FedRAMP 20x in CI/CD
CI/CD is often the process 20x assessor materials tell you to verify: the pipeline that validates KSIs and the human steps around it. A green badge is not the process.
Educational resource only. scm.cc is not a FedRAMP Recognized Independent Assessor (3PAO) and is not FedRAMP-authorized; it grants no authorization, certification, or assessment outcome. FedRAMP.gov is the authoritative source. This is not legal advice.
Technical detail
Needed for a reviewable pipeline: pinned runner images, required checks that fail closed, logs retained with integrity, and a map from job names to KSI identifiers in the SDR. Sampled pipelines are sampled evidence.
How to implement
Pair this page with GitHub/GitLab and Terraform. Use the persistent-validation course to practice distinguishing a screenshot of a badge from a replayable job log.
Common mistakes
- Allowing `workflow_dispatch` to skip the required KSI jobs. - Calling a weekly cron that does not block deploy 'continuous validation.'
Related hub pages
Primary sources
- FedRAMP 20x overview & Core Principles (retrieved 2026-09-27)
- FedRAMP 20x Key Security Indicators (CR26) (retrieved 2026-09-27)
- Security Decision Record (retrieved 2026-09-27)
- FedRAMP Certification reference (retrieved 2026-09-27)
Last verified 2026-09-27. FedRAMP.gov is authoritative.