r/FedRAMP • • 16h ago

Creating Audit Bundles for SDLC

0 Upvotes

One of the things that FedRAMP 20x expects is machine-readable evidence. We maintain an open-source project that helps with this. We did a write-up on how you can use CI/Lock (open source) to create an evidence bundle of the SDLC. https://testifysec.com/docs/cilock/tutorials/audit-evidence-bundle#what-goes-in-the-bundle

You should be able to drop that link into your agent. What KSI's do you think this methodology could extend to?