NIST SP 800-172FedRAMP Moderate

NIST SP 800-172 covers 15.8% of FedRAMP Moderate

51 of the 323 controls in FedRAMP Moderate are already satisfied by evidence you collected for NIST SP 800-172. 272 are genuine gaps. Every claim below was judged against both control sets and then argued against; the ones that did not survive are published further down with the reason each failed.

15.8%

of the target already covered

controls evidenced

272

genuine gaps

claims rejected in review

This number is directional. It says how much of FedRAMP Moderate your NIST SP 800-172 evidence satisfies. The reverse pair is a different number, often very different, because a security standard has enormous depth for access control and almost none for lawful basis or data subject rights.

90 candidate mappings were examined and 9 were removed. Signed off 2026-08-19, review level machine verified. Mappings were judged by Claude Code rather than read line by line by a practitioner. Every claim shows its reasoning so you can check it. Ask and a practitioner will review this pair.

Where the gaps are

Coverage is never evenly spread. A source standard usually satisfies one part of a target almost completely and barely touches another, and which part is which is the thing worth knowing before you plan the work.

AT - Awareness and Training4 of 6 evidenced, 2 to do

SI - System and Information Integrity9 of 24 evidenced, 15 to do

CA - Assessment, Authorization, and Monitoring5 of 14 evidenced, 9 to do

CM - Configuration Management7 of 27 evidenced, 20 to do

SR - Supply Chain Risk Management3 of 12 evidenced, 9 to do

IR - Incident Response4 of 17 evidenced, 13 to do

PS - Personnel Security2 of 10 evidenced, 8 to do

RA - Risk Assessment2 of 11 evidenced, 9 to do

AC - Access Control7 of 43 evidenced, 36 to do

IA - Identification and Authentication4 of 27 evidenced, 23 to do

PL - Planning1 of 7 evidenced, 6 to do

AU - Audit and Accountability2 of 16 evidenced, 14 to do

SA - System and Services Acquisition1 of 21 evidenced, 20 to do

CP - Contingency Planning0 of 23 evidenced, 23 to do

MA - Maintenance0 of 10 evidenced, 10 to do

MP - Media Protection0 of 7 evidenced, 7 to do

PE - Physical and Environmental Protection0 of 19 evidenced, 19 to do

SC - System and Communications Protection0 of 29 evidenced, 29 to do

Theme level, not control level, deliberately. The per-control list of what is evidenced and what is a gap is the report itself, so publishing it here would be publishing the thing being sold.

Claims that held

A sample. Each one names the control whose evidence does the work, the control it satisfies, and why.

3.14.2eAC-2(12)argued against and upheld

Account Monitoring for Atypical Usage

Monitoring for anomalous or suspicious behaviour detects atypical account usage.

3.9.2eAC-2(13)argued against and upheld

Disable Accounts for High-Risk Individuals

Protecting systems when adverse information develops about an individual is disabling high-risk accounts.

3.1.2eAC-20argued against and upheld

Use of External Systems

Restricting access to only organization owned, provisioned or issued resources governs external system use.

3.1.2eAC-20(1)argued against and upheld

Limits on Authorized Use

Permitting only organization provisioned resources is the strictest form of limiting authorized use.

3.1.3eAC-4argued against and upheld

Information Flow Enforcement

Secure transfer solutions controlling flows between security domains is information flow enforcement.

3.1.3eAC-4(21)argued against and upheld

Physical or Logical Separation of Information Flows

Controlling flows between separated security domains is logical separation of information flows.

3.1.1eAC-5argued against and upheld

Separation of Duties

Dual authorization for critical operations prevents one individual completing a sensitive action alone.

3.2.1eAT-2argued against and upheld

Literacy Training and Awareness

Awareness training at hire, annually and on system change covering current threats is literacy training.

Claims that did not hold

9 proposed mappings for this pair were rejected. They are kept in the graph rather than deleted, so what was thrown out is as inspectable as what survived. A crosswalk that never rejects anything is not being judged.

3.13.2eAC-6

Least Privilege

control identity corrected 2026-08-19: issued 3.13.2e is introducing unpredictability into operations; these mappings are least privilege and secure engineering, a subject that appears nowhere in the issued 800-172