What you can’t automate
123 of the 322 class Cbaseline controls are reached by no KSI. No machine-validated 20x evidence maps to them, so they stay narrative in your Security Decision Record — this is the writing workload, stated up front so nothing over-claims automation it doesn’t have.
orphan controls
123
families involved
18
% of baseline
38%
AC
14 controlsAT
1 controlAU
1 controlCA
6 controlsCP
1 controlIA
8 controlsIR
5 controlsMA
9 controlsPE
19 controlsPL
5 controlsPS
2 controlsRA
7 controlsSA
12 controlsSC
6 controlsSI
7 controlsThe KSI-covered controls, with the AWS calls that prove them, are back on the class C evidence plan.