Control-Family Heatmap
Rows are the 10 FedRAMP 20x KSI themes, columns the 19 NIST 800-53 control families touched by a KSI or a Rev5 baseline. The top block shows where 20x attention concentrates — distinct controls per family reached by each theme. The bottom block shows where the Rev5 baselines put their mass, per certification class. Reading the two against each other is the point: a family heavy below and empty above is scope that automated KSI evidence will never cover.
| KSI theme | AC | AT | AU | CA | CM | CP | IA | IR | MA | MP | PE | PL | PM | PS | RA | SA | SC | SI | SR | Total |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| CED — Cybersecurity Education | · | 6 | · | · | · | 1 | · | 2 | · | · | · | · | · | 1 | · | · | · | · | 1 | 11 |
| CMT — Change Management | · | · | 1 | · | 12 | · | · | · | 1 | · | · | · | · | · | · | · | · | 2 | · | 16 |
| CNA — Cloud Native Architecture | 5 | · | · | 3 | 2 | · | · | · | · | · | · | 1 | · | · | · | · | 10 | 6 | · | 27 |
| IAM — Identity and Access Management | 27 | · | 1 | · | 6 | · | 19 | · | · | · | · | · | · | 7 | 1 | · | 7 | 1 | · | 69 |
| INR — Incident Response | · | · | · | · | · | · | · | 11 | · | · | · | · | · | · | · | · | · | 1 | · | 12 |
| MLA — Monitoring, Logging, and Auditing | 4 | · | 14 | 1 | 2 | · | · | 1 | · | · | · | · | · | · | · | · | · | 6 | · | 28 |
| PIY — Policy and Inventory | 1 | · | 1 | 1 | 7 | 3 | · | 1 | · | · | · | 1 | 2 | · | 1 | 3 | 2 | 3 | 1 | 27 |
| RPL — Recovery Planning | · | · | · | · | 1 | 19 | · | 2 | · | · | · | · | · | · | · | · | · | 1 | · | 23 |
| SCR — Supply Chain Risk | 1 | · | · | 2 | · | · | · | 1 | · | · | · | · | · | 1 | 2 | 5 | 1 | 2 | 3 | 18 |
| SVC — Service Configuration | 3 | · | · | · | 7 | 1 | 2 | · | 1 | · | · | 3 | · | · | · | 1 | 14 | 7 | 1 | 40 |
| KSI-reached controls | 30 | 6 | 16 | 7 | 20 | 22 | 19 | 14 | 1 | — | — | 3 | 2 | 8 | 4 | 9 | 23 | 19 | 6 | |
| Rev5 baseline controls per family, by certification class | ||||||||||||||||||||
| Class B | 11 | 5 | 10 | 9 | 9 | 6 | 16 | 7 | 4 | 4 | 10 | 7 | · | 9 | 8 | 9 | 14 | 6 | 11 | 155 |
| Class C | 43 | 6 | 16 | 13 | 27 | 23 | 27 | 17 | 10 | 7 | 19 | 7 | · | 10 | 11 | 21 | 29 | 24 | 12 | 322 |
| Class D | 50 | 6 | 27 | 15 | 34 | 35 | 30 | 24 | 12 | 10 | 26 | 7 | · | 11 | 13 | 25 | 35 | 35 | 14 | 409 |
The two family sets are not nested. MP and PE appear in every baseline yet are reached by no KSI — automated 20x evidence never touches them — while PM carries KSI attention but sits in no Rev5 baseline. Class A has no baseline at all, which is why no Class A row exists above.