--- title: "Proof of State" description: "What was true in your cloud as of a date someone else picks: state records hash chained, kept seven years, verifiable by a second party without our help." url: https://policycortex.com/proof/state sealed: 2026-08-31 amended: 2026-09-05 register: proof/state records: 5 digest: sha3:1376adb55724cd88ae22346d3ab2f7a1486c97856f2351cf56c6598e2af221ca --- # What was true, as of a time you can name. Proof of State An assessor names a date three months back and asks what your environment was on that day. Dashboards overwrite themselves, and activity logs record that something changed, not what everything was. This layer keeps the record of the moment itself, and a second party can check it without our help. **In one paragraph.** Proof of state is a point-in-time record of cloud configuration, taken from the cloud provider APIs, content hashed with SHA3-256, chained to the previous record, retained seven years, and regenerable to any timestamp a second party picks. It answers what was true in the environment on a date somebody else names, not what is true now. [Request Access](https://app.policycortex.com/auth?mode=request-access) ยท [How it works](https://policycortex.com/architecture) ## An assessor names a date three months back. Produce the configuration. Q1. Can you produce the configuration of your environment as of a date someone else picks, or only as of today? The request is ordinary. An assessor names a date three months back and asks what your environment was on that day: which storage accounts enforced encryption at rest, which network paths were open, which identities held which roles, and inside which declared boundary each resource sat. The date is theirs, not yours. That is the whole difficulty. Dashboards overwrite themselves. A console renders current state, and current state is the one thing nobody asked about. Activity logs record that something changed, not what everything was at a moment. Screenshots preserve whatever someone thought to capture, on the day they thought to capture it. When the date arrives from outside, none of these reconstruct the moment. They reconstruct your best story about it. Proof of State is the record of the moment itself: point-in-time captures of resource configuration, taken from the cloud provider APIs, content hashed, chained, and kept. As of stops being a reconstruction project and becomes a parameter you pass. State is the first of three proofs. [Proof of Change](https://policycortex.com/proof/change) records what altered the estate and under what authority. [Proof of Agency](https://policycortex.com/proof/agency) records what your machines were allowed to do before they did it. All three commit to the same evidence base. ## What we actually record One record per resource, per capture, whether the capture ran on schedule or a change triggered it. The claim is not a sentence about the resource; it is the raw provider response underneath, hashed. The field names below are the real ones. - **resource.id**: The full provider path of the resource this record is about: the identifier the cloud API resolves, not a friendly name someone typed into a spreadsheet. - **control.mapping**: The control statements this state bears on, stored on the record. One encryption setting can evidence NIST 800-171 3.13.16 and 800-53 SC-28 at once, and the mapping is written down, not implied. - **asset.scope**: The declared boundary the resource sits in: CUI enclave, environment, production class. Scoping arguments get settled by this field instead of by the meeting. - **state.proof**: The raw cloud API response that grounds the claim, stored verbatim. If a narrative and this payload ever disagree, the payload wins. - **content.hash**: SHA3-256 digest of the record content. Anyone holding the record can recompute it; a matching digest means unaltered content, with no trust in us required. - **captured.at**: UTC timestamp of the capture. Every claim in the evidence base reads as of this field, not as of whenever someone last looked. - **retention**: Seven years, append-only JSONL. A record is never updated in place; newer state is a new record, chained after the old one. - **regenerable.to**: Any historical timestamp inside retention. The assessor picks the date; the evidence base rebuilds the environment as of that date from the records written then. ![The PolicyCortex evidence system: registered collectors and artifacts grouped by control, each artifact with source, resource path, capture time, size, and SHA hash](https://policycortex.com/images/pcx-evidence-system-artifacts-1600.webp) Exhibit S-1. Collectors writing hashed artifacts per control: the record family above, as it lands. Illustrative demo data; the interface is real. ## How the record is verified Each state record is content hashed with SHA3-256 and carries the digest of the record before it, so every line commits to the entire history above it. The log is append-only: a correction is a new record, never an edit. Alter one record, anywhere, at any time, and every digest after it stops recomputing. Verification is a recomputation, not an assertion: run the chain from the first record forward and it returns one of two answers, intact, or the sequence number of the first record that breaks. A second party can do that recomputation without our help. The records, the digests, and the chain rule are everything required: no PolicyCortex account, no API of ours in the loop, no trust in the operator whose environment is being examined. Retention is seven years, and because the log is a chain rather than a table, producing the environment as of any date is a replay, not an archaeology project. The documents assessors ask for are projections of this record, not parallel artifacts maintained by hand. SSP, POA&M, and SAR generate from one implementation record, and the package exports as OSCAL 1.1.2. The same record ships in [assessor handoff shape](https://policycortex.com/cmmc/emass-c3pao-handoff) for the eMASS and C3PAO exchange, and in [program-office shapes](https://policycortex.com/federal) for federal environments. The document is never the source. The chain is. How the chain is constructed and where it lives inside your tenant is covered in the [architecture](https://policycortex.com/architecture). There is no telemetry pipeline to PolicyCortex servers and no egress of evidence. Verification works precisely because nothing about it depends on us. ## What this layer does not do **Stated limit.** Proof of State cannot attest to what it never observed. Environments outside connected scope produce no records, and the record says so: when a collector is down or a scope is unobserved, the chain carries an explicit gap entry with the interval and the reason, never silently fewer rows. Absence is declared, not inferred. And the record is not the verdict: it does not guarantee an assessment outcome, and it is not the assessor. It is what you hand the assessor so the argument is about the environment instead of about the evidence. ## Where it maps State evidence files under continuous monitoring, with the audit family governing how the records themselves are protected. The mapping is quiet on purpose: the record is the product, and the rows below are where assessors expect to find it. - **NIST 800-53**: CA-7 continuous monitoring grounded in point-in-time records, with the AU family covering how those records are protected, retained, and reviewed. - **NIST 800-171 / CMMC Level 2**: One evidence base for the 110 requirements: state records handed to your assessor as generated evidence with the raw payload attached. - **FedRAMP 20x**: Machine-readable by construction. State and control mappings export as OSCAL 1.1.2 rather than as documents transcribed from screenshots. - **MITRE ATT&CK**: Configuration tampering becomes detectable because expected state is on record: an unexplained delta from the last capture anchors the detection. ![The PolicyCortex control implementation table: CMMC Level 2 controls by family with implementation status and evidence counts](https://policycortex.com/images/pcx-system-control-collections-1600.webp) Exhibit S-2. The 110-requirement table where state evidence files, control by control. Illustrative demo data; the interface is real. Reconstruct the state a reviewer actually asks for. [Request Access](https://app.policycortex.com/auth?mode=request-access) ## Register colophon | Seq | Label | SHA3-256 | Prev | |---|---|---|---| | REC 0000 | THE QUESTION | c753fa1b8b86 | e92b4ef53279 | | REC 0001 | WHAT WE RECORD | 7862dd1c94e2 | c753fa1b8b86 | | REC 0002 | VERIFICATION | 271a782586f8 | 7862dd1c94e2 | | REC 0003 | STATED LIMIT | 781ea88d3d04 | 271a782586f8 | | REC 0004 | FRAMEWORK MAP | 1376adb55724 | 781ea88d3d04 | Head sha3:1376adb55724cd88ae22346d3ab2f7a1486c97856f2351cf56c6598e2af221ca. Each digest is SHA3-256 over the previous digest, the register key, the record label, and the record copy; a second party can recompute it from this document.