The package is a projection of the record.

One implementation record, several shapes.

ssp

The System Security Plan, in NIST SP 800-18 r1 structure, generated from the implementation record rather than authored beside it.

sar

The Security Assessment Report, per NIST SP 800-53A, generated from the same record.

poam

The Plan of Action and Milestones: open gaps by family and severity, each with an owner and a remediation path.

oscal

OSCAL 1.1.2 JSON, native. Machine readable by construction; the format FedRAMP 20x asks for.

emass

eMASS XML, the assessor handoff shape for the eMASS and C3PAO exchange. The OSCAL package is C3PAO-agnostic; it does not lock you to an assessor.

conmon.record

The continuous monitoring record: append-only JSONL, hash chained, seven-year retention, regenerable to any timestamp.

evidence.index

The index of evidence artifacts behind every control, each with its content hash and capture time.

package

One ZIP carrying all of the above: inventory, validations, POA&M, SSP, SAR. Hash chained, AES-256 protected.

See alsoProof of state, where the rows come fromThe export surface in the architecture

Regenerable to the date the authorizing official signed.

$ pcx export package as-of=2026-05-14
implementation  one record, head sha3:2f8ce1a90b47
projections     ssp  sar  poam  oscal-1.1.2.json  emass.xml  evidence-index
gaps            1 declared (interval and reason on record)
verify          INTACT

$ pcx export package as-of=2026-08-31
delta           rows added since 2026-05-14, enumerated by sequence number
edited.rows     0   (an edit would read BROKEN at the first failing seq)

See alsoProof of change, where edits become visibleDeclared gaps

From scope to 3PAO assessment.

NIST 800-53

CA-7 continuous monitoring from point-in-time records; AU-9 and AU-10 from the chain itself; CM-3, AC-6, SI-4. SSP and SAR generated, not authored.

NIST 800-171 / CMMC Level 2

One evidence base for the 110 requirements, handed to the assessor as generated evidence with the raw payload attached.

FedRAMP 20x

Machine-readable by construction; exports as OSCAL 1.1.2 rather than as documents transcribed from screenshots.

eMASS / C3PAO

The handoff package: what the assessor receives and how they verify it by hash.

PCX · Exhibit A-2 · register copyExhibit A-2ato collection, as shippedMounted · intact

Exhibit A-2 · one authorization package from scope to 3PAO assessment: passing controls, family coverage, next action. Illustrative demo data; the interface is real.

See alsoThe eMASS and C3PAO handoffThe federal record

Which boundaries.

Four questions program offices ask.

1. Q-01

   What is in the package?

   The SSP, the SAR, the POA&M, the OSCAL 1.1.2 JSON, the eMASS XML, and the evidence indexes, generated from one implementation record and shipped as one ZIP, hash chained and AES-256 protected.

2. Q-02

   Which clouds are supported for ATO packaging?

   AWS and Azure boundaries, including AWS GovCloud and Azure Government; the software also runs inside GCC High. GCP is observed for governance, remediation, and control-linked evidence, but an ATO workflow for GCP is not offered.

3. Q-03

   Can the package be regenerated as of a past date?

   Yes. Retention is seven years and the record regenerates to any historical timestamp inside it, so the package as of the day the authorizing official signed is a parameter you pass, not an archive you search.

4. Q-04

   Does PolicyCortex authorize or certify the system?

   No. The authorizing official remains the authority on what operates and the assessor remains the authority on what passes. PolicyCortex produces the records those decisions rest on, and no certification is guaranteed.

What this page is not.