ARC-AMPE

A project opens into evidence lanes with a real control set behind them; collection is demonstrative until a test plan runs against a real target.

Blueprint with 10 evidence lanes and a control set; no registered test plans yet. A project opens into real lanes; collection is demonstrative until a READY plan or a release path exists.

Engagement

ARC-AMPE control baseline assessment

Control set

308 controls (175 base, 133 enhancements) across 20 families, parsed from ARC-AMPE_Vol2_SSPP-DE-Entity_v1.0-508_07072025.xlsx, sheet "DEE Mandatory Baseline". This is the ingested DEE mandatory baseline, not the size of ARC-AMPE as published.

Native identifiers

NIST SP 800-53 Rev. 5 control identifiers as tailored by ARC-AMPE, e.g. AC-02, AC-02(01), SC-08(01).

Evidence lanes

1. 01Access Control and Identificationidentity provider configuration export · account inventory and access review records · privileged access authorization records · session and remote access configuration
2. 02Audit and Accountabilitylog source inventory · audit record retention configuration · log review and alerting evidence
3. 03Configuration, Acquisition, and Supply Chainbaseline configuration export · change control records · software inventory and provenance · supplier assessment records
4. 04Contingency Planning and Incident Responsecontingency plan and test results · backup and restoration evidence · incident response plan and exercise records · incident tickets for the audit window
5. 05Assessment, Authorization, Planning, and RiskSSPP · SAR · POA&M · risk assessment and vulnerability scan results · interconnection security agreements
6. 06Personnel Security, Awareness, and Trainingrole-based training completion records · screening and onboarding records · separation and transfer records
7. 07Physical Protection, Media, and Maintenancefacility access records or provider attestation · media handling and sanitization records · maintenance authorization records
8. 08System and Communications Protectiontransport encryption configuration · cryptographic module and key management evidence · boundary protection configuration
9. 09System and Information Integrityflaw remediation and patch records · malicious code protection configuration · monitoring and alerting evidence
10. 10PII Processing and Transparencyprivacy notice and consent evidence · PII inventory and processing records · authority-to-process documentation

Registry status

Beta · catalog on diskA parsed control catalog for this regime exists in the repo. `catalogPath` is non-null and `controlCount` is real.

Control units

308308 controls (175 base, 133 enhancements) across 20 families, parsed from ARC-AMPE_Vol2_SSPP-DE-Entity_v1.0-508_07072025.xlsx, sheet "DEE Mandatory Baseline". This is the ingested DEE mandatory baseline, not the size of ARC-AMPE as published.

Control families

AC · AT · AU · CA · CM · CP · IA · IR · MA · MP · PE · PL · PM · PS · PT · RA · SA · SC · SI · SR

Applies to

healthcare · insurance · federal · US

Verification

Secondary — corroborated across independent sources; the authority blocks automated fetch or does not state it plainly. checked 2026-08-06