Generated from the official FedRAMP/docs GitHub repo. Source path: FRMR.documentation.json on main at blob 5c6bfee74029. FRMR version: 0.9.43-beta · upstream last_updated: 2026-04-08. The official FedRAMP/rules repo exists, but grclanker still treats FedRAMP/docs as the active source until structured rules land there.

Monitoring, Logging, and Auditing

Domain code: MLA · Domain ID: KSI-MLA · Web slug: monitoring-logging-and-auditing

Theme

A secure cloud service offering will monitor, log, and audit all important events, activity, and changes.

Indicators

KSI-MLA-ALA (formerly KSI-MLA-08) — Authorizing Log Access

Mapped Rev5 controls: si-11

Recent update: 2026-02-04 — Removed italics and changed the ID as part of new standardization in v0.9.0-beta; no material changes.

KSI-MLA-EVC (formerly KSI-MLA-05) — Evaluating Configurations

Persistently evaluate and test the configuration of machine-based information resources, especially infrastructure as code.

Mapped Rev5 controls: ca-7, cm-2, cm-6, si-7.7

Terms: Information Resource, Machine-Based (information resources), Persistently

Recent update: 2026-02-04 — Removed italics and changed the ID as part of new standardization in v0.9.0-beta; no material changes.

KSI-MLA-LET (formerly KSI-MLA-07) — Logging Event Types

Maintain a list of information resources and event types that will be logged, monitored, and audited, then do so.

Mapped Rev5 controls: ac-2.4, ac-6.9, ac-17.1, ac-20.1, au-2, au-7.1, au-12, si-4.4, si-4.5, si-7.7

Terms: Information Resource

Recent update: 2026-02-04 — Removed italics and changed the ID as part of new standardization in v0.9.0-beta; no material changes.

KSI-MLA-OSM (formerly KSI-MLA-01) — Operating SIEM Capability

Operate a Security Information and Event Management (SIEM) or similar system(s) for centralized, tamper-resistent logging of events, activities, and changes.

Mapped Rev5 controls: ac-17.1, ac-20.1, au-2, au-3, au-3.1, au-4, au-5, au-6.1, au-6.3, au-7, au-7.1, au-8, au-9, au-11, ir-4.1, si-4.2, si-4.4, si-7.7

Recent update: 2026-02-04 — Removed italics and changed the ID as part of new standardization in v0.9.0-beta; no material changes.

KSI-MLA-RVL (formerly KSI-MLA-02) — Reviewing Logs

Persistently review and audit logs.

Mapped Rev5 controls: ac-2.4, ac-6.9, au-2, au-6, au-6.1, si-4, si-4.4

Terms: Persistently

Recent update: 2026-02-04 — Removed italics and changed the ID as part of new standardization in v0.9.0-beta; no material changes.