TheArtOfService
NIST Cybersecurity Framework 2.0FedRAMP Moderate

NIST Cybersecurity Framework 2.0 covers 21.4% of FedRAMP Moderate

69 of the 323 controls in FedRAMP Moderate are already satisfied by evidence you collected for NIST Cybersecurity Framework 2.0. 254 are genuine gaps. Every claim below was judged against both control sets and then argued against; the ones that did not survive are published further down with the reason each failed.

21.4%
of the target already covered
69
controls evidenced
254
genuine gaps
344
claims rejected in review

This number is directional. It says how much of FedRAMP Moderate your NIST Cybersecurity Framework 2.0 evidence satisfies. The reverse pair is a different number, often very different, because a security standard has enormous depth for access control and almost none for lawful basis or data subject rights.

499 candidate mappings were examined and 355 were removed. Signed off 2026-08-19, review level machine verified. Mappings were judged by Claude Code rather than read line by line by a practitioner. Every claim shows its reasoning so you can check it. Ask and a practitioner will review this pair.

Where the gaps are

Coverage is never evenly spread. A source standard usually satisfies one part of a target almost completely and barely touches another, and which part is which is the thing worth knowing before you plan the work.

SR - Supply Chain Risk Management6 of 12 evidenced, 6 to do
RA - Risk Assessment4 of 11 evidenced, 7 to do
AT - Awareness and Training2 of 6 evidenced, 4 to do
AU - Audit and Accountability5 of 16 evidenced, 11 to do
CM - Configuration Management8 of 27 evidenced, 19 to do
IR - Incident Response5 of 17 evidenced, 12 to do
PL - Planning2 of 7 evidenced, 5 to do
SA - System and Services Acquisition5 of 21 evidenced, 16 to do
CP - Contingency Planning5 of 23 evidenced, 18 to do
CA - Assessment, Authorization, and Monitoring3 of 14 evidenced, 11 to do
SI - System and Information Integrity5 of 24 evidenced, 19 to do
PS - Personnel Security2 of 10 evidenced, 8 to do
IA - Identification and Authentication5 of 27 evidenced, 22 to do
PE - Physical and Environmental Protection3 of 19 evidenced, 16 to do
SC - System and Communications Protection4 of 29 evidenced, 25 to do
MA - Maintenance1 of 10 evidenced, 9 to do
AC - Access Control4 of 43 evidenced, 39 to do
MP - Media Protection0 of 7 evidenced, 7 to do

Theme level, not control level, deliberately. The per-control list of what is evidenced and what is a gap is the report itself, so publishing it here would be publishing the thing being sold.

Claims that held

A sample. Each one names the control whose evidence does the work, the control it satisfies, and why.

NIST-CSF-PR.AA-01AC-2argued against and upheld
Account Management

AC-2 manages the accounts through which those identities gain access.

NIST-CSF-PR.AA-05AC-3argued against and upheld
Access Enforcement

PR.AA-05 requires access permissions be defined, managed and enforced.

NIST-CSF-PR.AA-05AC-5argued against and upheld
Separation of Duties

PR.AA-05 requires separation of duties be incorporated into entitlement design.

NIST-CSF-PR.AA-05AC-6argued against and upheld
Least Privilege

PR.AA-05 requires those permissions incorporate least privilege.

NIST-CSF-PR.AT-01AT-2argued against and upheld
Literacy Training and Awareness

PR.AT-01 requires personnel receive awareness and training for their duties.

NIST-CSF-PR.AT-02AT-3argued against and upheld
Role-Based Training

PR.AT-02 requires individuals in specialized roles receive role-based training.

NIST-CSF-PR.PS-04AU-12argued against and upheld
Audit Record Generation

AU-12 supplies the audit record generation capability.

NIST-CSF-PR.PS-04AU-3argued against and upheld
Content of Audit Records

AU-3 sets the content those records must carry to be useful.

Claims that did not hold

344 proposed mappings for this pair were rejected. They are kept in the graph rather than deleted, so what was thrown out is as inspectable as what survived. A crosswalk that never rejects anything is not being judged.

NIST-CSF-PR.DS-02AC-17(2)
Protection of Confidentiality and Integrity Using Encryption

Not corroborated on review of this pair by Claude Code

Claimed at high confidence before it was rejected.

NIST-CSF-PR.AA-03AC-18(1)
Authentication and Encryption

Not corroborated on review of this pair by Claude Code

Claimed at medium confidence before it was rejected.

NIST-CSF-PR.DS-02AC-18(1)
Authentication and Encryption

Not corroborated on review of this pair by Claude Code

Claimed at high confidence before it was rejected.

NIST-CSF-PR.DS-01AC-19(5)
Full Device or Container-Based Encryption

Not corroborated on review of this pair by Claude Code

Claimed at high confidence before it was rejected.

NIST-CSF-PR.AA-05AC-2
Account Management

Not corroborated on review of this pair by Claude Code

Claimed at medium confidence before it was rejected.

NIST-CSF-PR.AA-01AC-2(3)
Disable Accounts

Not corroborated on review of this pair by Claude Code

Claimed at high confidence before it was rejected.

NIST-CSF-RS.CO-02AC-2(4)
Automated Audit Actions

Not corroborated on review of this pair by Claude Code

Claimed at low confidence before it was rejected.

NIST-CSF-PR.PS-04AC-2(4)
Automated Audit Actions

Not corroborated on review of this pair by Claude Code

Claimed at high confidence before it was rejected.

The full report

Everything above is a sample. The report is every evidenced control and every gap, with the reasoning and the source document behind each one, in a form you can hand to an assessor. $299, emailed immediately.

Buy this crosswalk