AI-powered FedRAMP System Security Plan and Policy & Procedure document generation. Upload your IaC evidence, fill out the intake form, and Forseti generates a complete authorization package — OSCAL-first with DOCX exports.
The SSP Generator uses AWS Bedrock (Claude 3.5 Sonnet) to generate implementation statements and policy narratives from your IaC evidence. This feature requires the AWS GovCloud (us-gov-west-1) environment with a deployed Lambda proxy. Until then, the system operates in stub mode — the full pipeline works end-to-end, but AI-generated text will show placeholder content.
System metadata, boundary description, data types, CSP leveraged authorizations, ISSO/AO contacts, and FIPS 199 categorization.
Upload Terraform, CloudFormation, or CDK files. Auto-extracts config values and maps them to NIST 800-53 controls with structured evidence summaries.
Claude 3.5 Sonnet generates implementation statements per control from IaC evidence. Outputs in third-person SSP format with specific resource names and config values.
NIST OSCAL 1.1.0 System Security Plan — primary FedRAMP 20x machine-readable format. Includes all implemented requirements and system characteristics.
FedRAMP SSP v5.0 Word document — cover page, all 13 sections, control implementation table, and appendices. Human-review flagging for sections needing input.
All 18 NIST 800-53 control family Policy & Procedure documents as individual DOCX files. Templates work now; AI-enhanced content needs Bedrock.
// ssp-bedrock.js — Configuration for AWS GovCloud const FORSETI_BEDROCK_ENABLED = false; // Set true when Lambda proxy is deployed const BEDROCK_ENDPOINT = '/api/bedrock'; // Lambda proxy URL const BEDROCK_MODEL = 'anthropic.claude-3-5-sonnet-20241022-v2:0'; // GovCloud endpoint: https://bedrock-runtime.us-gov-west-1.amazonaws.com
The SSP Generator is fully functional in stub mode. You can test the complete pipeline — intake, IaC mapping, generation (stubs), review, and export — right now.
Upload artifacts and policy documents to automatically evaluate compliance evidence and update control statuses across all framework cards
Analyzes configuration files, IaC templates, scripts, and logs for compliance evidence. Pattern-matches against 43 NIST controls and auto-sets Pass on high-confidence matches.
Scans policy and procedure documents for required sections across 19 NIST control families. Verifies purpose, scope, roles, procedures, and review frequency per FedRAMP requirements.
Strong evidence automatically sets Pass/Fail on matched GRC controls. Linked family controls cascade — a passing AC-1 policy also passes AC-2 through AC-22. Fail never overridden.
Each finding shows matched keywords, evidence snippets, and confidence scores. Assessors retain full override capability with manual Pass/Fail buttons on every control.
Analyzes for compliance evidence and auto-maps to NIST 800-53 controls
Scans for required sections: purpose, scope, roles, procedures, review frequency
Phase 1: Keyword/pattern matching. Phase 2 (GovCloud): Semantic analysis via AWS Bedrock for narrative completeness and gap detection.
AI-powered compliance scanner with Bedrock integration — scans targets, evaluates controls, and feeds Pass/Fail results directly into the GRC assessment dashboard
Executes 135 commands across 14 control families with 652 individual compliance checks. Covers Linux, Windows, AWS, Azure, GCP, and Kubernetes platforms.
Uses AWS Bedrock (Claude Sonnet) to analyze findings, generate SAR-ready narratives, provide remediation guidance, and answer assessor questions in real-time.
Produces OSCAL Assessment Results JSON files compliant with the FedRAMP machine-readable schema. Maps every finding to NIST 800-53 Rev 5 controls.
Supports SSH (Linux), SSM Run Command (GovCloud), and local execution for testing. No SSH keys needed in production — uses IAM-based SSM.
Import scan results to automatically set Pass/Fail on matched GRC controls. 105 rules mapped to NIST control IDs — updates propagate across all framework cards simultaneously.
Color-coded terminal output with pass/fail tables, family breakdown, and finding severity
FedRAMP-compliant Assessment Results with findings, observations, and control mappings
Bedrock-generated SAR narrative with findings, risk analysis, and remediation recommendations
wingman scan --output results.jsonWingman v0.1.0 — Built for AWS GovCloud (us-gov-west-1). Local scanning available in offline mode via wingman scan --local --no-ai