Evidence for an assessment: NIST 800-53, OSCAL and FedRAMP 20x
What Quilzo does for each control, who does the rest, and evidence an auditor can check.
| To | Run |
|---|---|
| What a questionnaire asks | quilzo compliance summary |
| How Quilzo implements a control | quilzo compliance implementation AC-7 |
| As an OSCAL component definition | quilzo compliance component -o component.json |
| A draft OSCAL system security plan | quilzo compliance ssp --impact moderate |
| FedRAMP 20x Key Security Indicators | quilzo compliance ksi |
| Secure by Design pledge | quilzo compliance pledge |
| A CycloneDX SBOM from the build | quilzo compliance sbom sbom.json |
| Every algorithm and its post-quantum status | quilzo compliance crypto |
| What the law asks of the published site | quilzo compliance site --statement |
| An accessibility conformance report | quilzo compliance acr |
Organisation policy, as NIST parameters
quilzo policy show
quilzo policy propose ac-12_odp="8 hours" --reason "..."
quilzo policy approve ID # a second administratorEvidence over time, and auditors
| To | Run |
|---|---|
| What the evidence shows over a period | quilzo assurance report |
| Engage an auditor, scoped and ending | quilzo engagement open ID --firm ... |
| One file of evidence, proofs and a signed head | quilzo engagement issue ID -o FILE |
| Answer a questionnaire from your claims | quilzo attest fill FILE |
| Controls across a group of companies | quilzo entity report |