diff --git a/frameworks/WAFS/map.json b/frameworks/WAFS/map.json
index 013e399..6c56831 100644
--- a/frameworks/WAFS/map.json
+++ b/frameworks/WAFS/map.json
@@ -12,7 +12,7 @@
       "BP01": ["iam.hasOrganization"],
       "BP02": ["iam.rootMfaActive", "iam.hasAlternateContact", "iam.rootHasAccessKey", "iam.rootConsoleLogin30days", "iam.passwordPolicy", "iam.enableGuardDuty"],
       "BP03": ["iam.mfaActive", "iam.passwordPolicyWeak", "iam.passwordLastChange90", "iam.hasAccessKeyNoRotate30days"],
-      "BP04": [],
+      "BP04": ["iam.enableGuardDuty"],
       "BP05": [],
       "BP06": [],
       "BP07": [],
@@ -47,7 +47,7 @@
       "BP01": ["cloudfront.$length"],
       "BP02": ["ec.SGSensitivePortOpenToAll", "ec2.SGAllTCPOpen", "ec2.SGAllUDPOpen", "ec2.SGDefaultInUsed", "ec2.SGEncryptionInTransit", "ec2.ELBListenerInsecure", "rds.PubliclyAccessible"],
       "BP03": [],
-      "BP04": ["iam.enableGuardDuty"]
+      "BP04": []
     },
     "SEC06":{
       "BP01": [],