What you can’t automate
210 of the 409 class Dbaseline controls are reached by no KSI. No machine-validated 20x evidence maps to them, so they stay narrative in your Security Decision Record — this is the writing workload, stated up front so nothing over-claims automation it doesn’t have.
orphan controls
210
families involved
18
% of baseline
51%
AC
21 controlsAC-02 (07) — in annual assessmentAC-02 (09) — in annual assessmentAC-02 (11) — in annual assessmentAC-02 (12) — in annual assessmentAC-04 (04)AC-04 (21)AC-06 (03) — in annual assessmentAC-06 (08) — in annual assessmentAC-08AC-10AC-11AC-11 (01)AC-17 (04)AC-18AC-18 (04)AC-18 (05)AC-19AC-19 (05)AC-20 (02)AC-21AC-22
AT
1 controlAU
12 controlsAU-01AU-05 (01) — in annual assessmentAU-05 (02) — in annual assessmentAU-06 (04) — in annual assessmentAU-06 (05) — in annual assessmentAU-06 (06) — in annual assessmentAU-06 (07) — in annual assessmentAU-09 (02)AU-09 (03)AU-10 — in annual assessmentAU-12 (01) — in annual assessmentAU-12 (03) — in annual assessment
CA
8 controlsCM
14 controlsCP
13 controlsIA
11 controlsIR
12 controlsMA
11 controlsPE
26 controlsPL
5 controlsPS
3 controlsRA
9 controlsSA
16 controlsSC
12 controlsSI
18 controlsSI-01SI-02 (03)SI-04 (01) — in annual assessmentSI-04 (10) — in annual assessmentSI-04 (11)SI-04 (12)SI-04 (14)SI-04 (16) — in annual assessmentSI-04 (18)SI-04 (19) — in annual assessmentSI-04 (20) — in annual assessmentSI-04 (22)SI-04 (23) — in annual assessmentSI-05 (01)SI-06 — in annual assessmentSI-07 (02)SI-07 (05)SI-07 (15)
The KSI-covered controls, with the AWS calls that prove them, are back on the class D evidence plan.