AWS MSP VCL 8.0 gap analysis in one afternoon: from 61 controls to a work list

The AWS MSP Program Validation Checklist 8.0 has 61 controls. That sounds like weeks of work, but most MSPs already cover a large part with what they have — just not in the form an auditor wants to see. The trick of a fast gap analysis is not to read every control, but to split them into three classes first: what you already measure, what needs a time series (and therefore must start today) and what is organisational (policy, people, roadmap). After that you know exactly which work is urgent.

This article does that in four steps. Budget three to four hours, including the two scripts.

Step 0: the timeline that decides everything

• 31 December 2026: VCL 7.1 sunsets.
• 1 January 2027: every validation or revalidation runs on 8.0.
• OPSP-003 (toil measurement) asks for a demonstrated quarterly reduction. That means at least two quarters of data before your audit. If your audit falls in Q1 2027, your toil measurement must be running by Q3 2026 at the latest.
• OPS-004 (GenAI observability) asks for agent session tracing and cost observability. Also a time series: last week's traces cannot be invented afterwards.

Conclusion before you start: the two new metric controls are more urgent than the 27 rewritten policy controls, because you cannot catch up on them.

Step 1: the 19 named controls in three classes

AWS named 19 controls in its "Summary of Changes" (12 new, 3 rewritten, 4 retained). Put them in a worksheet with three columns: current evidence, class, owner. This starting classification fits most MSPs; adjust after your own check.

Control	Topic	Class	Why
OPS-004	GenAI & agentic AI observability	time series	traces, sessions, cost — cannot be reconstructed
OPSP-003	Toil measurement and reduction	time series	quarterly trend required
OPS-009	FinOps incl. AI cost	time series	inference cost per month
SEC-003	Vulnerability mgmt incl. AI deps	already measured (partly)	your scanner must include AI SDKs
OPS-010	Patch and release management	already measured	patch logs, provided they carry a per-host result
GOVP-001	Change management incl. AI workloads	already measured (partly)	changelog must explicitly include AI workloads
SEC-007	Agentic zero trust & blast radius	already measured (partly)	network segmentation + what an agent may do
SECP-001	Encryption and key management	already measured	KMS, TLS inventory
SEC-001	IAM	already measured	MFA coverage, access review
PLAT-005	Well-Architected	already measured	WAR reports
SECP-004	Prompt injection prevention	organisational + technical	guardrails in the app, detection outside it
GOV-002	AI agent and model governance	organisational	inventory with owner and risk tier
GOV-003	Data governance for AI	organisational + technical	PII policy + redaction
PLAT-004	Agentic AI platform	organisational + technical	human-in-the-loop evidence
GOVP-002	Responsible AI policy	organisational	policy + one applied example
BUS-002	AI transformation roadmap	organisational
BUS-006	Vertical specialisation	organisational
PEO-003	AI practice lead	organisational	name + role description
PEO-004	Forward Deployed Engineers	organisational	team capacity

Three time series, seven things you probably already measure, nine organisational. That is a work list, not a mountain.

Step 2: inventory your AI dependencies (SEC-003, GOV-002)

Two controls start with the same question: which AI SDKs and models actually run in our code and our customers' code? Most MSPs do not know exactly. This script walks a tree of repositories and prints every AI-related dependency per manifest:

#!/usr/bin/env bash
# ai-deps.sh — inventory of AI/LLM SDKs in requirements.txt, pyproject,
# package.json, go.mod, csproj and Gemfile under a root.
set -euo pipefail
ROOT="${1:-.}"
PAT='openai|anthropic|langchain|llama[-_]?index|litellm|transformers|cohere|mistralai|google-generativeai|vertexai|bedrock|ollama|huggingface|sentence[-_]transformers|vllm|go-openai|semantic-kernel|Azure\.AI\.OpenAI'
find "$ROOT" \( -name requirements.txt -o -name pyproject.toml -o -name package.json -o -name go.mod -o -name '*.csproj' -o -name Gemfile \) \
  -not -path '*/node_modules/*' -not -path '*/.venv/*' -not -path '*/vendor/*' -print0 |
while IFS= read -r -d '' f; do
  grep -Eio "($PAT)[^\"', )]*" "$f" | sort -u | sed "s|^|$f\t|"
done | column -t -s $'\t'

Example output on a folder with three projects:

repos/c/go.mod            go-openai
repos/b/package.json      anthropic-ai/sdk
repos/a/requirements.txt  langchain-core>=0.3
repos/a/requirements.txt  openai==1.40.0

That is immediately your starting inventory for GOV-002: per line, add an app, an owner and a risk tier. For SEC-003, then check that your vulnerability scanner actually includes these packages — pip-audit, npm audit or OSV on the lockfile. The how-to scan a package-lock for vulnerabilities explains the OSV approach; AI SDKs are ordinary packages in the same pipeline.

Step 3: compute your toil baseline (OPSP-003)

AWS asks for toil "as a percentage of ops time". Nobody measures human minutes reliably, and your works council probably does not want that either. The proxy that works: of all remediation actions in a month, what share was automated? Export your ticket system or runbook log to CSV with at least a date and an auto/manual column:

awk -F, 'NR>1{m=substr($1,1,7); t[m]++; if($2=="auto")a[m]++}
  END{for(m in t) printf "%s  actions=%d  auto=%d  automation=%.0f%%\n", m, t[m], a[m], 100*a[m]/t[m]}' actions.csv | sort

2026-07  actions=3  auto=1  automation=33%
2026-08  actions=3  auto=2  automation=67%

Two lines are enough for a baseline; three months for a trend; six months for the quarterly comparison the control asks for. If you have no exportable source today, that is your first action item — not writing the policy, but starting the counter.

Measure this per team or per tenant, not per person. In Germany (Betriebsrat), Belgium and the Netherlands (works council), per-employee productivity measurement can require consent. An aggregated automation percentage does not.

Step 4: GenAI observability (OPS-004): the minimum required

The control names five things: agent session tracing, inference performance, drift detection, decision audit trail and cost observability. Translated into a minimal dataset per AI call:

Field	Why
app id, model, provider	governance (GOV-002) and cost
session hash (not the user)	session tracing without identity
tokens in/out, latency	performance and cost
tool calls	make agentic behaviour visible
refusal flag, PII hits	safety (SECP-004, GOV-003)
cost in euro with pricing version	FinOps (OPS-009)

Two pitfalls. One: never store raw prompts centrally — redact PII at source and keep hashes. Two: without a pricing version per trace you cannot reproduce last quarter's cost report, and reproducibility is exactly what an auditor tests.

What monsys takes over

If monsys runs on your managed hosts, steps 2 to 4 are largely done:

• SEC-003 / OPS-010: OSV/EPSS/KEV on app dependencies (pypi, npm, Go), OS packages and kernel; AI SDKs are automatically in the same pipeline. Patch actions are signed with a per-host result.
• OPSP-003: the toil worker computes per tenant per month the automation ratio, auto-resolved alerts and MTTA/MTTR, plus the quarter delta. Never per person.
• OPS-004 / OPS-009: AI traces with tokens, latency, model, refusal and PII hits; agent sessions per session hash; cost in euro with pricing snapshot.
• GOVP-001 / PLAT-004: every action on a host is a signed, single-use token with human approval — that is the human-in-the-loop evidence.
• The VCL 8.0 evidence pack bundles everything in an Ed25519-signed PDF+JSONL, with an attestation page for the organisational controls.

The dashboard shows per control how much evidence exists — including "no evidence" where that is the case. monsys supplies the measurements, the AWS validation partner judges the file. See the product page and the documentation.

End-of-afternoon checklist

• [ ] Worksheet with 19 controls in three classes, an owner per row
• [ ] AI-dependency inventory run over all repos (yours and customers')
• [ ] Toil baseline for at least the current month; the counter is running
• [ ] Minimal AI-trace dataset agreed with the dev team
• [ ] Audit date scheduled and six months counted back: when must the time series be running?
• [ ] Organisational controls assigned: who writes GOVP-002, who becomes PEO-003?

The organisational controls can still be written in Q4 2026. The time series cannot. Start those first.