AWS ships an ISM evidence pack for Landing Zone Accelerator. 847 of 1,081 controls are still yours

Twenty-two controls inside the scope the accelerator claims for itself got neither full nor partial coverage ^[16], and 825 were never in scope at all ^[6]. Together that is 847 of the 1,081 ISM controls left for the customer to implement and evidence ^[17], about 78 percent of the manual ^[18]. The addressable slice is under a quarter of the ISM to begin with ^[19]; measured against the whole document, the accelerator reaches roughly 22 percent ^[20]. That is not a knock on the tool. It is the line the report draws, and the line is the useful part of it.

The coverage figure also merges two different states. Full and Partial were scored into one bucket ^[5], so a control where the landing zone switches on a log and leaves retention and review to you sits alongside one it closes outright. An assessor will separate them again, which makes the report read better as a work queue than as a score. The more durable contribution is the responsibility breakdown: rather than the AWS-or-customer binary, gwi.digital splits controls three ways, AWS provided, LZA enabled and customer responsibility, and subdivides the 825 out-of-scope controls into subcategories ^[11]. That is what a GRC team can plan against.

The result sits on an existing base and does not replace it. AWS states plainly that the report is not an IRAP authorization, certification or accreditation, only a professional evaluation of what the accelerator delivers out of the box and what it does not ^[8]. Underneath it, the AWS services themselves were most recently assessed at PROTECTED by CyberCX in the year before publication, according to AWS ^[10], and the gwi.digital work was positioned in Phase 2 of the ASD framework, aimed at consumers building on already-authorized services ^[7].

The drift-testing mechanism has the longest tail. ISM compliance is a continuing state and an assessment report is a photograph, so a way to keep measuring configuration against a tested baseline ^[14] is what turns an Artifact download into something an assessor can retest rather than accept on a date. It also runs the other way: once drift is measurable, a local deviation becomes a recorded one.

The commercial mechanics deserve naming. AWS is not really selling the accelerator here, it is pre-paying the documentation phase of an assessment that it says typically takes months of preparation, evidence gathering and testing ^[15]. The Compliance Workbook already mapped the Universal Configuration to 17 frameworks ^[12], and the accelerator automates close to 200 controls that apply themselves to new accounts as an estate grows ^[13]. What the ISM report adds is a third-party opinion in place of a vendor mapping. How much weight that carries is still an assessor's call ^[8].