01
Precise
We name the KSI, the date and the evidence source. “KSI-IAM-01 passed against Okta logs pulled 28 Sep” beats “identity controls look good.”
Approach
Continuous, with the evidence out front.
The identity is built on a step sequencer: eight pads, played in order, repeatedly. FedRAMP 20x asks the same of a security program. So do we.
How an engagement runs
Eight steps, played in order. Then again.
FedRAMP 20x asks for validation that runs continuously and shows its evidence. Our engagements are built the same way.
01 / 08
- Step 01
Scope
Agree the system, the boundary and which 20x release we test against.
- Step 02
Inventory
List every component, data flow and evidence source in that boundary.
- Step 03
Map
Map each Key Security Indicator (KSI) to the systems and logs that prove it.
- Step 04
Collect
Pull machine-readable evidence straight from the source, with timestamps.
- Step 05
Validate
Test every KSI against that evidence. Pass or fail, nothing in between.
- Step 06
Report
Show what passed, what failed, the evidence and the date it was tested.
- Step 07
Fix first
Rank the gaps by effort and impact so your team knows where to start.
- Step 08
Repeat
20x is continuous. So is the validation. Run it again, and again.
How we write it up
The engineer who has read the whole rule set.
Direct, specific and unimpressed by jargon. It keeps our findings defensible in a regulated market.
02
Evidence-first
We lead with what we observed, then what it means. Opinions come last and are labeled as opinions.
03
Plain-spoken
Short sentences, no unexplained acronyms. If a finding is bad news, it is in the first line.
04
Current
20x is new and still changing. We date our guidance, cite the rule version we used, and update it when the rules move.
| KSI | Result | Evidence | Tested |
|---|---|---|---|
| KSI-IAM-01 | ● PASS | IdP sign-in logs | 2026-09-28T14:02:11Z |
| KSI-MLA-01 | ● PASS | SIEM retention config | 2026-09-28T14:02:37Z |
| KSI-CNA-01 | ● PASS | Network policy export | 2026-09-28T14:03:02Z |
| KSI-SVC-02 | ■ FAIL | TLS scan, 3 endpoints | 2026-09-28T14:03:40Z |
| KSI-CMT-01 | ● PASS | CI/CD audit trail | 2026-09-28T14:04:15Z |
| KSI-RPL-01 | ● PASS | Backup restore test | 2026-09-28T14:04:58Z |
Book a consultation
Find out what will hold up.
A short call about your system, your timeline and where 20x will push hardest. You’ll leave with a clear next step, whether or not it involves us.