TheArtOfService
ISO 22301:2019FedRAMP Moderate

ISO 22301:2019 covers 6.5% of FedRAMP Moderate

21 of the 323 controls in FedRAMP Moderate are already satisfied by evidence you collected for ISO 22301:2019. 302 are genuine gaps. Every claim below was judged against both control sets and then argued against; the ones that did not survive are published further down with the reason each failed.

6.5%
of the target already covered
21
controls evidenced
302
genuine gaps
3
claims rejected in review

This number is directional. It says how much of FedRAMP Moderate your ISO 22301:2019 evidence satisfies. The reverse pair is a different number, often very different, because a security standard has enormous depth for access control and almost none for lawful basis or data subject rights.

42 candidate mappings were examined and 3 were removed. Signed off 2026-08-19, review level machine verified. Mappings were judged by Claude Code rather than read line by line by a practitioner. Every claim shows its reasoning so you can check it. Ask and a practitioner will review this pair.

Where the gaps are

Coverage is never evenly spread. A source standard usually satisfies one part of a target almost completely and barely touches another, and which part is which is the thing worth knowing before you plan the work.

AT - Awareness and Training3 of 6 evidenced, 3 to do
CP - Contingency Planning7 of 23 evidenced, 16 to do
IR - Incident Response5 of 17 evidenced, 12 to do
RA - Risk Assessment3 of 11 evidenced, 8 to do
CA - Assessment, Authorization, and Monitoring3 of 14 evidenced, 11 to do
AC - Access Control0 of 43 evidenced, 43 to do
AU - Audit and Accountability0 of 16 evidenced, 16 to do
CM - Configuration Management0 of 27 evidenced, 27 to do
IA - Identification and Authentication0 of 27 evidenced, 27 to do
MA - Maintenance0 of 10 evidenced, 10 to do
MP - Media Protection0 of 7 evidenced, 7 to do
PE - Physical and Environmental Protection0 of 19 evidenced, 19 to do
PL - Planning0 of 7 evidenced, 7 to do
PS - Personnel Security0 of 10 evidenced, 10 to do
SA - System and Services Acquisition0 of 21 evidenced, 21 to do
SC - System and Communications Protection0 of 29 evidenced, 29 to do
SI - System and Information Integrity0 of 24 evidenced, 24 to do
SR - Supply Chain Risk Management0 of 12 evidenced, 12 to do

Theme level, not control level, deliberately. The per-control list of what is evidenced and what is a gap is the report itself, so publishing it here would be publishing the thing being sold.

Claims that held

A sample. Each one names the control whose evidence does the work, the control it satisfies, and why.

7.3AT-2argued against and upheld
Literacy Training and Awareness

Awareness of the policy, contribution and implications of nonconformity is required.

7.2AT-3argued against and upheld
Role-Based Training

Competence is determined and provided by role, which is role based training.

7.2AT-4argued against and upheld
Training Records

Documented information must be retained as evidence of competence.

9.2CA-2argued against and upheld
Control Assessments

Internal audit at planned intervals determines whether controls are effectively implemented.

10.1CA-5argued against and upheld
Plan of Action and Milestones

Nonconformity handling with documented actions and results is the evidence a plan of action and milestones records.

9.1CA-7argued against and upheld
Continuous Monitoring

Monitoring, measurement, analysis and evaluation at planned intervals is continuous monitoring.

5.2.2CP-1argued against and upheld
Policy and Procedures

Communicating that policy across the organization satisfies the dissemination requirement.

5.2.1CP-1argued against and upheld
Policy and Procedures

An established and approved business continuity policy is the contingency planning policy.

Claims that did not hold

3 proposed mappings for this pair were rejected. They are kept in the graph rather than deleted, so what was thrown out is as inspectable as what survived. A crosswalk that never rejects anything is not being judged.

10.2CA-5
Plan of Action and Milestones

target corrected: ISO 22301 clauses 10.1 and 10.2 were swapped in the graph

Claimed at high confidence before it was rejected.

8.4.5IR-2
Incident Response Training

recovery under 8.4.5 is restoring business activities, not incident response competence

Claimed at high confidence before it was rejected.

6.1.2RA-3
Risk Assessment

attached to a mis-titled clause, real 6.1.2 is Addressing risks and opportunities

Claimed at high confidence before it was rejected.

The full report

Everything above is a sample. The report is every evidenced control and every gap, with the reasoning and the source document behind each one, in a form you can hand to an assessor. $299, emailed immediately.

Buy this crosswalk