What you can’t automate
60 of the 155 class Bbaseline controls are reached by no KSI. No machine-validated 20x evidence maps to them, so they stay narrative in your Security Decision Record — this is the writing workload, stated up front so nothing over-claims automation it doesn’t have.
orphan controls
60
families involved
18
% of baseline
39%
AT
1 controlAU
1 controlCA
3 controlsCP
1 controlIR
1 controlPL
5 controlsPS
1 controlSA
3 controlsSI
1 controlThe KSI-covered controls, with the AWS calls that prove them, are back on the class B evidence plan.