme": "KAI-DIG", "name": "Plain writing compliance report posted", "authority": [ { "citation": "Plain Writing Act", "note": "Not in the FedXchange tracker" } ], "evidence": { "tiers": [ "P1" ], "description": "P1", "expected_access": "public" }, "validation": { "methods": [ "analyst" ], "cycle": "yearly" }, "crosswalk": { "cr26_ksi": [], "fiscam": null }, "criticality": "major", "result_rule": "any_failure", "ig_subscore": false, "status": "draft" }, { "id": "KAI-TRP-FAR", "theme": "KAI-TRP", "name": "FOIA annual report filed on time with complete data", "authority": [ { "tracker_id": "law-89-487" }, { "tracker_id": "law-110-175" }, { "tracker_id": "law-114-185" } ], "evidence": { "tiers": [ "P2" ], "description": "P2 FOIA.gov", "expected_access": "public" }, "validation": { "methods": [ "analyst" ], "cycle": "yearly" }, "crosswalk": { "cr26_ksi": [], "fiscam": null }, "criticality": "major", "result_rule": "any_failure", "ig_subscore": false, "status": "draft" }, { "id": "KAI-TRP-BKL", "theme": "KAI-TRP", "name": "FOIA backlog and processing times improving (excluding CFA's own requests)", "authority": [ { "tracker_id": "law-89-487" }, { "tracker_id": "law-110-175" } ], "evidence": { "tiers": [ "P2" ], "description": "P2 FOIA.gov", "expected_access": "public" }, "validation": { "methods": [ "analyst" ], "cycle": "yearly" }, "crosswalk": { "cr26_ksi": [], "fiscam": null }, "criticality": "major", "result_rule": "share", "ig_subscore": false, "status": "draft" }, { "id": "KAI-TRP-CFR", "theme": "KAI-TRP", "name": "Chief FOIA Officer report published", "authority": [ { "tracker_id": "law-110-175" }, { "tracker_id": "law-114-185" } ], "evidence": { "tiers": [ "P3" ], "description": "P3 Justice Department site", "expected_access": "public" }, "validation": { "methods": [ "analyst" ], "cycle": "yearly" }, "crosswalk": { "cr26_ksi": [], "fiscam": null }, "criticality": "major", "result_rule": "any_failure", "ig_subscore": false, "status": "draft" }, { "id": "KAI-TRP-RRM", "theme": "KAI-TRP", "name": "FOIA reading room posts frequently requested records", "authority": [ { "tracker_id": "law-114-185" } ], "evidence": { "tiers": [ "P1" ], "description": "P1 agency FOIA page", "expected_access": "public" }, "validation": { "methods": [ "analyst" ], "cycle": "90 days" }, "crosswalk": { "cr26_ksi": [], "fiscam": null }, "criticality": "major", "result_rule": "any_failure", "ig_subscore": false, "status": "draft" }, { "id": "KAI-TRP-REG", "theme": "KAI-TRP", "name": "FOIA regulations updated for the 2016 amendments", "authority": [ { "tracker_id": "law-114-185" } ], "evidence": { "tiers": [ "P2" ], "description": "P2 eCFR", "expected_access": "public" }, "validation": { "methods": [ "machine" ], "cycle": "yearly" }, "crosswalk": { "cr26_ksi": [], "fiscam": null }, "criticality": "major", "result_rule": "any_failure", "ig_subscore": false, "status": "draft" }, { "id": "KAI-TRP-OPN", "theme": "KAI-TRP", "name": "Open government page maintained", "authority": [ { "tracker_id": "omb-m-10-06" } ], "evidence": { "tiers": [ "P1" ], "description": "P1 /open", "expected_access": "public" }, "validation": { "methods": [ "machine" ], "cycle": "30 days" }, "crosswalk": { "cr26_ksi": [], "fiscam": null }, "criticality": "major", "result_rule": "any_failure", "ig_subscore": false, "status": "draft" }, { "id": "KAI-TRP-ODP", "theme": "KAI-TRP", "name": "Data inventory and open data plan published", "authority": [ { "tracker_id": "law-115-435" }, { "tracker_id": "omb-m-25-05" }, { "tracker_id": "eo-13642" } ], "evidence": { "tiers": [ "P1", "P2" ], "description": "P1 /data.json, P2 catalog.data.gov", "expected_access": "public" }, "validation": { "methods": [ "machine" ], "cycle": "30 days" }, "crosswalk": { "cr26_ksi": [ "KSI-PIY-GIV" ], "fiscam": null }, "criticality": "major", "result_rule": "any_failure", "ig_subscore": false, "status": "draft" }, { "id": "KAI-TRP-EVA", "theme": "KAI-TRP", "name": "Chief Data Officer, learning agenda and evaluation plan posted", "authority": [ { "tracker_id": "law-115-435" } ], "evidence": { "tiers": [ "P1" ], "description": "P1 /data and /evaluation pages", "expected_access": "public" }, "validation": { "methods": [ "machine", "analyst" ], "cycle": "yearly" }, "crosswalk": { "cr26_ksi": [], "fiscam": null }, "criticality": "major", "result_rule": "any_failure", "ig_subscore": false, "status": "draft" }, { "id": "KAI-TRP-PRF", "theme": "KAI-TRP", "name": "Strategic plan and annual performance plan and report posted", "authority": [ { "citation": "GPRA Modernization Act", "note": "Not in the FedXchange tracker" } ], "evidence": { "tiers": [ "P1", "P2" ], "description": "P1, P2 Performance.gov", "expected_access": "public" }, "validation": { "methods": [ "analyst" ], "cycle": "yearly" }, "crosswalk": { "cr26_ksi": [], "fiscam": null }, "criticality": "major", "result_rule": "any_failure", "ig_subscore": false, "status": "draft" }, { "id": "KAI-REC-SAO", "theme": "KAI-REC", "name": "Senior records official's annual report filed with NARA", "authority": [ { "tracker_id": "cfr-36-1220" }, { "tracker_id": "law-113-187" } ], "evidence": { "tiers": [ "P3" ], "description": "P3 archives.gov reports", "expected_access": "public" }, "validation": { "methods": [ "analyst" ], "cycle": "yearly" }, "crosswalk": { "cr26_ksi": [], "fiscam": null }, "criticality": "major", "result_rule": "any_failure", "ig_subscore": false, "status": "draft" }, { "id": "KAI-REC-ELR", "theme": "KAI-REC", "name": "Permanent records and email managed electronically", "authority": [ { "tracker_id": "cfr-36-1220" }, { "tracker_id": "omb-m-19-21" }, { "tracker_id": "omb-m-23-07" } ], "evidence": { "tiers": [ "P3" ], "description": "P3 NARA self-assessment results", "expected_access": "public" }, "validation": { "methods": [ "analyst" ], "cycle": "yearly" }, "crosswalk": { "cr26_ksi": [], "fiscam": null }, "criticality": "major", "result_rule": "any_failure", "ig_subscore": false, "status": "draft" }, { "id": "KAI-REC-SCH", "theme": "KAI-REC", "name": "Records schedules approved, including email", "authority": [ { "tracker_id": "cfr-36-1220" }, { "tracker_id": "law-113-187" }, { "tracker_id": "omb-m-23-07" } ], "evidence": { "tiers": [ "P2" ], "description": "P2 NARA schedule repository", "expected_access": "public" }, "validation": { "methods": [ "analyst" ], "cycle": "yearly" }, "crosswalk": { "cr26_ksi": [ "KSI-PIY-GIV" ], "fiscam": null }, "criticality": "major", "result_rule": "any_failure", "ig_subscore": false, "status": "draft" }, { "id": "KAI-REC-UDR", "theme": "KAI-REC", "name": "Unauthorized destruction cases reported to NARA and closed", "authority": [ { "tracker_id": "cfr-36-1220" }, { "tracker_id": "law-113-187" } ], "evidence": { "tiers": [ "P2" ], "description": "P2 NARA case lists", "expected_access": "public" }, "validation": { "methods": [ "machine" ], "cycle": "30 days" }, "crosswalk": { "cr26_ksi": [], "fiscam": null }, "criticality": "major", "result_rule": "share", "ig_subscore": false, "status": "draft" }, { "id": "KAI-REC-MSG", "theme": "KAI-REC", "name": "Official business on personal messaging accounts is copied to official records", "authority": [ { "tracker_id": "law-113-187" } ], "evidence": { "tiers": [ "P3", "F" ], "description": "P3 IG, F", "expected_access": "foia_releasable" }, "validation": { "methods": [ "analyst" ], "cycle": null }, "crosswalk": { "cr26_ksi": [], "fiscam": null }, "criticality": "major", "result_rule": "auditor", "ig_subscore": false, "status": "draft" }, { "id": "KAI-OVR-IGO", "theme": "KAI-OVR", "name": "IG open recommendations on IT and security closed by agreed dates", "authority": [ { "citation": "Inspector General Act", "note": "Not in the FedXchange tracker" } ], "evidence": { "tiers": [ "P2", "P3" ], "description": "P2 Oversight.gov, P3 semiannual reports", "expected_access": "public" }, "validation": { "methods": [ "analyst" ], "cycle": "90 days" }, "crosswalk": { "cr26_ksi": [ "KSI-PIY-RES" ], "fiscam": "SM" }, "criticality": "major", "result_rule": "share", "ig_subscore": false, "status": "draft" }, { "id": "KAI-OVR-GAO", "theme": "KAI-OVR", "name": "GAO priority recommendations implemented", "authority": [ { "citation": "GAO priority letters", "note": "Not in the FedXchange tracker" } ], "evidence": { "tiers": [ "P3" ], "description": "P3 GAO recommendation database", "expected_access": "public" }, "validation": { "methods": [ "analyst" ], "cycle": "yearly" }, "crosswalk": { "cr26_ksi": [ "KSI-PIY-RES" ], "fiscam": "SM" }, "criticality": "major", "result_rule": "share", "ig_subscore": false, "status": "draft" }, { "id": "KAI-AUT-SRN", "theme": "KAI-AUT", "name": "Each system of records notice cites a legal authority that is in force", "authority": [ { "tracker_id": "law-93-579" }, { "tracker_id": "omb-a-108-2016", "note": "SORN section \"Authority for maintenance of the system\"" } ], "evidence": { "tiers": [ "P2" ], "description": "P2 Federal Register SORNs, checked against the U.S. Code and the CFR", "expected_access": "public" }, "validation": { "methods": [ "machine", "analyst" ], "cycle": "30 days" }, "crosswalk": { "cr26_ksi": [], "fiscam": null }, "criticality": "major", "result_rule": "any_failure", "ig_subscore": false, "status": "draft" }, { "id": "KAI-AUT-ICR", "theme": "KAI-AUT", "name": "Each information collection cites the legal authority for collecting it", "authority": [ { "tracker_id": "law-104-13" }, { "citation": "5 CFR 1320.8(b)(3)", "note": "Respondents are told whether a response is voluntary, required for a benefit or mandatory, citing authority" } ], "evidence": { "tiers": [ "P2" ], "description": "P2 reginfo.gov information collection requests and supporting statements", "expected_access": "public" }, "validation": { "methods": [ "machine", "analyst" ], "cycle": "30 days" }, "crosswalk": { "cr26_ksi": [], "fiscam": null }, "criticality": "major", "result_rule": "any_failure", "ig_subscore": false, "status": "draft" }, { "id": "KAI-AUT-NPR", "theme": "KAI-AUT", "name": "Proposed rules state the legal authority they rest on", "authority": [ { "citation": "5 U.S.C. 553(b)(2)", "note": "Administrative Procedure Act; not in the FedXchange tracker" } ], "evidence": { "tiers": [ "P2" ], "description": "P2 Federal Register proposed rules", "expected_access": "public" }, "validation": { "methods": [ "machine", "analyst" ], "cycle": "7 days" }, "crosswalk": { "cr26_ksi": [], "fiscam": null }, "criticality": "major", "result_rule": "any_failure", "ig_subscore": false, "status": "draft" }, { "id": "KAI-AUT-ALN", "theme": "KAI-AUT", "name": "Assistance programs name their authorizing law, and awards fit the program", "authority": [ { "citation": "31 U.S.C. 6102(a)(1)(B)", "note": "Federal Program Information Act; not in the FedXchange tracker" } ], "evidence": { "tiers": [ "P2" ], "description": "P2 SAM.gov Assistance Listings, compared with USAspending awards under each listing", "expected_access": "public" }, "validation": { "methods": [ "analyst" ], "cycle": "yearly" }, "crosswalk": { "cr26_ksi": [], "fiscam": null }, "criticality": "major", "result_rule": "share", "ig_subscore": false, "status": "draft" }, { "id": "KAI-AUT-PRF", "theme": "KAI-AUT", "name": "Annual performance report says which goals were met and explains each one missed", "authority": [ { "citation": "31 U.S.C. 1116", "note": "GPRA Modernization Act; not in the FedXchange tracker" } ], "evidence": { "tiers": [ "P3" ], "description": "P3 annual performance report and strategic plan, Performance.gov", "expected_access": "public" }, "validation": { "methods": [ "analyst" ], "cycle": "yearly" }, "crosswalk": { "cr26_ksi": [], "fiscam": null }, "criticality": "major", "result_rule": "any_failure", "ig_subscore": false, "status": "draft" } ] }