r/FedRAMP • u/colek42 • 16h ago
Creating Audit Bundles for SDLC
0
Upvotes
One of the things that FedRAMP 20x expects is machine-readable evidence. We maintain an open-source project that helps with this. We did a write-up on how you can use CI/Lock (open source) to create an evidence bundle of the SDLC. https://testifysec.com/docs/cilock/tutorials/audit-evidence-bundle#what-goes-in-the-bundle
You should be able to drop that link into your agent. What KSI's do you think this methodology could extend to?