<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# FedRAMP Assessment — API Reference

## OSCAL CLI Commands

```bash
# Validate OSCAL SSP document
oscal-cli ssp validate system-security-plan.json

# Convert OSCAL XML to JSON
oscal-cli ssp convert --to json system-security-plan.xml

# Resolve profile to catalog
oscal-cli profile resolve fedramp-moderate-profile.json
```

## AWS GovCloud Compliance

```bash
# List AWS Config compliance (GovCloud)
aws configservice describe-compliance-by-config-rule \
  --region us-gov-west-1 --output json

# Get Security Hub findings (FedRAMP mapped)
aws securityhub get-findings \
  --filters '{"ComplianceStatus": [{"Value": "FAILED", "Comparison": "EQUALS"}]}' \
  --region us-gov-west-1

# Export AWS artifact for authorization package
aws artifact get-report-metadata --report-id <REPORT_ID>
```

## Control Assessment Commands

```bash
# AC-2: Account Management
lastlog -b 90 | awk 'NR>1 {print $1, $2}'
awk -F: '$7 !~ /nologin|false/ {print $1}' /etc/passwd

# AU-2: Audit Events
auditctl -l | wc -l
systemctl is-active auditd rsyslog

# CM-6: Configuration Settings
sshd -T | grep -E "^(permitrootlogin|passwordauthentication|x11forwarding)"

# IA-5: Authenticator Management
grep -E "^PASS_(MAX|MIN|WARN)_AGE" /etc/login.defs
chage -l <username>

# SC-28: Protection at Rest
lsblk -o NAME,FSTYPE,MOUNTPOINT | grep crypt
dmsetup status

# SI-2: Flaw Remediation
apt list --upgradable 2>/dev/null | grep -c security
yum check-update --security 2>/dev/null | tail -n +3 | wc -l
```

## FedRAMP Baseline Control Counts

| Family | Low | Moderate | High |
|--------|-----|----------|------|
| AC | 10 | 25 | 30 |
| AU | 6 | 16 | 19 |
| CA | 5 | 9 | 9 |
| CM | 6 | 11 | 12 |
| IA | 6 | 11 | 12 |
| SC | 10 | 44 | 50 |
| SI | 5 | 16 | 19 |
