A sample SSP, POA&M and OSCAL package you can check yourself.

Download the files

What is inside the package

Check it yourself, offline

python3 Evidence_History/verify_ledger.py Evidence_History/ledger.jsonl --organization-id aa98488a-56df-457a-bb2c-e8c661543c04

PolicyCortex evidence stream verification (SHA3-256)
stream: Evidence_History/ledger.jsonl
status: INTACT
headDigest: 9496e0defd46052a2285bfa9cdb68336eedb18f8ee6e622e8953caa690e866e9
records: 721 (state_capture 721, change_record 0, declared_gap 0, agency_record 0)
ledger.json: sha3Chain head digest and counts match
signature: ledger.json is not signed (UNSIGNED_NO_SERVER_KEY); keep the head digest outside PolicyCortex to detect later changes
not chained: 0 executed changes without an observed before and after state, 0 autonomous decisions without a recorded envelope evaluation (ids in manifest.json evidenceChainV2.exclusions)

What this sample is, and is not

Data

Fictional. The system, the organization, its cloud resources and their IDs come from the product's demonstration data. No customer cloud was scanned to make it.

How it was made

On November 10, 2026 a local copy of the application, built from the product's main branch, exported the package and the two PDFs from its own Export page. Nothing in them was edited; the files were only renamed. The worksheet and the verifier are copied out of the ZIP, and the verifier output is what the verifier printed.

Signature

Not signed. The local copy had no signing key, and the verifier's output says so. With a signing key set, a package also carries an HMAC-SHA256 signature that binds the stream's head digest and record counts, which the verifier checks when it is given the key.

Evidence stream

721 state captures. The export found no executed changes, autonomous decisions or collection gaps for this system in its window, so the stream holds no change records, agency records or declared gaps.

OSCAL

Checked on November 10, 2026 against NIST's OSCAL 1.1.2 JSON schemas: the SSP, the POA&M and the assessment results all pass. The schemas check structure only; the further rules NIST's oscal-cli applies were not run.

Assessment

PolicyCortex prepares the record. It is not an assessor, and this sample is not an assessment or an authorization.

When the next sample is published

Your own package

nist-800-53

NIST SP 800-53: the Low, Moderate and High baselines, and the SSP, SAR and POA&M generated from one record.

proof.state

Proof of State: what a state capture records, and how the stream is checked.

architecture

Architecture: how the chain is built and where evidence is stored in each delivery mode.

Questions about the sample

1. Q-01

   Is any of this real customer data?

   No. The product generated it from its demonstration data, which describes a fictional system at a fictional organization. No customer cloud was scanned to make it.

2. Q-02

   Do I need an account, or PolicyCortex installed, to verify it?

   No. The verifier is one Python file that uses the standard library only. It runs offline, with no PolicyCortex account and no network.

3. Q-03

   What does a passing check prove?

   That every record in the evidence stream still recomputes, in order, and that the stream matches ledger.json. Matching the head digest with a copy kept elsewhere, like the one on this page, rules out a stream rewritten from end to end. It does not show that the evidence was right when it was collected; the assessor examines that.

4. Q-04

   Can I get a package like this for my own system?

   Yes, from the product, once access is agreed. Request access and we review your environment and agree a read-only scope before anything connects.