TheArtOfService
ASD Strategies to Mitigate Cyber Security IncidentsFedRAMP Moderate

ASD Strategies to Mitigate Cyber Security Incidents covers 14.9% of FedRAMP Moderate

48 of the 323 controls in FedRAMP Moderate are already satisfied by evidence you collected for ASD Strategies to Mitigate Cyber Security Incidents. 275 are genuine gaps. Every claim below was judged against both control sets and then argued against; the ones that did not survive are published further down with the reason each failed.

14.9%
of the target already covered
48
controls evidenced
275
genuine gaps
0
claims rejected in review

This number is directional. It says how much of FedRAMP Moderate your ASD Strategies to Mitigate Cyber Security Incidents evidence satisfies. The reverse pair is a different number, often very different, because a security standard has enormous depth for access control and almost none for lawful basis or data subject rights.

84 candidate mappings were examined and 0 were removed. Signed off 2026-08-19, review level machine verified. Mappings were judged by Claude Code rather than read line by line by a practitioner. Every claim shows its reasoning so you can check it. Ask and a practitioner will review this pair.

Where the gaps are

Coverage is never evenly spread. A source standard usually satisfies one part of a target almost completely and barely touches another, and which part is which is the thing worth knowing before you plan the work.

SI - System and Information Integrity10 of 24 evidenced, 14 to do
AT - Awareness and Training2 of 6 evidenced, 4 to do
CP - Contingency Planning6 of 23 evidenced, 17 to do
CM - Configuration Management6 of 27 evidenced, 21 to do
AU - Audit and Accountability3 of 16 evidenced, 13 to do
SC - System and Communications Protection5 of 29 evidenced, 24 to do
AC - Access Control7 of 43 evidenced, 36 to do
IA - Identification and Authentication4 of 27 evidenced, 23 to do
MP - Media Protection1 of 7 evidenced, 6 to do
IR - Incident Response2 of 17 evidenced, 15 to do
PS - Personnel Security1 of 10 evidenced, 9 to do
RA - Risk Assessment1 of 11 evidenced, 10 to do
CA - Assessment, Authorization, and Monitoring0 of 14 evidenced, 14 to do
MA - Maintenance0 of 10 evidenced, 10 to do
PE - Physical and Environmental Protection0 of 19 evidenced, 19 to do
PL - Planning0 of 7 evidenced, 7 to do
SA - System and Services Acquisition0 of 21 evidenced, 21 to do
SR - Supply Chain Risk Management0 of 12 evidenced, 12 to do

Theme level, not control level, deliberately. The per-control list of what is evidenced and what is a gap is the report itself, so publishing it here would be publishing the thing being sold.

Claims that held

A sample. Each one names the control whose evidence does the work, the control it satisfies, and why.

ASD37-08AC-17(3)argued against and upheld
Managed Access Control Points

ASD routes traffic through a content-checking proxy rather than arbitrary access points.

ASD37-13AC-20(2)argued against and upheld
Portable Storage Devices Restricted Use

ASD controls removable storage media and blocks USB storage devices on computers.

ASD37-18AC-3argued against and upheld
Access Enforcement

ASD enforces access to operating systems and applications strictly according to user duties.

ASD37-27AC-4argued against and upheld
Information Flow Enforcement

Outbound data loss prevention blocks flows of large or sensitive data that policy disallows.

ASD37-22AC-4argued against and upheld
Information Flow Enforcement

ASD denies traffic between computers unless required, enforcing flow control between systems.

ASD37-08AC-4argued against and upheld
Information Flow Enforcement

Denying direct internet connectivity forces flows through a controlled proxy interface.

ASD37-22AC-4(21)argued against and upheld
Physical or Logical Separation of Information Flows

ASD segmentation and segregation separates information flows logically or physically.

ASD37-18AC-6argued against and upheld
Least Privilege

ASD grants privileges only for assigned duties and revalidates the need regularly.

Claims that did not hold

Nothing proposed for this pair was rejected in review. That is unusual and worth knowing rather than hiding: it means the candidate set was small and every candidate held.

The full report

Everything above is a sample. The report is every evidenced control and every gap, with the reasoning and the source document behind each one, in a form you can hand to an assessor. $299, emailed immediately.

Buy this crosswalk