What It Is#
Built this for my client InfusionPoints to conduct FedRAMP 20x Low pilot assessments. Used by Fortreum (3PAO) to validate their Command Center platform.
The assessment results are public:
InfusionPoints/fedramp20x-low-pilot-final
InfusionPoints FedRAMP 20x Low Pilot Final Submission
HTML
0
1
Features#
- Digital Signature Verification - Upload JSON/Excel files with their .sig files to verify authenticity and integrity via PGP
- Assessment Workflow - Structured process for 3PAO attestation
- KSI Validation - Key Security Indicator checks per FedRAMP 20x requirements
- Machine-Readable Output - JSON reports with cryptographic signatures
The Pilot#
InfusionPoints submitted their Command Center on XBU40 (cloud-native GRC platform hosted in AWS GovCloud) for the FedRAMP 20x Low pilot. Fortreum served as the independent 3PAO.
Timeline:
- Original submission: June 18, 2025
- Updated submission: July 3, 2025 (added 5 additional KSI checks based on PMO feedback)
Related#
- FedRAMP 20x CWG Pilot Demos - Video walkthrough
- GitOps Demo - GitOps approach to FedRAMP 20x
