Baseline Coverage & Orphans
A Rev5 baseline for a certification class contains N controls; the 20x KSIs demonstrably cover some of them. What is left — the orphans — is the scope a Security Decision Record has to argue for by hand, and nothing in the dataset states it directly. Coverage here is a set intersection between each baseline and the KSI-mapped control graph, never a property of a control.
Class B
- Orphans (hand-argued)
- 60
- Annual assessment subset
- 35
Class C
- Orphans (hand-argued)
- 123
- Annual assessment subset
- 80
Class D
- Orphans (hand-argued)
- 210
- Annual assessment subset
- 101
No Rev5 baseline exists for class A. That is an absence of a baseline, not a baseline of zero controls — coverage is undefined rather than 0%.
Coverage by control family
Percentage of each class’s baseline family reached by any KSI indicator. An em-dash means the family has no baseline controls in that class; a family flagged below the table is reached by no KSI at all and is 100% orphan, not unknown.
| Class | AC | AT | AU | CA | CM | CP | IA | IR | MA | MP | PE | PL | PS | RA | SA | SC | SI | SR |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| B | 64 | 80 | 90 | 67 | 56 | 83 | 69 | 86 | 25 | 0 | 0 | 29 | 89 | 38 | 67 | 86 | 83 | 45 |
| C | 67 | 83 | 94 | 54 | 74 | 96 | 70 | 71 | 10 | 0 | 0 | 29 | 80 | 36 | 43 | 79 | 71 | 50 |
| D | 58 | 83 | 56 | 47 | 59 | 63 | 63 | 50 | 8 | 0 | 0 | 29 | 73 | 31 | 36 | 66 | 49 | 43 |
Families reached by no KSI — 100% orphan
Present in every baseline, absent from the KSI graph entirely. Every control in these families has to be argued by hand.
Rev5 baseline — class B → C
Added (167)
Removed (0)
None — this set is nested at these two classes.
Annual independent assessment — class B → C
Added (46)
Removed (1)
KSI-mapped controls in no baseline (10)
Of the 209 controls reachable from a KSI indicator, these appear in no Rev5 baseline of any class — work the KSIs ask for that no baseline requires.