Every building block is already established. The join was never published.
What the Federal government has already built, what contractor systems already report, and the one statement never issued.
1Published by the government
PublishedSP 800-171 / 171AThe requirements and their 320 assessment objectives.
PublishedChecklist ProgramHardening baselines in SCAP and XCCDF, designated as the configuration source.
Published · Apr 2025Parameter valuesThresholds, frequencies and response times, set by the Department.
PublishedOSCALThe schema NIST built so assessment data moves between tools.
2Required state, already reported
03.04.07+5 moreEndpointNonessential programs, ports and services restricted.81 objectives
03.05.01+7 moreEnterpriseIdentity, authentication and tenant policy for CUI.61 objectives
03.11.02+2 moreVulnerabilityMonthly scanning; remediation within 30 / 90 / 180 days.carried in endpoint
03.03.01+2 moreAuditRecords retained, with reduction and on-demand reporting.1 objective
The missing act
Not yet designated
No published artifact states which assessment objectives the Department will accept a machine-readable export for.
Absent it, the evidence to the left carries no compliance value and every objective to the right is established by interview.
3All 320 objectives, by what the system emits
44.7%143 objectives
Automated validation
Emitted state reaches the objective’s full parameter and is scored against a referent. No assessor.
100scored against a referent the Federal government publishes.
43against a value the organization must define: valid, not comparable.
25.0%80 objectives
Combination
Emission falls short of the full parameter. The export narrows it; assessor judgement completes it.
30.3%97 objectives
Manual validation
Nothing emits at any cost — conduct, judgement, and organization-defined process.