TheArtOfService
APPINIST SP 800-53 Rev 5

APPI covers 4% of NIST SP 800-53 Rev 5

12 of the 300 controls in NIST SP 800-53 Rev 5 are already satisfied by evidence you collected for APPI. 288 are genuine gaps. Every claim below was judged against both control sets and then argued against; the ones that did not survive are published further down with the reason each failed.

4%
of the target already covered
12
controls evidenced
288
genuine gaps
0
claims rejected in review

What this leaves you to do

NIST SP 800-53 Rev 5 has 300 controls. Holding APPI already evidences 12 of them, so the work in front of you is 288 controls, not 300, which is 96% of the standard rather than all of it.

That is the whole claim. We do not know your hourly rate, how long a control takes you, or how many people you have, so there is no figure here in dollars or weeks. Every number in that sentence comes from the two counts above it and can be re-derived from the free tools without taking our word for any of it.

This number is directional. It says how much of NIST SP 800-53 Rev 5 your APPI evidence satisfies. The reverse pair is a different number, often very different, because a security standard has enormous depth for access control and almost none for lawful basis or data subject rights.

32 candidate mappings were examined and 0 were removed. Signed off 2026-08-19, review level machine verified. Mappings were judged by Claude Code rather than read line by line by a practitioner. Every claim shows its reasoning so you can check it. Ask and a practitioner will review this pair.

Where the gaps are

Coverage is never evenly spread. A source standard usually satisfies one part of a target almost completely and barely touches another, and which part is which is the thing worth knowing before you plan the work.

PT - PII Processing and Transparency5 of 8 evidenced, 3 to do
SI - System and Information Integrity3 of 22 evidenced, 19 to do
IR - Incident Response1 of 9 evidenced, 8 to do
PM - Program Management3 of 32 evidenced, 29 to do
AC - Access Control0 of 23 evidenced, 23 to do
AT - Awareness and Training0 of 5 evidenced, 5 to do
AU - Audit and Accountability0 of 15 evidenced, 15 to do
CA - Assessment, Authorization, and Monitoring0 of 8 evidenced, 8 to do
CM - Configuration Management0 of 14 evidenced, 14 to do
CP - Contingency Planning0 of 12 evidenced, 12 to do
IA - Identification and Authentication0 of 13 evidenced, 13 to do
MA - Maintenance0 of 7 evidenced, 7 to do
MP - Media Protection0 of 8 evidenced, 8 to do
PE - Physical and Environmental Protection0 of 22 evidenced, 22 to do
PL - Planning0 of 8 evidenced, 8 to do
PS - Personnel Security0 of 9 evidenced, 9 to do
RA - Risk Assessment0 of 9 evidenced, 9 to do
SA - System and Services Acquisition0 of 17 evidenced, 17 to do
SC - System and Communications Protection0 of 47 evidenced, 47 to do
SR - Supply Chain Risk Management0 of 12 evidenced, 12 to do

Theme level, not control level, deliberately. The per-control list of what is evidenced and what is a gap is the report itself, so publishing it here would be publishing the thing being sold.

Claims that held

A sample. Each one names the control whose evidence does the work, the control it satisfies, and why.

Article 26NIST800-IR-6argued against and upheld
Incident reporting

Article 26 requires leakage be reported to the Commission and notified to the person.

Article 33NIST800-PM-21argued against and upheld
Accounting of Disclosures. Develop and maintain an accurate accounting of disclosures of personally identifiable information, including: Date, nature, and purpose of each disclosure; and Name and address, or other contact information of the individual

Article 33 requires third party provision records be disclosed to the person on request.

Article 29NIST800-PM-21argued against and upheld
Accounting of Disclosures. Develop and maintain an accurate accounting of disclosures of personally identifiable information, including: Date, nature, and purpose of each disclosure; and Name and address, or other contact information of the individual

Article 29 requires a retained record of date, recipient and prescribed matters for each provision.

Article 34NIST800-PM-22argued against and upheld
Personally Identifiable Information Quality Management. Develop and document organization-wide policies and procedures for: Reviewing for the accuracy, relevance, timeliness, and completeness of personally identifiable information across the information life cycle; Correcting or deleting inaccurate

Article 34 requires investigation and correction, addition or deletion of inaccurate data.

Article 22NIST800-PM-22argued against and upheld
Personally Identifiable Information Quality Management. Develop and document organization-wide policies and procedures for: Reviewing for the accuracy, relevance, timeliness, and completeness of personally identifiable information across the information life cycle; Correcting or deleting inaccurate

Article 22 requires personal data be kept accurate and up to date and deleted when unneeded.

Article 40NIST800-PM-26argued against and upheld
Complaint Management. Implement a process for receiving and responding to complaints, concerns, or questions from individuals about the organizational security and privacy practices that includes: Mechanisms that are easy to use and readily accessible

Article 40 requires complaints be handled appropriately and promptly with a supporting system.

Article 18NIST800-PT-2argued against and upheld
Authority to Process Personally Identifiable Information. Determine and document the [organization-defined] that permits the [organization-defined] of personally identifiable information; and Restrict the [organization-defined] of personally identifiable information to only that which is authorized

Article 18 restricts handling to the authorised purpose absent the person's prior consent.

Article 17NIST800-PT-2argued against and upheld
Authority to Process Personally Identifiable Information. Determine and document the [organization-defined] that permits the [organization-defined] of personally identifiable information; and Restrict the [organization-defined] of personally identifiable information to only that which is authorized

Article 17 fixes the authorised scope of processing by specifying the purpose of use.

Claims that did not hold

Nothing proposed for this pair was rejected in review. That is unusual and worth knowing rather than hiding: it means the candidate set was small and every candidate held.

The full report

Everything above is a sample. The report is every evidenced control and every gap, with the reasoning and the source document behind each one, in a form you can hand to an assessor. $299, emailed immediately.

Buy this crosswalk