TheArtOfService
FedRAMP ModerateAPEC Cross-Border Privacy Rules (CBPR) System

FedRAMP Moderate covers 20.3% of APEC Cross-Border Privacy Rules (CBPR) System

12 of the 59 controls in APEC Cross-Border Privacy Rules (CBPR) System are already satisfied by evidence you collected for FedRAMP Moderate. 47 are genuine gaps. Every claim below was judged against both control sets and then argued against; the ones that did not survive are published further down with the reason each failed.

20.3%
of the target already covered
12
controls evidenced
47
genuine gaps
0
claims rejected in review

This number is directional. It says how much of APEC Cross-Border Privacy Rules (CBPR) System your FedRAMP Moderate evidence satisfies. The reverse pair is a different number, often very different, because a security standard has enormous depth for access control and almost none for lawful basis or data subject rights.

44 candidate mappings were examined and 0 were removed. Signed off 2026-08-19, review level machine verified. Mappings were judged by Claude Code rather than read line by line by a practitioner. Every claim shows its reasoning so you can check it. Ask and a practitioner will review this pair.

Where the gaps are

Coverage is never evenly spread. A source standard usually satisfies one part of a target almost completely and barely touches another, and which part is which is the thing worth knowing before you plan the work.

Security1 of 1 evidenced
CBPR Program Requirements: Security Safeguards8 of 10 evidenced, 2 to do
CBPR Program Requirements: Accountability3 of 12 evidenced, 9 to do
Risk0 of 1 evidenced, 1 to do
Transparency0 of 1 evidenced, 1 to do
Data Minimization0 of 1 evidenced, 1 to do
Purpose Limitation0 of 1 evidenced, 1 to do
Governance0 of 1 evidenced, 1 to do
Consent0 of 1 evidenced, 1 to do
Data Quality0 of 1 evidenced, 1 to do
Individual Rights0 of 1 evidenced, 1 to do
CBPR Program Requirements: Access and Correction0 of 3 evidenced, 3 to do
CBPR Program Requirements: Choice0 of 7 evidenced, 7 to do
CBPR Program Requirements: Collection Limitation0 of 3 evidenced, 3 to do
CBPR Program Requirements: Integrity of Personal Information0 of 5 evidenced, 5 to do
CBPR Program Requirements: Notice0 of 4 evidenced, 4 to do
CBPR Program Requirements: Uses of Personal Information0 of 6 evidenced, 6 to do

Theme level, not control level, deliberately. The per-control list of what is evidenced and what is a gap is the report itself, so publishing it here would be publishing the thing being sold.

Claims that held

A sample. Each one names the control whose evidence does the work, the control it satisfies, and why.

SC-13Principle VII, Security Safeguardsargued against and upheld
Security Safeguards

FIPS validated cryptography for defined uses is a reasonable technical safeguard.

SC-28Principle VII, Security Safeguardsargued against and upheld
Security Safeguards

Confidentiality and integrity protection of information at rest is a core reasonable safeguard.

AC-3Principle VII, Security Safeguardsargued against and upheld
Security Safeguards

Access enforcement of approved authorisations protects held information from unauthorised access.

SA-9Program Requirements, Accountability, question 46argued against and upheld
Mechanisms with processors to meet obligations

Requiring providers to comply with defined requirements and documenting oversight is that mechanism.

SR-5Program Requirements, Accountability, question 47argued against and upheld
Processor agreement content

Contract tools and procurement methods carry the obligations into supplier agreements.

SA-9Program Requirements, Accountability, question 47argued against and upheld
Processor agreement content

Provider obligations flow down as documented requirements the provider must comply with.

CA-3Program Requirements, Accountability, question 47argued against and upheld
Processor agreement content

Information exchanges are governed by ISA, MOU or contract, reviewed annually.

SR-6Program Requirements, Accountability, question 49argued against and upheld
Spot checking and monitoring of processors

Supplier risk posture assessed at a defined frequency and after significant events is regular monitoring.

Claims that did not hold

Nothing proposed for this pair was rejected in review. That is unusual and worth knowing rather than hiding: it means the candidate set was small and every candidate held.

The full report

Everything above is a sample. The report is every evidenced control and every gap, with the reasoning and the source document behind each one, in a form you can hand to an assessor. $299, emailed immediately.

Buy this crosswalk