FedRAMP 20x with GitHub
GitHub org rulesets, required reviews, CODEOWNERS, and code scanning are common automated methods for change and software-supply indicators. They prove what the org settings were at collection time — not that every runtime host matches.
Educational resource only. scm.cc is not a FedRAMP Recognized Independent Assessor (3PAO) and is not FedRAMP-authorized; it grants no authorization, certification, or assessment outcome. FedRAMP.gov is the authoritative source. This is not legal advice.
Technical detail
The product QA engine already treats some GitHub checks as methods on CMT indicators. Do not stack extra ruleset types onto an indicator that already has its two methods. Duplicate exports of the same ruleset are not independence.
How to implement
Scope the org/enterprise to the authorization boundary. Record the collector identity in the SDR. Practice grading GitHub-shaped facts on the synthetic offering in the KSI evidence course.
Common mistakes
- Personal-fork settings offered as the production org evidence. - A branch-protection screenshot with no org id or retrieved date.
Related hub pages
Primary sources
- FedRAMP 20x overview & Core Principles (retrieved 2026-09-27)
- FedRAMP 20x Key Security Indicators (CR26) (retrieved 2026-09-27)
- Security Decision Record (retrieved 2026-09-27)
- FedRAMP Certification reference (retrieved 2026-09-27)
Last verified 2026-09-27. FedRAMP.gov is authoritative.