Frontierwhat a machine can prove, and what is left

Controls reached by at least one Key Security Indicator edge. Not the Rev5 baseline union: a control no indicator reaches has nothing to prove here, and counting it would make every ratio below flatter than the work is.

• AC-01

  An access control policy and its procedures are documents developed, disseminated and reviewed on a stated cycle; no API reports that a document exists or that anyone read it.

  narrativelev 7
• AC-02

  Full snapshot of every IAM user, group, role, and attached/inline policy with their relationships, used to review that granted permissions match least-privilege intent

  partialaws
• AC-02 (01)

  Automated account management is a claim about the mechanism that provisions and deprovisions — Identity Center's SCIM provisioning status and its identity-source binding are readable, and that is telemetry. Whether that mechanism is the one every account in the boundary is managed by, and what it is fed from, is an architecture statement. Dropped from two recipes on 2026-08-26 whose key-age assertions were testing IA-05 (g), not this.

  partiallev 5
• AC-02 (02)

  The mechanism that ends a temporary or emergency account without anyone deciding to: the AWS Config rule that measures how long an IAM credential has gone unused, the period it is configured with, the remediation configuration proving the revocation fires automatically, and an empty non-compliant set showing nothing has outlived the period

  partialaws
• AC-02 (03)

  Active unused-access findings identifying IAM roles, access keys, console passwords, and service/action-level permissions that have not been used within the configured age, driving right-sizing and removal

  partialaws
• AC-02 (04)

  GuardDuty IAM/credential-abuse findings (detection) paired with CloudTrail records of the responsive action taken to disable or secure the affected privileged principal

  partialaws
• AC-02 (05)

  No plane has read this control. Its candidate plane is named in docs/machine-readable-evidence-planes.md; nothing here dispositions it.

  lev 4
• AC-02 (06)

  No plane has read this control. Its candidate plane is named in docs/machine-readable-evidence-planes.md; nothing here dispositions it.

  lev 3
• AC-02 (13)

  GuardDuty IAM/credential-abuse findings (detection) paired with CloudTrail records of the responsive action taken to disable or secure the affected privileged principal

  partialaws
• AC-03

  Full snapshot of every IAM user, group, role, and attached/inline policy with their relationships, used to review that granted permissions match least-privilege intent

  partialaws
• AC-04

  Security groups, network ACLs, route tables, VPC endpoint policies and Network Firewall rules enumerate every flow the deployment actually permits; which flows were APPROVED is a document the enumeration is compared against.

  partiallev 6
• AC-05

  IAM policies and Identity Center permission sets show whether any principal holds two duties at once, so the implementation is measurable; the set of duties that require separation is stated in the SSP, not in AWS.

  partiallev 6
• AC-06

  AWS Config compliance result proving no customer-managed IAM policy grants full administrative access (Allow Action:* on Resource:*)

  partialaws
• AC-06 (01)

  Full snapshot of every IAM user, group, role, and attached/inline policy with their relationships, used to review that granted permissions match least-privilege intent

  partialaws
• AC-06 (02)

  No plane has read this control. Its candidate plane is named in docs/machine-readable-evidence-planes.md; nothing here dispositions it.

  lev 4
• AC-06 (05)

  Documented just-in-time / break-glass privilege-elevation process backed by IAM Identity Center permission sets and account assignments, showing privileged access is role/attribute-based, time-bound, and approval-gated rather than standing

  narrativeaws
• AC-06 (07)

  Active unused-access findings identifying IAM roles, access keys, console passwords, and service/action-level permissions that have not been used within the configured age, driving right-sizing and removal

  partialaws
• AC-06 (09)

  CloudTrail records management events by default, and every privileged control-plane call arrives as one — IAM policy writes, KMS key operations, security-group authorizations. A trail capturing read AND write management events, still logging, with log-file validation on, decides the control-plane half from its own output. The in-guest half does not close: AWS documents that Session Manager logging is unavailable for sessions connecting through port forwarding or SSH, so an operator who reaches a host that way executes privileged functions and leaves no session log while get-document still reports logging enabled, and which instances ship the auth log is a CloudWatch agent configuration living on the instance, not a field any API returns. A recipe here evidences the control plane and hands the in-guest plane to a sampled review.

  partiallev 6
• AC-06 (10)

  Preventing non-privileged users from executing privileged functions needs a partition of principals into privileged and non-privileged that no IAM output carries; given the partition, the policies each side holds are enumerable and the check is writable. Dropped from config-iam-policy-no-admin-access on 2026-08-26 because the rule sees customer-managed policies only and carries no such partition.

  partiallev 4
• AC-07

  GuardDuty IAM/credential-abuse findings (detection) paired with CloudTrail records of the responsive action taken to disable or secure the affected privileged principal

  partialaws
• AC-12

  No plane has read this control. Its candidate plane is named in docs/machine-readable-evidence-planes.md; nothing here dispositions it.

  lev 5
• AC-14

  Access Analyzer and the public-access Config rules enumerate every path that reaches a resource without authentication; the rationale for each path that is deliberately permitted is documented.

  partiallev 7
• AC-17

  How operators actually reach the environment from outside it: the managed access paths that exist, the logging and encryption configured on them, the session-by-session record of who used them, and the negative check that no instance is directly reachable instead

  partialaws
• AC-17 (01)

  How operators actually reach the environment from outside it: the managed access paths that exist, the logging and encryption configured on them, the session-by-session record of who used them, and the negative check that no instance is directly reachable instead

  partialaws
• AC-17 (02)

  How operators actually reach the environment from outside it: the managed access paths that exist, the logging and encryption configured on them, the session-by-session record of who used them, and the negative check that no instance is directly reachable instead

  partialaws
• AC-17 (03)

  How operators actually reach the environment from outside it: the managed access paths that exist, the logging and encryption configured on them, the session-by-session record of who used them, and the negative check that no instance is directly reachable instead

  partialaws
• AC-18 (01)

  No plane has read this control. Its candidate plane is named in docs/machine-readable-evidence-planes.md; nothing here dispositions it.

  lev 4
• AC-18 (03)

  No plane has read this control. Its candidate plane is named in docs/machine-readable-evidence-planes.md; nothing here dispositions it.

  lev 4
• AC-20

  The machine-generated inventory of every resource an external entity can reach — IAM Access Analyzer's active ExternalAccess findings — read against the declared zone of trust, so the terms-and-conditions review has a list to work from rather than a memory

  partialaws
• AC-20 (01)

  The enhancement asks for verification that the EXTERNAL system implements the required controls, or a retained agreement saying so — a statement about somebody else's estate that no call against this one can make.

  narrativelev 8
• AT-02

  Training delivery and completion live in a learning management system; AWS has no notion of a trained person.

  narrativelev 6
• AT-02 (02)

  The requirement is that awareness training covers insider threat — a property of the course content, not of any system state.

  narrativelev 6
• AT-02 (03)

  Same shape as the sibling enhancement: what the training covers is a property of the curriculum, which no API enumerates.

  narrativelev 3
• AT-03

  Role-based training records map people to courses in an LMS; the AWS role a principal assumes says nothing about what they were taught.

  narrativelev 6
• AT-03 (05)

  Whether PII-handling training was delivered is an LMS record; AWS can show where PII sits, never who was trained on it.

  narrativelev 1
• AT-04

  Retention of individual training records is an LMS retention setting; where those records are stored could be an AWS fact, but their content and completeness never are.

  narrativelev 6
• AU-02

  AWS Config compliance results proving the audit trail exists and is protected — CloudTrail enabled and multi-region so management events are captured account-wide, log-file validation on so records are tamper-evident, and SSE-KMS encryption on so the logs themselves are protected at rest

  partialaws
• AU-03

  Content of audit records is a property of the record, and CloudTrail's event schema fixes the fields — type, time, source, outcome, identity — so a sample event read out of the trail proves the shape. Which additional content the organization requires, and whether application and OS logs carry the same fields, is a document. Dropped from config-cloudtrail-audit-logging on 2026-08-26: a rule that checks a multi-Region trail exists does not read a record.

  partiallev 7
• AU-03 (01)

  No plane has read this control. Its candidate plane is named in docs/machine-readable-evidence-planes.md; nothing here dispositions it.

  lev 4
• AU-03 (03)

  No plane has read this control. Its candidate plane is named in docs/machine-readable-evidence-planes.md; nothing here dispositions it.

  lev 2
• AU-04

  How long audit records are kept, how much space they occupy, and whether the pipeline that delivers them is currently failing — retention settings on every log group and log bucket, the storage they consume, and the trail's own delivery-error fields

  partialaws
• AU-05

  How long audit records are kept, how much space they occupy, and whether the pipeline that delivers them is currently failing — retention settings on every log group and log bucket, the storage they consume, and the trail's own delivery-error fields

  partialaws
• AU-06

  The metric filters that turn audit log events into metrics, the alarms built on them, and Config's confirmation that those alarms actually notify someone — the automated-mechanism half of audit review

  partialaws
• AU-06 (01)

  The metric filters that turn audit log events into metrics, the alarms built on them, and Config's confirmation that those alarms actually notify someone — the automated-mechanism half of audit review

  partialaws
• AU-06 (03)

  No plane has read this control. Its candidate plane is named in docs/machine-readable-evidence-planes.md; nothing here dispositions it.

  lev 4
• AU-07

  A demonstration run against the live log estate that audit records can be reduced, sorted and searched on demand by event criteria — the standing saved queries, the query that ran, and the report it returned

  partialaws
• AU-07 (01)

  A demonstration run against the live log estate that audit records can be reduced, sorted and searched on demand by event criteria — the standing saved queries, the query that ran, and the report it returned

  partialaws
• AU-08

  What each instance's clock is actually locked to and how far off it is right now — the chrony daemon's reference source, offset and leap status collected fleet-wide through Run Command — together with the configured time source in chrony.conf and the UTC time stamps CloudTrail already writes on every audit record

  partialaws
• AU-09

  AWS Config compliance results proving the audit trail exists and is protected — CloudTrail enabled and multi-region so management events are captured account-wide, log-file validation on so records are tamper-evident, and SSE-KMS encryption on so the logs themselves are protected at rest

  partialaws
• AU-09 (04)

  No plane has read this control. Its candidate plane is named in docs/machine-readable-evidence-planes.md; nothing here dispositions it.

  lev 4
• AU-11

  How long audit records are kept, how much space they occupy, and whether the pipeline that delivers them is currently failing — retention settings on every log group and log bucket, the storage they consume, and the trail's own delivery-error fields

  partialaws
• AU-12

  AWS Config compliance results proving the audit trail exists and is protected — CloudTrail enabled and multi-region so management events are captured account-wide, log-file validation on so records are tamper-evident, and SSE-KMS encryption on so the logs themselves are protected at rest

  partialaws
• CA-02

  Security Hub standards and Config conformance packs perform an automated control assessment continuously and return a pass/fail per control, which is the assessment ACTIVITY; the assessment plan that fixed the scope, depth and methods, and the report that came out the other end, are documents no call returns. AWS Audit Manager is the obvious candidate and is deliberately not named — AWS has closed it to new customers, so a recipe built on it would be unfollowable advice for most readers.

  partiallev 7
• CA-02 (01)

  Independence is a property of the assessor, not of the assessment: who performed it, who they report to, and whether they had any hand in developing or operating the system. A 3PAO reads the independence attestation and the engagement letter; no account state distinguishes an independent assessor from an employee holding the same IAM role.

  narrativelev 7
• CA-03

  Every external interface is enumerable — VPC peering connections, Transit Gateway attachments, PrivateLink endpoints, Direct Connect virtual interfaces and the resource policies that admit another account — so the interface characteristics the control asks to be documented are telemetry. The agreement that APPROVES each exchange is not, and the dataset's own AC-20 guidance says exactly this, differentiating CA-3 as the documented agreement between the two system owners.

  partiallev 7
• CA-07

  The operating half is pure telemetry: whether the Config recorder is on and recording every resource type, which Security Hub standards are enabled and their control statuses, whether Inspector and GuardDuty cover the account. The strategy the control actually names — the metrics chosen, the monitoring frequencies, who correlates and who reports — is a document, and the telemetry is what that document is measured against rather than a substitute for it.

  partiallev 7
• CA-07 (01)

  No plane has read this control. Its candidate plane is named in docs/machine-readable-evidence-planes.md; nothing here dispositions it.

  lev 4
• CA-07 (04)

  Two of the three named ingredients are collectible: compliance monitoring is Security Hub control status and a conformance pack's compliance summary, change monitoring is the Config configuration-item history joined to CloudTrail. Effectiveness monitoring — whether the risk responses in place are actually reducing risk — is the judgement, and it is the third no score substitutes for.

  partiallev 7
• CA-09

  The machine-generated inventory of every plane on which one part of the system reaches another — VPC peering connections, Transit Gateway attachments, the interface and gateway endpoints this account consumes, the endpoint connections other accounts have made INTO your endpoint service, and the security-group rules that name another group rather than a CIDR — each narrowed to the states that are actually live

  partialaws
• CM-02

  AWS Config compliance results plus the State Manager association list proving a defined configuration is actually applied and re-applied to every managed node — instances are under SSM management, and the associations that carry your baseline report COMPLIANT on a schedule rather than drifting

  partialaws
• CM-02 (02)

  The machine-maintained component inventory — Config's recorder status and discovered-resource counts proving supported resources are tracked continuously and the list stays current without anyone editing a spreadsheet, plus Systems Manager Inventory's node and installed-application metadata for what runs inside them

  partialaws
• CM-02 (03)

  No plane has read this control. Its candidate plane is named in docs/machine-readable-evidence-planes.md; nothing here dispositions it.

  lev 5
• CM-02 (07)

  No plane has read this control. Its candidate plane is named in docs/machine-readable-evidence-planes.md; nothing here dispositions it.

  lev 4
• CM-03

  Who changed what, when, and from which state to which — CloudTrail's record of every mutating API call and Config's per-resource configuration history, plus, where Change Manager is in use, the change-request executions that carry the approval

  partialaws
• CM-03 (02)

  Three collectible artifacts line up with the three verbs: a CloudFormation change set is the validated preview of what a change would do, a pipeline execution record shows the test stage that gated the deployment and whether it passed, and an approval action on that pipeline carries who signed the change off. Change Manager would carry the approval and the runbook together, but it is one of the Systems Manager capabilities AWS lists as unavailable in the GovCloud (US) Regions, so a recipe leading with it is undeliverable for a FedRAMP estate — build on the change set and the pipeline, which exist in both partitions. Whether the tests were ADEQUATE to the change is the reviewer's judgement, and a green stage cannot report it.

  partiallev 6
• CM-03 (04)

  The rule requiring the designated owners of the changed code to approve before it merges, the file that names who those owners are, the platform's own report of whether that file actually parses — and, per change, who approved, on which commit, and when.

  partialpipeline
• CM-04 (02)

  For every change that reached the assessed branch, the automated verification that ran against it — which workflows ran, on which commit, and what each concluded — together with the two things that decide whether those runs were a condition of the change or merely adjacent to it: the rule that made the checks required, and the platform's own per-push record of whether that rule held, failed, or was bypassed. The runs alone are activity; the rule and the per-push record are what make them a gate.

  partialpipeline
• CM-05

  The enforced half of who may change what: the service control policy type actually enabled in the organization root, the customer-authored SCPs and the roots, OUs and accounts each one is attached to, and the permissions boundary carried by every principal your own tagging marks as a change authority

  partialaws
• CM-06

  AWS Config compliance results plus the State Manager association list proving a defined configuration is actually applied and re-applied to every managed node — instances are under SSM management, and the associations that carry your baseline report COMPLIANT on a schedule rather than drifting

  partialaws
• CM-07

  Config compliance results proving the ports you declared unnecessary are not reachable from the internet and the software you declared prohibited is not installed, plus the actual installed-application set a periodic review has to read

  partialaws
• CM-07 (01)

  Config compliance results proving the ports you declared unnecessary are not reachable from the internet and the software you declared prohibited is not installed, plus the actual installed-application set a periodic review has to read

  partialaws
• CM-07 (02)

  No plane has read this control. Its candidate plane is named in docs/machine-readable-evidence-planes.md; nothing here dispositions it.

  lev 4
• CM-07 (05)

  No plane has read this control. Its candidate plane is named in docs/machine-readable-evidence-planes.md; nothing here dispositions it.

  lev 5
• CM-08

  The machine-maintained component inventory — Config's recorder status and discovered-resource counts proving supported resources are tracked continuously and the list stays current without anyone editing a spreadsheet, plus Systems Manager Inventory's node and installed-application metadata for what runs inside them

  partialaws
• CM-08 (01)

  The machine-maintained component inventory — Config's recorder status and discovered-resource counts proving supported resources are tracked continuously and the list stays current without anyone editing a spreadsheet, plus Systems Manager Inventory's node and installed-application metadata for what runs inside them

  partialaws
• CM-08 (03)

  Every running instance built from an image you never approved and every node carrying denylisted software, together with proof that an automated action was configured for those findings and a record of what it did when one fired

  partialaws
• CM-09

  A configuration management plan is a document: it names the roles, defines what counts as a configuration item, and states how the baseline is protected from unauthorised change. AWS enforces whatever baseline it is given and reports drift from it, but the plan that decided what the baseline should be is read, never queried.

  narrativelev 6
• CM-12

  A Region-by-Region inventory of the resources that can hold information, the classification tags you asserted on them, and — where Macie exists — a sampled machine judgement about which S3 buckets actually contain sensitive data

  partialaws
• CM-12 (01)

  A Region-by-Region inventory of the resources that can hold information, the classification tags you asserted on them, and — where Macie exists — a sampled machine judgement about which S3 buckets actually contain sensitive data

  partialaws
• CP-02

  A contingency plan is a document: developed, distributed to named roles, coordinated with related plans, reviewed on a cycle and updated after changes. A 3PAO reads the plan, its distribution list and its revision history; no API reports that a plan exists or that anyone maintains it.

  narrativelev 7
• CP-02 (01)

  No plane has read this control. Its candidate plane is named in docs/machine-readable-evidence-planes.md; nothing here dispositions it.

  lev 6
• CP-02 (03)

  No plane has read this control. Its candidate plane is named in docs/machine-readable-evidence-planes.md; nothing here dispositions it.

  lev 6
• CP-02 (08)

  No plane has read this control. Its candidate plane is named in docs/machine-readable-evidence-planes.md; nothing here dispositions it.

  lev 4
• CP-03

  Contingency training is delivered to people on a schedule and recorded in a training system. A 3PAO reads the curriculum, the roster and the completion dates; nothing in an AWS account changes when someone is trained.

  narrativelev 7
• CP-04

  AWS Backup restore-testing plans and their job history genuinely evidence that a technical recovery test ran on a schedule, completed, and how long it took — that is more than nothing and should not be closed as narrative. What it does not cover is CP-04's subject: exercising the contingency PLAN, reviewing the results with the participants and initiating corrective actions, which is an exercise report and a remediation record.

  partiallev 7
• CP-04 (01)

  No plane has read this control. Its candidate plane is named in docs/machine-readable-evidence-planes.md; nothing here dispositions it.

  lev 6
• CP-06

  No plane has read this control. Its candidate plane is named in docs/machine-readable-evidence-planes.md; nothing here dispositions it.

  lev 6
• CP-06 (01)

  No plane has read this control. Its candidate plane is named in docs/machine-readable-evidence-planes.md; nothing here dispositions it.

  lev 5
• CP-06 (03)

  No plane has read this control. Its candidate plane is named in docs/machine-readable-evidence-planes.md; nothing here dispositions it.

  lev 4
• CP-07

  No plane has read this control. Its candidate plane is named in docs/machine-readable-evidence-planes.md; nothing here dispositions it.

  lev 4
• CP-07 (01)

  No plane has read this control. Its candidate plane is named in docs/machine-readable-evidence-planes.md; nothing here dispositions it.

  lev 4
• CP-07 (02)

  No plane has read this control. Its candidate plane is named in docs/machine-readable-evidence-planes.md; nothing here dispositions it.

  lev 4
• CP-07 (03)

  No plane has read this control. Its candidate plane is named in docs/machine-readable-evidence-planes.md; nothing here dispositions it.

  lev 4
• CP-08

  No plane has read this control. Its candidate plane is named in docs/machine-readable-evidence-planes.md; nothing here dispositions it.

  lev 4
• CP-08 (01)

  No plane has read this control. Its candidate plane is named in docs/machine-readable-evidence-planes.md; nothing here dispositions it.

  lev 4
• CP-08 (02)

  No plane has read this control. Its candidate plane is named in docs/machine-readable-evidence-planes.md; nothing here dispositions it.

  lev 4
• CP-09

  AWS Config compliance results proving system data is backed up on a defined schedule — RDS automated backups enabled with a minimum retention, and AWS Backup plans meeting a minimum frequency and retention

  partialaws
• CP-09 (01)

  No plane has read this control. Its candidate plane is named in docs/machine-readable-evidence-planes.md; nothing here dispositions it.

  lev 4
• CP-09 (08)

  No plane has read this control. Its candidate plane is named in docs/machine-readable-evidence-planes.md; nothing here dispositions it.

  lev 4
• CP-10

  Restore jobs that actually ran — the schedule they ran on, whether each one completed, how long it took, and what it produced — plus the point-in-time recovery window that makes transaction-level recovery possible

  partialaws
• CP-10 (02)

  Restore jobs that actually ran — the schedule they ran on, whether each one completed, how long it took, and what it produced — plus the point-in-time recovery window that makes transaction-level recovery possible

  partialaws
• IA-02

  Account-wide credential report proving MFA is active per principal and that passwords/access keys are rotated within policy

  partialaws
• IA-02 (01)

  The credential report's mfa_active and the MFA_ENABLED_FOR_IAM_CONSOLE_ACCESS rule are TRUE for a virtual TOTP app as much as for a FIDO key, and FedRAMP's guidance on this enhancement is that the factor be phishing-resistant. list-mfa-devices discloses the device type by SerialNumber shape for IAM users, which is telemetry; whether workforce console access runs through IAM users at all, or through Identity Center and an external IdP whose factor AWS never sees, is the judgement. Re-filed here from two recipes the 2026-08-26 audit found were testing IA-02 base.

  partiallev 7
• IA-02 (02)

  Same telemetry as IA-02 (01) and the same phishing-resistance judgement, with one more gap: nothing in the credential report or the Config rule partitions privileged accounts from non-privileged ones, so the enhancement's own subject — the non-privileged population — is a list a human supplies. Dropped from config-mfa-enabled-console-access on 2026-08-26 because one assertion carried both enhancements with nothing to tell them apart.

  partiallev 7
• IA-02 (08)

  The credential report and STS usage prove authentication runs on signed, time-bounded temporary credentials rather than long-lived secrets; replay resistance itself is a property of the SigV4 protocol, cited from AWS documentation rather than measured.

  partiallev 7
• IA-03

  No plane has read this control. Its candidate plane is named in docs/machine-readable-evidence-planes.md; nothing here dispositions it.

  lev 5
• IA-04

  Every identifier the account has issued, with the date it was assigned and the AWS-generated unique id behind it; the workforce identifiers issued through IAM Identity Center and the external issuer each one came from; and the CloudTrail record of identifiers being deleted, which is the only dated evidence of a name becoming free to reuse

  partialaws
• IA-04 (04)

  No plane has read this control. Its candidate plane is named in docs/machine-readable-evidence-planes.md; nothing here dispositions it.

  lev 6
• IA-05

  Account-wide credential report proving MFA is active per principal and that passwords/access keys are rotated within policy

  partialaws
• IA-05 (01)

  get-account-password-policy returns the length, complexity, reuse and age settings this enhancement asks for, and the ODPs are numbers a recipe can carry as parameters — that half is telemetry. The organization-defined values themselves, and whether IAM users are the password population at all on an estate signing in through an external IdP, are the judgement. Dropped from iam-credential-report on 2026-08-26: access-key age is not a password rule.

  partiallev 7
• IA-05 (02)

  ACM and Private CA enumerate every certificate, its chain and its expiry, and a KMS key policy proves the private key is non-exportable; whether each relying party actually validates the full certification path is a per-application TLS client setting.

  partiallev 7
• IA-05 (06)

  Whether secret scanning, push protection and validity checking are switched on in this organization and which repositories those settings actually reach, together with the alerts themselves — each carrying the kind of credential found, whether the credential was confirmed to still work, how it was closed and by whom, and whether a push containing it was blocked or waved through. The settings are the population; the alerts are what was found in it, and an alert list read without the settings beside it cannot be told apart from a list produced by scanning nothing.

  partialpipeline
• IA-06

  Obscuring authentication feedback is a property of what a login interface renders; no API reports what a form displayed while someone typed into it.

  narrativelev 7
• IA-07

  The same shape as SC-13, which the overlay already rates partial: KMS and CloudHSM are enumerable and the FIPS endpoints in use are checkable, but the module's FIPS 140 validation is a certificate that is cited, never measured.

  partiallev 7
• IA-08

  For every Amazon Cognito directory that fronts non-organizational users: the user pool's multi-factor configuration, and every identity pool's guest-access flag together with the named external providers it will exchange a token for

  partialaws
• IA-11

  The configured ceiling on how long any credential stays valid before its holder must present an authenticator again — MaxSessionDuration on every IAM role, SessionDuration on every IAM Identity Center permission set, and the aws:MultiFactorAuthAge conditions in policy that expire an MFA-backed session independently of the session itself

  partialaws
• IA-12

  No plane has read this control. Its candidate plane is named in docs/machine-readable-evidence-planes.md; nothing here dispositions it.

  lev 4
• IA-12 (02)

  No plane has read this control. Its candidate plane is named in docs/machine-readable-evidence-planes.md; nothing here dispositions it.

  lev 4
• IA-12 (03)

  No plane has read this control. Its candidate plane is named in docs/machine-readable-evidence-planes.md; nothing here dispositions it.

  lev 4
• IA-12 (05)

  No plane has read this control. Its candidate plane is named in docs/machine-readable-evidence-planes.md; nothing here dispositions it.

  lev 4
• IR-02

  Incident response training is delivered to responders and refreshed on a cycle. A 3PAO reads the training content, the roster of who took it and when, and any simulated-event exercise records; no AWS call reports a trained responder.

  narrativelev 7
• IR-02 (03)

  No plane has read this control. Its candidate plane is named in docs/machine-readable-evidence-planes.md; nothing here dispositions it.

  lev 2
• IR-03

  GuardDuty findings and Security Hub insight summaries that were reviewed, together with evidence that the findings fed into an after-action review cycle — AAR documents stored as versioned S3 objects with the incident IDs they reference

  partialaws
• IR-03 (02)

  No plane has read this control. Its candidate plane is named in docs/machine-readable-evidence-planes.md; nothing here dispositions it.

  lev 5
• IR-04

  GuardDuty findings and Security Hub insight summaries that were reviewed, together with evidence that the findings fed into an after-action review cycle — AAR documents stored as versioned S3 objects with the incident IDs they reference

  partialaws
• IR-04 (01)

  GuardDuty findings and Security Hub insight summaries that were reviewed, together with evidence that the findings fed into an after-action review cycle — AAR documents stored as versioned S3 objects with the incident IDs they reference

  partialaws
• IR-05

  Recurring GuardDuty finding types and patterns queried across a multi-quarter window, plus Athena SQL over CloudTrail data, surfacing whether the same attack vectors repeat and whether the same misconfigurations are reintroduced after remediation

  partialaws
• IR-06

  Security Hub finding workflow status plus GuardDuty detection coverage, showing incident response procedures are exercised: enabled insights, automated response actions routed through EventBridge, automated notifications, and Systems Manager Automation documents that encode response steps

  partialaws
• IR-06 (01)

  Security Hub finding workflow status plus GuardDuty detection coverage, showing incident response procedures are exercised: enabled insights, automated response actions routed through EventBridge, automated notifications, and Systems Manager Automation documents that encode response steps

  partialaws
• IR-06 (03)

  Security Hub finding workflow status plus GuardDuty detection coverage, showing incident response procedures are exercised: enabled insights, automated response actions routed through EventBridge, automated notifications, and Systems Manager Automation documents that encode response steps

  partialaws
• IR-07

  Security Hub finding workflow status plus GuardDuty detection coverage, showing incident response procedures are exercised: enabled insights, automated response actions routed through EventBridge, automated notifications, and Systems Manager Automation documents that encode response steps

  partialaws
• IR-07 (01)

  Security Hub finding workflow status plus GuardDuty detection coverage, showing incident response procedures are exercised: enabled insights, automated response actions routed through EventBridge, automated notifications, and Systems Manager Automation documents that encode response steps

  partialaws
• IR-08

  GuardDuty findings and Security Hub insight summaries that were reviewed, together with evidence that the findings fed into an after-action review cycle — AAR documents stored as versioned S3 objects with the incident IDs they reference

  partialaws
• IR-08 (01)

  Security Hub finding workflow status plus GuardDuty detection coverage, showing incident response procedures are exercised: enabled insights, automated response actions routed through EventBridge, automated notifications, and Systems Manager Automation documents that encode response steps

  partialaws
• MA-02

  Systems Manager Maintenance Windows and their execution history prove scheduled maintenance was defined, ran, and what it touched — the schedule, the tasks, the targets and the outcome of each run. The approval before the work, the review of maintenance records afterwards, and all physical maintenance and component replacement, which is AWS's responsibility, are outside that output.

  partiallev 7
• PL-08

  The security and privacy architecture description is a written artifact reviewed for coherence with the SSP; a resource inventory is evidence about the deployment, not about the document.

  narrativelev 7
• PL-09

  Organizations SCPs, a Config aggregator and Security Hub central configuration prove that management IS centralized; which controls the organization chose to manage centrally is an ODP a human states.

  partiallev 1
• PL-10

  Selecting a control baseline is a documented decision recorded in the SSP; no API states which baseline an authorization boundary claims.

  narrativelev 7
• PM-03

  No plane has read this control. Its candidate plane is named in docs/machine-readable-evidence-planes.md; nothing here dispositions it.

  lev 1
• PM-07

  No plane has read this control. Its candidate plane is named in docs/machine-readable-evidence-planes.md; nothing here dispositions it.

  lev 1
• PS-02

  Risk designations are assigned to positions in an HR system and reviewed against screening criteria; no AWS API knows what a position is.

  narrativelev 8
• PS-03

  Background screening happens before access is granted, in an HR or vendor system; AWS sees only the principal that results.

  narrativelev 8
• PS-04

  The state of every credential in the account as of a stated moment, the enabled-or-disabled status of every workforce identity in the identity store, and the CloudTrail record of the revocations themselves — the five API calls that actually revoke standing access, each with the time it happened and the administrator who did it

  partialaws
• PS-05

  What a transferred individual can still reach, and what they have actually used: the reassignment events themselves from CloudTrail (group membership, attached policy, and Identity Center account-assignment changes, each with its time and the administrator who made it), the current Identity Center assignments per permission set, and IAM's service-last-accessed report for the identities involved — a per-principal view of which services the identity is permitted to reach and which of those it has never authenticated to. `iam-access-analyzer-unused-access` answers the same question estate-wide from findings; this answers it for the named principal a transfer is about.

  partialaws
• PS-06

  A signed access agreement is a document a 3PAO reads; AWS holds no signature and no acknowledgement.

  narrativelev 9
• PS-07

  Requirements on third-party personnel live in contracts and in provider notifications of personnel changes, not in any AWS resource.

  narrativelev 7
• PS-08

  A sanctions process is an HR procedure invoked after a violation; nothing in an AWS account records that it ran.

  narrativelev 7
• PS-09

  Security roles and responsibilities are stated in position descriptions maintained entirely outside the system.

  narrativelev 7
• RA-03 (01)

  A supply chain risk assessment is an analysis someone writes about suppliers, components and services and then updates as the supply chain changes. AWS Artifact supplies inputs to it — third-party attestations and audit reports — but the assessment itself is the document a 3PAO reads, and no API produces one.

  narrativelev 7
• RA-05

  Patch Manager compliance state plus Amazon Inspector scan status and coverage — proving flaws are being found continuously (Inspector enabled and actually covering your resources) and that the fixes landed (per-node missing/failed patch counts and the time of the last scan or install)

  partialaws
• RA-05 (05)

  No plane has read this control. Its candidate plane is named in docs/machine-readable-evidence-planes.md; nothing here dispositions it.

  lev 5
• RA-05 (11)

  A public disclosure program is a published intake channel and a commitment to act on what arrives through it. A 3PAO reads the published policy, the disclosure page or security.txt, and the history of reports received and resolved; no AWS call reports that a reporting channel exists, let alone that anyone answered it.

  narrativelev 7
• SA-02

  No plane has read this control. Its candidate plane is named in docs/machine-readable-evidence-planes.md; nothing here dispositions it.

  lev 7
• SA-03

  The control asks that the system be acquired and built under a documented lifecycle, with security roles assigned and risk management integrated into each phase. None of those three is a property of the estate: a pipeline execution record names no lifecycle, assigns no role and integrates no risk decision, so it is not partial evidence of any limb — it is evidence of a different thing that happens to run alongside. The lifecycle definition, the role assignments and the phase gates live in the SSP and the acquisition record, and a 3PAO reads them there.

  narrativelev 8
• SA-05

  No plane has read this control. Its candidate plane is named in docs/machine-readable-evidence-planes.md; nothing here dispositions it.

  lev 7
• SA-08

  Which policy decisions were actually enforced against the infrastructure definitions the boundary deploys from: that a policy scan ran, on which branch, how many rules it applied and when it last ran, together with the failures still open and the record of which were dismissed and with what justification. The load-bearing half is the scan record rather than the findings. SA-08 asks whether security engineering principles were applied, and a clean findings list is the same output whether every principle held or the scan applied no rules, ran last quarter, or parsed nothing — so the count of rules run and the date it ran are the part of this evidence that makes the rest of it mean anything.

  partialpipeline
• SA-09

  The inventory half is already collected by this overlay — Access Analyzer enumerates every external principal trusted by the estate, and that is the same enumeration the AC-20 recipe performs. That each external provider MEETS the security requirements imposed on it is a statement about somebody else's estate, captured in the agreement CA-3 names, which is why the dataset's AC-20 guidance separates the three controls in the first place.

  partiallev 8
• SA-10

  The rules that made every change to the mainline arrive through a reviewed pull request, as a signed commit, onto a history that cannot be rewritten — together with the record of when those rules themselves last changed and who changed them, and the platform's own per-push record of any change that got past them.

  partialpipeline
• SA-11

  Whether static analysis is configured in this organization and which repositories it actually reaches; for each of those repositories, which query suite ran over which languages, whether the recurring schedule is still alive, when the analysis last ran and with how many rules in the run; and what the analysis found, split into what is still open and what a person closed by hand — each closure carrying who closed it, which of four fixed reasons they chose, and whatever they wrote down. The first two halves are the population and the proof that testing happened; the third is the half an assessment asks for, and read without the other two it cannot be told apart from the output of a scanner that never ran.

  partialpipeline
• SA-15 (03)

  The control asks the developer to perform a criticality analysis at defined decision points and at a defined level of rigor. No pipeline emits one: the analysis names which components are critical to mission function, which is a judgement about the mission rather than a property of the build. A dependency graph enumerates components and ranks none of them. A 3PAO reads the criticality analysis itself and the decision points recorded in the SDLC documentation.

  narrativelev 4
• SA-22

  The exact component-and-version inventory the boundary's repositories build from — every package the dependency graph resolved, carrying the version string that is the only thing SA-22's question can be asked about — together with whether that graph is switched on across the boundary at all, and then the open advisories for which the ecosystem offers no patched version, which is the closest thing a pipeline emits to a component nobody maintains any more. The inventory is the load-bearing half and it is why this recipe exists separately from the vulnerability one: "is this component past end of support" is a question about a name and a version, and a check that cannot produce the version has not asked it.

  partialpipeline
• SC-02

  No plane has read this control. Its candidate plane is named in docs/machine-readable-evidence-planes.md; nothing here dispositions it.

  lev 4
• SC-04

  The customer half is readable: EBS encryption-by-default, no snapshot or AMI shared beyond the account, and instance tenancy all bear on whether storage released by one workload reaches an unintended reader. The control's core — that nothing survives in memory or storage between one tenant's use of a shared resource and the next — is a hypervisor property inherited from AWS's own authorisation and read out of Artifact, never returned by a call against your account.

  partiallev 7
• SC-05

  The denial-of-service defences that are actually attached to the internet-facing resources — the Shield Advanced subscription and the list of resources it protects, the web ACL's rate-based rules and their limits, whether web ACL logging is on — plus what those defences observed: the attacks Shield recorded over the period and the CloudWatch detection and block counts underneath them

  partialaws
• SC-07

  AWS Config compliance results proving the network boundary is controlled — no security group exposes SSH to the internet, groups open to 0.0.0.0/0 only allow authorized ports, and every VPC's default security group denies all traffic

  partialaws
• SC-07 (03)

  Every route in or out of the boundary, named and counted — internet gateways, NAT gateways, VPC endpoints and Site-to-Site VPN tunnels — alongside what each boundary device does with traffic that matched no rule: the network ACL entries, the closed default security group, subnets that hand out public IPs, and the firewall policy's stateless and stateful default actions

  partialaws
• SC-07 (04)

  Every route in or out of the boundary, named and counted — internet gateways, NAT gateways, VPC endpoints and Site-to-Site VPN tunnels — alongside what each boundary device does with traffic that matched no rule: the network ACL entries, the closed default security group, subnets that hand out public IPs, and the firewall policy's stateless and stateful default actions

  partialaws
• SC-07 (05)

  Every route in or out of the boundary, named and counted — internet gateways, NAT gateways, VPC endpoints and Site-to-Site VPN tunnels — alongside what each boundary device does with traffic that matched no rule: the network ACL entries, the closed default security group, subnets that hand out public IPs, and the firewall policy's stateless and stateful default actions

  partialaws
• SC-07 (07)

  No plane has read this control. Its candidate plane is named in docs/machine-readable-evidence-planes.md; nothing here dispositions it.

  lev 4
• SC-07 (08)

  No plane has read this control. Its candidate plane is named in docs/machine-readable-evidence-planes.md; nothing here dispositions it.

  lev 4
• SC-08

  AWS Config compliance results proving data in transit is protected by TLS — S3 bucket policies denying non-TLS requests, load-balancer listeners restricted to SSL/HTTPS, and Redshift clusters requiring SSL

  partialaws
• SC-08 (01)

  Cryptographic protection in transit is a listener's SslPolicy name and a service's TLS setting, both readable per resource; FedRAMP's demand that the module be FIPS-validated is the same certificate-number limb SC-13 carries, looked up rather than returned. Dropped from config-encryption-in-transit on 2026-08-26, where no command read an SslPolicy.

  partiallev 7
• SC-10

  No plane has read this control. Its candidate plane is named in docs/machine-readable-evidence-planes.md; nothing here dispositions it.

  lev 5
• SC-12

  Generation and rotation are fields: GetKeyRotationStatus returns whether automatic rotation is enabled and its period, DescribeKey returns the origin — AWS_KMS meaning material generated inside the HSM that never leaves it — and the key policy is the access scoping written down. Destruction is not. DeletionDate is present only when a key is already scheduled for deletion and PendingDeletionWindowInDays only for a pending replica, so on an estate of healthy keys the fields an assertion would read are absent from the response and any claim about the destruction window is vacuously true; the window is a ScheduleKeyDeletion request parameter, not a key attribute. The deeper gap is the control's own wording — generation, distribution, storage, access and destruction are measured against organization-defined requirements, and this dataset carries no SC-12 parameter value, so the check compares KMS state to the SSP rather than to something in the output.

  partiallev 7
• SC-13

  AWS Config compliance results proving KMS customer-managed keys are lifecycle-managed — automatic annual rotation enabled and no active key scheduled for deletion — the key-hygiene half of the cryptographic-protection control

  partialaws
• SC-17

  No plane has read this control. Its candidate plane is named in docs/machine-readable-evidence-planes.md; nothing here dispositions it.

  lev 4
• SC-18

  For a service that ships code to a browser, the two things a pipeline can say about the mobile code it delivers: what was allowed INTO it, and whether what shipped is what this pipeline built. The first is the dependency diff for the change — every component added, its ecosystem, its version, its licence and any advisory against it, separated by whether it reaches the runtime or stops at the build — and the gate that makes the check mandatory rather than advisory. The second is a provenance attestation over the built bundle, verified against the repository and workflow that are supposed to have produced it. Neither is a statement about which mobile code technologies the organization decided to permit, and that is the control's first limb.

  partialpipeline
• SC-20

  DNSSEC signing status of every public hosted zone, with the key-signing key state and the DS record that carries the chain of trust to the parent

  partialaws
• SC-21

  Per-VPC DNSSEC validation status of the Route 53 Resolver, joined against the full VPC inventory so that a VPC which never enabled validation is visible rather than absent

  partialaws
• SC-22

  The hosted zones that serve name resolution, each marked private or public so internal and external resolution can be shown to be served by separate zones, and the Resolver endpoints that carry queries across the VPC boundary with their direction and operational status

  partialaws
• SC-23

  Every place a client session terminates, with the protocol and negotiated policy it terminates under: listener protocol and SslPolicy on each load balancer, HTTP listeners that redirect rather than serve, an ACM certificate behind each one, and CloudFront viewer policies that refuse plain HTTP

  partialaws
• SC-28

  AWS Config compliance results across the storage services proving customer data is encrypted at rest — S3 buckets with default server-side encryption, EBS volumes encrypted, and RDS storage encrypted, all backed by KMS

  partialaws
• SC-28 (01)

  Key-backed encryption is readable: ENCRYPTED_VOLUMES and RDS_STORAGE_ENCRYPTED take a kmsId/kmsKeyId parameter, and GetBucketEncryption returns the SSEAlgorithm and key. The information this enhancement protects is an SSP list, and which key ownership counts as the organization's is a policy. Dropped from config-encryption-at-rest on 2026-08-26, where no key was asserted and the S3 rule could not fail.

  partiallev 7
• SC-39

  A separate execution domain per process is a property of the Nitro hypervisor and the guest operating system, not a setting anyone can query. A 3PAO reads AWS's own FedRAMP authorization package for the hypervisor boundary and your architecture description for the guest side; no customer-invocable API reports process isolation.

  narrativelev 9
• SI-02

  Patch Manager compliance state plus Amazon Inspector scan status and coverage — proving flaws are being found continuously (Inspector enabled and actually covering your resources) and that the fixes landed (per-node missing/failed patch counts and the time of the last scan or install)

  partialaws
• SI-02 (02)

  No plane has read this control. Its candidate plane is named in docs/machine-readable-evidence-planes.md; nothing here dispositions it.

  lev 4
• SI-03

  Whether malware scanning is switched on for compute and for the buckets that accept uploads, plus the scan-by-scan record of what was actually examined and what came back INFECTED

  partialaws
• SI-04

  AWS Config compliance results proving continuous security monitoring is switched on account-wide — GuardDuty threat detection enabled (optionally centralized to a delegated admin) and Security Hub aggregating control findings

  partialaws
• SI-04 (02)

  No plane has read this control. Its candidate plane is named in docs/machine-readable-evidence-planes.md; nothing here dispositions it.

  lev 4
• SI-04 (04)

  No plane has read this control. Its candidate plane is named in docs/machine-readable-evidence-planes.md; nothing here dispositions it.

  lev 6
• SI-04 (05)

  Security Hub finding workflow status plus GuardDuty detection coverage, showing incident response procedures are exercised: enabled insights, automated response actions routed through EventBridge, automated notifications, and Systems Manager Automation documents that encode response steps

  partialaws
• SI-05

  The advisories AWS itself has issued against this account — operational issues, scheduled changes and account notifications, each dated and scoped — together with the subscribers on the topic those alerts are published to and the confirmation state of each subscription, which is the difference between an address that was entered and an address that receives

  partialaws
• SI-07

  Cryptographic proof that the audit trail CloudTrail delivered has not been altered or deleted, plus the compliance state of the write-once controls that make stored records and container images tamper-evident

  partialaws
• SI-07 (01)

  Cryptographic proof that the audit trail CloudTrail delivered has not been altered or deleted, plus the compliance state of the write-once controls that make stored records and container images tamper-evident

  partialaws
• SI-07 (07)

  For each artifact actually running in the boundary, the cryptographic answer to whether it came from the build this provider claims built it: the signed provenance statement, the certificate identifying the workflow that produced it, and the transparency-log timestamps that make the signature checkable later. Collected alongside the two things that decide whether that answer can be trusted at all — the version of the verifying client, and the record of which deployed artifacts were submitted for verification in the first place.

  partialpipeline
• SI-08

  No plane has read this control. Its candidate plane is named in docs/machine-readable-evidence-planes.md; nothing here dispositions it.

  lev 5
• SI-08 (02)

  No plane has read this control. Its candidate plane is named in docs/machine-readable-evidence-planes.md; nothing here dispositions it.

  lev 4
• SI-10

  Which taint-tracking ruleset actually ran over this repository — the query suite, the languages selected, and the threat model that decides what counts as an untrusted source — together with whether the recurring scan is still scheduled, when it last ran per analysed language, and how many rules were in the run; and then the open findings in the injection families SI-10 is about, identified by the CWE tags the queries carry. The ruleset and the freshness are the load-bearing half: a finding names a sink that exists, but only the run record says the absence of findings means anything at all.

  partialpipeline
• SI-11

  Whether the queries that find information disclosure through an error message or a stack trace ran over this part of the boundary — which languages were selected, whether the recurring scan is still scheduled and when it last completed — and then the open findings those queries produced, identified by the CWE tags the queries carry rather than by their names. The run record is the load-bearing half here as it is on every scanning recipe: a finding names a leak that exists, and only the record of a scan having run over a selected language makes the absence of findings a statement about anything.

  partialpipeline
• SI-12

  Retention is set where it is enforced and every setting is readable: CloudWatch Logs retention in days, S3 lifecycle rules and Object Lock, and a Backup vault locked IN COMPLIANCE MODE, whose MinRetentionDays and MaxRetentionDays cannot be shortened by anyone, including the root user, once the grace time expires — a governance-mode lock is removable by any principal holding the IAM permission, so the mode is load-bearing rather than decorative. How long the information is REQUIRED to be kept comes from the records schedule and the law behind it, and that number arrives from outside AWS.

  partiallev 7
• SI-12 (03)

  No plane has read this control. Its candidate plane is named in docs/machine-readable-evidence-planes.md; nothing here dispositions it.

  lev 1
• SI-16

  No plane has read this control. Its candidate plane is named in docs/machine-readable-evidence-planes.md; nothing here dispositions it.

  lev 5
• SI-18 (04)

  No plane has read this control. Its candidate plane is named in docs/machine-readable-evidence-planes.md; nothing here dispositions it.

  lev 1
• SR-02 (01)

  The control establishes a supply chain risk management team — organization-defined personnel, roles and responsibilities, leading defined SCRM activities. Nothing a pipeline emits evidences a team's existence or its charter. Recorded against the plan rather than silently: `docs/automation-beyond-aws.md` §P5 lists SR-02 (01) among the controls build attestation bears on, and `docs/code-scanning-overlay-plan.md` step 8 carries that into the attestation authoring batch. The control text does not support it. The attestation argument belongs to si-7.7 on its detection limb; KSI-SVC-VRI, which asks for cryptographic validation of integrity, reaches si-7 and si-7.1 instead — both already covered by an AWS partial recipe, which is where a pipeline attestation recipe would sit beside rather than replace one. A 3PAO reads the SCRM plan and the team's charter.

  narrativelev 7
• SR-05

  Whether the tooling that examines acquired software is switched on and covering the estate, and what it found: Inspector's per-account enablement state for each scanned resource type, the registry-wide ECR scanning configuration (scan type and frequency, and the repository filters that decide which repositories it applies to), Inspector's own coverage statistics, and a CycloneDX 1.4 or SPDX 2.3 SBOM exported per monitored resource — the component-level inventory of what was actually acquired.

  partialaws
• SR-06

  Whether Dependabot alerting is configured in this organization and which repositories it actually reaches, together with the alerts themselves — each carrying the advisory that raised it, the package, ecosystem and manifest path it was found in, the reason a human gave for closing it, and, for a remediated one, the date it was fixed. The first half is the population; the second half is what was found in it, and the second half means nothing without the first.

  partialpipeline
• SR-08

  The organization's webhook configuration — which endpoints are subscribed to the supply-chain alert event, whether each is switched on, and where it points — together with the platform's own record of what it actually delivered to them and with what response code. Configuration says a path exists; the delivery log says the path carried something.

  partialpipeline
• SR-10

  Inspecting hardware for tampering is AWS's responsibility under the shared model, evidenced by its own authorization package rather than by anything you can call. The customer-side inspection — when components are examined, by whom, and what indication of need triggered it — is a documented procedure and its records, which is what a 3PAO reads.

  narrativelev 9
• SR-11 (01)

  No plane has read this control. Its candidate plane is named in docs/machine-readable-evidence-planes.md; nothing here dispositions it.

  lev 7