TheArtOfService
C5 (Germany)FedRAMP Moderate

C5 (Germany) covers 37.2% of FedRAMP Moderate

120 of the 323 controls in FedRAMP Moderate are already satisfied by evidence you collected for C5 (Germany). 203 are genuine gaps. Every claim below was judged against both control sets and then argued against; the ones that did not survive are published further down with the reason each failed.

37.2%
of the target already covered
120
controls evidenced
203
genuine gaps
6
claims rejected in review

This number is directional. It says how much of FedRAMP Moderate your C5 (Germany) evidence satisfies. The reverse pair is a different number, often very different, because a security standard has enormous depth for access control and almost none for lawful basis or data subject rights.

239 candidate mappings were examined and 6 were removed. Signed off 2026-08-19, review level machine verified. Mappings were judged by Claude Code rather than read line by line by a practitioner. Every claim shows its reasoning so you can check it. Ask and a practitioner will review this pair.

Where the gaps are

Coverage is never evenly spread. A source standard usually satisfies one part of a target almost completely and barely touches another, and which part is which is the thing worth knowing before you plan the work.

PS - Personnel Security6 of 10 evidenced, 4 to do
AU - Audit and Accountability9 of 16 evidenced, 7 to do
RA - Risk Assessment6 of 11 evidenced, 5 to do
CP - Contingency Planning12 of 23 evidenced, 11 to do
AT - Awareness and Training3 of 6 evidenced, 3 to do
PE - Physical and Environmental Protection9 of 19 evidenced, 10 to do
MP - Media Protection3 of 7 evidenced, 4 to do
AC - Access Control18 of 43 evidenced, 25 to do
SR - Supply Chain Risk Management5 of 12 evidenced, 7 to do
SC - System and Communications Protection11 of 29 evidenced, 18 to do
CM - Configuration Management10 of 27 evidenced, 17 to do
IR - Incident Response5 of 17 evidenced, 12 to do
CA - Assessment, Authorization, and Monitoring4 of 14 evidenced, 10 to do
PL - Planning2 of 7 evidenced, 5 to do
SI - System and Information Integrity6 of 24 evidenced, 18 to do
SA - System and Services Acquisition5 of 21 evidenced, 16 to do
IA - Identification and Authentication6 of 27 evidenced, 21 to do
MA - Maintenance0 of 10 evidenced, 10 to do

Theme level, not control level, deliberately. The per-control list of what is evidenced and what is a gap is the report itself, so publishing it here would be publishing the thing being sold.

Claims that held

A sample. Each one names the control whose evidence does the work, the control it satisfies, and why.

C5-IDM-01AC-1argued against and upheld
Policy and Procedures

C5 requires a documented role and rights concept and access management policy issued to those it binds.

C5-PSS-06AC-12argued against and upheld
Session Termination

C5 invalidates a session once detected as inactive using a configurable timeout.

C5-COS-04AC-17argued against and upheld
Remote Access

C5 grants cross network access only on the basis of a security assessment, with gateways at every perimeter.

C5-COS-03AC-17(1)argued against and upheld
Monitoring and Control

C5 configures physical and virtual networks to restrict and monitor connections, reassessed annually.

C5-CRY-02AC-17(2)argued against and upheld
Protection of Confidentiality and Integrity Using Encryption

C5 applies strong encryption and authentication to data transmitted over public networks.

C5-COS-05AC-17(3)argued against and upheld
Managed Access Control Points

C5 runs administration consoles on separated networks reachable only with multi-factor authentication.

C5-IDM-06AC-17(4)argued against and upheld
Privileged Commands and Access

C5 issues privileged access personally for a limited period with activity logged and misuse alerted.

C5-IDM-03AC-2argued against and upheld
Account Management

C5 locks accounts unused for two months and revokes them after six, a named account management step.

Claims that did not hold

6 proposed mappings for this pair were rejected. They are kept in the graph rather than deleted, so what was thrown out is as inspectable as what survived. A crosswalk that never rejects anything is not being judged.

C5-IDM-03AC-7
Unsuccessful Logon Attempts

judged against C5 criterion titles before the framework carried requirement text; does not hold against the real criterion; the C5 criterion title names failed logins but its basic criterion covers only dormancy, locking after two months unused and revoking after six; C5 sets no failed logon threshold or lockout duration

Claimed at high confidence before it was rejected.

C5-OPS-13AU-2
Event Logging

judged against C5 criterion titles before the framework carried requirement text; does not hold against the real criterion; C5-OPS-13 requires automated analysis and correlation of log data, not the selection and annual review of which event types are logged, which is OPS-10

Claimed at high confidence before it was rejected.

C5-OPS-16AU-6(1)
Automated Process Integration

judged against C5 criterion titles before the framework carried requirement text; does not hold against the real criterion; C5-OPS-16 restricts access to the logging systems and puts their configuration under change management; it says nothing about integrating audit review with automated mechanisms

Claimed at high confidence before it was rejected.

C5-IDM-08IA-5(7)
Authenticator Management | No Embedded Unencrypted Static Authenticators. Ensure that unencrypted static authenticators are not embedded in applications or other forms of static storage

judged against C5 criterion titles before the framework carried requirement text; does not hold against the real criterion; C5-IDM-08 covers controlled handout, forced replacement and hashed storage of authentication secrets; it says nothing about static authenticators embedded in applications or static storage

Claimed at high confidence before it was rejected.

C5-PS-07PE-6(1)
Monitoring Physical Access | Intrusion Alarms and Surveillance Equipment. Monitor physical access to the facility where the system resides using physical intrusion alarms and surveillance equipment

judged against C5 criterion titles before the framework carried requirement text; does not hold against the real criterion; C5-PS-07 monitors operating and environmental parameters of technical utilities, not physical access; video surveillance and anti-burglary systems appear only in PS-03's additional criterion

Claimed at high confidence before it was rejected.

C5-OPS-16SI-4(5)
System-Generated Alerts

judged against C5 criterion titles before the framework carried requirement text; does not hold against the real criterion; C5-OPS-16 restricts access to the logging and monitoring components and controls their configuration changes; automatic alerting on compromise indications is OPS-13

Claimed at high confidence before it was rejected.

The full report

Everything above is a sample. The report is every evidenced control and every gap, with the reasoning and the source document behind each one, in a form you can hand to an assessor. $299, emailed immediately.

Buy this crosswalk