ATO Compliance Package
======================

System: Enterprise Cloud Platform - NIST SP 800-53 Moderate
Framework: NIST_800_53
Generated: 2026-11-10T22:05:24.567Z
Archive encryption: none
Generator: PolicyCortex ATO Platform

Package Contents:
-----------------
00_INDEX.txt  - Start here: one-page index of the SSP, SPRS and POA&M workbooks and the policies and procedures by title
SSP/          - System Security Plan (NIST SP 800-18 format)
SAR/          - Security Assessment Report
POAM/         - Plan of Action and Milestones
Evidence/     - Evidence artifacts organized by control family; file names carry the control id (large collector series consolidated into per-type summary files)
Evidence_History/ledger.jsonl - One SHA3-256 hash chain of state captures, executed changes, autonomous decisions and declared gaps; verify it offline with Evidence_History/verify_ledger.py (see Evidence_History/README.txt)
Validation/   - Control assessment results (one row per control, automated policy-scan basis)
Formatted_Evidence/ - The evidence report rendered as Markdown, JSON and a Word-compatible document
EVIDENCE_GAPS.md    - In-scope controls without attached evidence and known collection/original-file availability gaps
Attachment selection: b4571e614a0d0d329813658df79d644b670675986c09b5ab3c4d07b9703c0ff9; at most five records per control across all sources.
The package contains the selected records. Additional observations and version history remain in the platform; attachment count is not a control verdict.
manifest.json       - Machine-readable package summary (counts, gaps, coverage reconciliation)
manifest.v2.json    - Per-file SHA-256 integrity manifest (see Integrity Verification below)
NOTE: 3 in-scope control(s) have no evidence in any collection run — each is listed in EVIDENCE_GAPS.md.

Integrity Verification:
-----------------------
Every file in this archive is listed in manifest.v2.json with its
SHA-256 hash and size, computed at packaging time. To verify a file:
  1. Extract the archive.
  2. Compute the file's SHA-256, e.g. `sha256sum <file>` (Linux/macOS)
     or `certutil -hashfile <file> SHA256` (Windows).
  3. Compare against the "sha256" entry for that path in manifest.v2.json.
manifest.v2.json intentionally excludes itself from its own file list.

Summary:
--------
Total Controls Assessed: 284
Controls Passed: 259
Compliance Score: 91%

NOTE: This package was generated autonomously by PolicyCortex.
Review all documents before submission to the authorizing official.
Review context: Review/Risk-Acceptance-Context.md and Review/STIG-Review-Context.json describe recorded decisions separately from technical results. Their supporting references do not add originals or change selected assessment evidence.
POA&M: POAM/eMASS_POAM.xlsx is the eMASS POA&M workbook (16 item(s)).
