Evidence QA for FedRAMP 20x

What it checks

Evidence QA runs the same engine over stored KSI collector facts for a CSP operator and, when invited, for a Recognized Independent Assessor. It applies a stricter freshness bar, replay on pinned evidence, and drift or tamper checks. Unrun collectors stay not_measured.

• FedRAMP 20x evidence review against official Key Security Indicators
• KSI evidence validation with method count, history length, and hash integrity
• Persistent validation evidence for ConMon packages and OCR releases
• Read-only assessor workbench with exportable workpapers the provider cannot edit

Two surfaces, one engine

Providers run the pre-check at app.scm.cc/qa. Independent assessors sign in at qa.scm.cc. Neither surface is an assessment, an attestation, or a grant of authorization.

Questions teams ask

What is FedRAMP 20x evidence review on scm.cc?

Evidence QA runs stored Key Security Indicator collector facts against a stricter bar than the official minima. It shows verified, partially_verified, failed, and not_measured. It does not perform a FedRAMP independent assessment and does not predict an outcome.

Does this validate KSI evidence for persistent validation?

It replays pinned evidence, checks drift and tamper hashes, and applies tighter freshness than VDR-TFR-MVX. Missing history stays missing. Results are an internal QA check, not a certification.

Is this a FedRAMP assessor tool?

It is a workbench for a Recognized Independent Assessor or a CSP compliance lead to review evidence the provider already collected. scm.cc is not a Recognized Independent Assessor (formerly 3PAO) and does not grant authorization. The official registry is marketplace.fedramp.gov.

Can I cite Evidence QA results to an agency?

No. Operator QA results are watermarked internal_qa material. They may be shown to an invited assessor. They are not independent evidence and must not be cited as a determination.