Automated FedRAMP Moderate DevSecOps Pipeline

Automating Federal Cloud Security Authorization

Commercial SaaS companies selling to U.S. government agencies face rigorous security baselines under the Federal Risk and Authorization Management Program (FedRAMP). Manual documentation of 325+ security controls leads to massive consulting costs and slow agency review cycles. By treating compliance controls as code within GitHub Actions, the team achieved an accelerated Agency ATO.

DevSecOps Pipeline Architecture Highlights

Machine-Readable OSCAL System Security Plan (SSP)

Instead of maintaining monolithic Word documents, security controls are authored as structured Markdown in Git and compiled automatically to NIST OSCAL JSON:

{
  "system-security-plan": {
    "id": "ssp-fedramp-moderate-01",
    "metadata": {
      "title": "FedRAMP Moderate Cloud Service Offering SSP",
      "last-modified": "2026-08-21T00:00:00Z",
      "version": "2.4.0",
      "oscal-version": "1.0.0"
    },
    "control-implementation": {
      "implemented-requirements": [
        {
          "control-id": "ac-2",
          "description": "Account Management is enforced via Okta SAML 2.0 with mandatory FIDO2 WebAuthn MFA and automated 90-day inactivity deactivation."
        },
        {
          "control-id": "sc-13",
          "description": "Cryptographic Protection uses FIPS 140-3 validated AES-256 modules across all data at rest and TLS 1.3 in transit."
        }
      ]
    }
  }
}

Continuous Monitoring (ConMon) Automation

Every month, scheduled GitHub Actions workflows run Aqua Trivy container scans and CIS benchmark audits, automatically updating the FedRAMP Plan of Action and Milestones (POA&M) spreadsheet submitted to authorizing agency officials.

Agency Authorization to Operate (ATO) Outcome