AWS Well-Architected Security PillarFedRAMP Moderate

AWS Well-Architected Security Pillar covers 23.5% of FedRAMP Moderate

76 of the 323 controls in FedRAMP Moderate are already satisfied by evidence you collected for AWS Well-Architected Security Pillar. 247 are genuine gaps. Every claim below was judged against both control sets and then argued against; the ones that did not survive are published further down with the reason each failed.

23.5%

of the target already covered

controls evidenced

247

genuine gaps

claims rejected in review

This number is directional. It says how much of FedRAMP Moderate your AWS Well-Architected Security Pillar evidence satisfies. The reverse pair is a different number, often very different, because a security standard has enormous depth for access control and almost none for lawful basis or data subject rights.

184 candidate mappings were examined and 1 were removed. Signed off 2026-08-19, review level machine verified. Mappings were judged by Claude Code rather than read line by line by a practitioner. Every claim shows its reasoning so you can check it. Ask and a practitioner will review this pair.

Where the gaps are

Coverage is never evenly spread. A source standard usually satisfies one part of a target almost completely and barely touches another, and which part is which is the thing worth knowing before you plan the work.

AU - Audit and Accountability8 of 16 evidenced, 8 to do

CM - Configuration Management13 of 27 evidenced, 14 to do

SI - System and Information Integrity11 of 24 evidenced, 13 to do

IR - Incident Response6 of 17 evidenced, 11 to do

AC - Access Control14 of 43 evidenced, 29 to do

SC - System and Communications Protection9 of 29 evidenced, 20 to do

IA - Identification and Authentication8 of 27 evidenced, 19 to do

RA - Risk Assessment3 of 11 evidenced, 8 to do

SA - System and Services Acquisition3 of 21 evidenced, 18 to do

CA - Assessment, Authorization, and Monitoring1 of 14 evidenced, 13 to do

AT - Awareness and Training0 of 6 evidenced, 6 to do

CP - Contingency Planning0 of 23 evidenced, 23 to do

MA - Maintenance0 of 10 evidenced, 10 to do

MP - Media Protection0 of 7 evidenced, 7 to do

PE - Physical and Environmental Protection0 of 19 evidenced, 19 to do

PL - Planning0 of 7 evidenced, 7 to do

PS - Personnel Security0 of 10 evidenced, 10 to do

SR - Supply Chain Risk Management0 of 12 evidenced, 12 to do

Theme level, not control level, deliberately. The per-control list of what is evidenced and what is a gap is the report itself, so publishing it here would be publishing the thing being sold.

Claims that held

A sample. Each one names the control whose evidence does the work, the control it satisfies, and why.

SEC 6: How do you protect your compute resources? | SEC06-BP03AC-17(1)argued against and upheld

Monitoring and Control

Automated session tooling with restricted interactive access monitors and controls remote access.

SEC 3: How do you manage permissions for people and machines? | SEC03-BP06AC-2argued against and upheld

Account Management

Joiner mover leaver driven grant and revoke is the account management process an assessor tests.

SEC 2: How do you manage identities for people and machines? | SEC02-BP04AC-2(1)argued against and upheld

Automated System Account Management

Federated identity provider provisioning is the automated account management mechanism required here.

SEC 2: How do you manage identities for people and machines? | SEC02-BP02AC-2(2)argued against and upheld

Automated Temporary and Emergency Account Management

Short lived credentials expire automatically, satisfying automatic disablement of temporary accounts.

SEC 3: How do you manage permissions for people and machines? | SEC03-BP06AC-2(3)argued against and upheld

Disable Accounts

Leaver driven revocation directly evidences disabling accounts no longer required.

SEC 2: How do you manage identities for people and machines? | SEC02-BP05AC-2(3)argued against and upheld

Disable Accounts

Unused credential findings and stale user removal evidence inactivity based disablement.

SEC 2: How do you manage identities for people and machines? | SEC02-BP06AC-2(7)argued against and upheld

Privileged User Accounts

Permission sets and role based assignment are the privileged account administration scheme tested.

SEC 3: How do you manage permissions for people and machines? | SEC03-BP07AC-21argued against and upheld

Information Sharing

Access Analyzer findings validated against documented intent is exactly the sharing authorization check.

Claims that did not hold

1 proposed mappings for this pair were rejected. They are kept in the graph rather than deleted, so what was thrown out is as inspectable as what survived. A crosswalk that never rejects anything is not being judged.

SEC 4: How do you detect and investigate security events? | SEC04-BP02SA-2

Allocation of Resources

control identity corrected 2026-08-19: FedRAMP SA-2 held the title 'Common Operating Picture' and the text 'Establish a common operating picture across IT, OT and physical security functions for cyber events.', which is not a NIST SP 800-53 Rev 5 control. SA-2 is Allocation of Resources: determine the high-level security and privacy requirements in mission and business process planning, determine, document and allocate the protecting resources through capital planning and investment control, and establish a discrete line item for information security and privacy in programming and budgeting documentation. This mapping was judged against the wrong requirement, so its judgement is void. The claim on record was that SEC04-BP02 (AWS Well-Architected Security Pillar) evidences SA-2 at medium confidence; it does not evidence resource determination, allocation or a budget line item.

Claimed at medium confidence before it was rejected.

The full report

Everything above is a sample. The report is every evidenced control and every gap, with the reasoning and the source document behind each one, in a form you can hand to an assessor. $299, emailed immediately.

Buy this crosswalk