TheArtOfService
Australia Consumer Data Right - Banking (CDR)FedRAMP Moderate

Australia Consumer Data Right - Banking (CDR) covers 8% of FedRAMP Moderate

26 of the 323 controls in FedRAMP Moderate are already satisfied by evidence you collected for Australia Consumer Data Right - Banking (CDR). 297 are genuine gaps. Every claim below was judged against both control sets and then argued against; the ones that did not survive are published further down with the reason each failed.

8%
of the target already covered
26
controls evidenced
297
genuine gaps
0
claims rejected in review

This number is directional. It says how much of FedRAMP Moderate your Australia Consumer Data Right - Banking (CDR) evidence satisfies. The reverse pair is a different number, often very different, because a security standard has enormous depth for access control and almost none for lawful basis or data subject rights.

54 candidate mappings were examined and 0 were removed. Signed off 2026-08-19, review level machine verified. Mappings were judged by Claude Code rather than read line by line by a practitioner. Every claim shows its reasoning so you can check it. Ask and a practitioner will review this pair.

Where the gaps are

Coverage is never evenly spread. A source standard usually satisfies one part of a target almost completely and barely touches another, and which part is which is the thing worth knowing before you plan the work.

PL - Planning3 of 7 evidenced, 4 to do
AT - Awareness and Training2 of 6 evidenced, 4 to do
CA - Assessment, Authorization, and Monitoring3 of 14 evidenced, 11 to do
IR - Incident Response3 of 17 evidenced, 14 to do
SI - System and Information Integrity4 of 24 evidenced, 20 to do
MP - Media Protection1 of 7 evidenced, 6 to do
SC - System and Communications Protection3 of 29 evidenced, 26 to do
RA - Risk Assessment1 of 11 evidenced, 10 to do
CM - Configuration Management2 of 27 evidenced, 25 to do
SA - System and Services Acquisition1 of 21 evidenced, 20 to do
AC - Access Control2 of 43 evidenced, 41 to do
IA - Identification and Authentication1 of 27 evidenced, 26 to do
AU - Audit and Accountability0 of 16 evidenced, 16 to do
CP - Contingency Planning0 of 23 evidenced, 23 to do
MA - Maintenance0 of 10 evidenced, 10 to do
PE - Physical and Environmental Protection0 of 19 evidenced, 19 to do
PS - Personnel Security0 of 10 evidenced, 10 to do
SR - Supply Chain Risk Management0 of 12 evidenced, 12 to do

Theme level, not control level, deliberately. The per-control list of what is evidenced and what is a gap is the report itself, so publishing it here would be publishing the thing being sold.

Claims that held

A sample. Each one names the control whose evidence does the work, the control it satisfies, and why.

AUCDR-IS-1AC-2argued against and upheld
Account Management

Control 1 requires unique identifiers and managed access to the data environment.

AUCDR-IS-1AC-6argued against and upheld
Least Privilege

Control 1 requires role based access and restriction of administrative privileges.

AUCDR-IS-6AT-2argued against and upheld
Literacy Training and Awareness

Control 6 requires a formal security training and awareness program for all personnel.

AUCDR-IS-6AT-3argued against and upheld
Role-Based Training

Control 6 requires training tuned to personnel who interact with CDR data.

AUCDR-IS-STEP4CA-2argued against and upheld
Control Assessments

Step 4 requires a program assessing control design and operating effectiveness.

AUCDR-IS-STEP4CA-7argued against and upheld
Continuous Monitoring

Step 4 requires ongoing monitoring and evaluation of the security capability.

AUCDR-IS-STEP4CA-8argued against and upheld
Penetration Testing

Step 4 requires effectiveness testing performed by independent skilled testers.

AUCDR-IS-5CM-7argued against and upheld
Least Functionality

Control 5 requires application whitelisting restricting what may execute.

Claims that did not hold

Nothing proposed for this pair was rejected in review. That is unusual and worth knowing rather than hiding: it means the candidate set was small and every candidate held.

The full report

Everything above is a sample. The report is every evidenced control and every gap, with the reasoning and the source document behind each one, in a form you can hand to an assessor. $299, emailed immediately.

Buy this crosswalk