--- title: "AWS Governance Evidence, GovCloud Included" description: "AWS commercial and GovCloud: control state, controlled remediation, and CMMC, NIST 800-171, FedRAMP, SOC 2, and PCI DSS mappings as hash-chained evidence." url: https://policycortex.com/solutions/aws sealed: 2026-09-02 amended: 2026-09-02 register: solutions/aws records: 6 digest: sha3:b7dc0f7b8502537fec7928cdcd6d0f784d50f6ed8bf9d9f5a610ad989ff61ac9 --- # AWS governance, commercial through GovCloud. AWS Config / Security Hub / CloudTrail / GovCloud PolicyCortex runs inside your AWS accounts, single account through Organizations, commercial through GovCloud (us-gov-east-1 and us-gov-west-1). It reads AWS Config, Security Hub, CloudTrail, and IAM Identity Center, records what the estate was, what changed it, and what machines were allowed to do, and maps those records to CMMC, NIST 800-171, FedRAMP, SOC 2, and PCI DSS 4.0. [Request verification](https://policycortex.com/contact) · [Book a call](https://policycortex.com/book) Read only. Fourteen days. No sales call required. ## What an AWS estate must prove Whatever the framework, the assessor's questions about an AWS estate are the same three. What was the configuration of this account, this bucket, this role, as of a date they name? Who or what changed it, and under whose authority? And when an automated fix ran, what was it allowed to do before it did it? AWS Config answers the first for today and CloudTrail answers the second as log lines; neither records what an automated fix was permitted to do before it ran. Multi-account estates add scope: which accounts in the Organization are inside the boundary, and whether the ones outside it were unobserved or simply not connected. - **aws.scope**: Single account through AWS Organizations; member accounts discovered through the Organizations API. SCPs are honored, never bypassed. - **aws.regions**: Commercial regions and GovCloud (us-gov-east-1, us-gov-west-1). ITAR-scoped workloads are supported in GovCloud when the boundary is declared. - **aws.sources**: AWS Config rule evaluations, Security Hub findings, CloudTrail, IAM Identity Center. Read scope for the evaluation. - **aws.frameworks**: CMMC Level 2, NIST 800-171, NIST 800-53, FedRAMP, SOC 2, PCI DSS 4.0. AWS boundaries are supported for ATO packaging. ## The evidence produced from your AWS accounts AWS Config tells you what is true now. The record tells you what was true then, what changed it, and what any machine was permitted to do. Where each proof files: - **Config · Security Hub**: Proof of state: rule evaluations and findings captured as point-in-time records with the raw API response attached, content hashed, regenerable to any date. Existing Config investment is consumed, not replaced. - **CloudTrail · IAM**: Proof of change: who or what altered a resource, under what authority, with before and after hashes and a rollback identifier. A CloudTrail event says it happened; the record says under whose authority. - **Remediation via SSM**: Proof of agency: every remediation proposed by the engine and executed through SSM Run Command, State Manager, or the SDK runs inside an envelope and in the trust mode you set. GATED, a named human approving each action, is the default. - **Organizations**: Scope as a declared field: which member accounts are inside the boundary. Accounts not connected are recorded as unobserved, not as compliant. - **Frameworks**: One control mapping per record: an S3 encryption setting evidences NIST 800-171 3.13.16, 800-53 SC-28, and PCI DSS 4.0 requirement 3 at once, written down, not implied. ![The PolicyCortex evidence system: registered collectors and artifacts grouped by control, each artifact with source, resource path, capture time, size, and SHA hash](https://policycortex.com/images/pcx-evidence-system-artifacts-1600.webp) Exhibit SB-2 · collectors writing hashed artifacts per control from the account's own sources, each with source, resource path, capture time, and digest. Illustrative demo data; the interface is real. ## How the record is verified across accounts Across an Organization the recomputation covers every connected member account as one chain, and an account that was never connected appears as an unobserved scope rather than as a clean one. Every record PolicyCortex writes for this obligation is content hashed with SHA3-256 and carries the digest of the record before it, so each line commits to the entire history above it. The log is append only: a correction is a new record, never an edit. Verification is a recomputation, not an assertion. Run the chain from the first record forward and it returns one of two answers: intact, or the sequence number of the first record that breaks. A second party can do that recomputation without our help. The records, the digests, and the chain rule are everything required: no PolicyCortex account, no API of ours in the loop. When a collector was down or a scope was unobserved, the chain carries a declared gap with the interval and the reason, never silently fewer rows. Absence is declared, not inferred. **Stated limit.** PolicyCortex is not an assessor and does not certify anything. It produces the records a compliance decision rests on; the assessor, the authorizing official, or the accountable official makes the determination. What is not connected is not observed, and the record says so. Control identifiers cite NIST SP 800-53 Rev 5, NIST SP 800-171 Rev 2, PCI DSS 4.0, SOC 2 TSC, ISO/IEC 27001:2022 and 45 CFR 164 as published. ## How you evaluate it in an AWS account The fourteen days begin with an IAM cross-account role with read scope; Config rule evaluations, Security Hub findings, and CloudTrail are read, nothing is written, and SCPs stay in force throughout. Connect read only for fourteen days, in SHADOW mode, inside your own tenant. Nothing executes. Policy evaluation, evidence collection, and action gating run where your data already is; there is no telemetry pipeline to PolicyCortex servers and no egress of evidence. At the end of the fourteen days you hold the records and can recompute the chain yourself. - **eval.mode**: SHADOW. Watch only; nothing executes. - **eval.duration**: Fourteen days. - **eval.location**: Your tenant. Azure, AWS, and GCP are observed clouds, including AWS GovCloud, Azure Government, and GCC High. - **eval.egress**: None. No telemetry pipeline to PolicyCortex servers; no evidence leaves the tenant. - **eval.after**: You keep the records. Licensing is annual and the tenant owns the evidence; a delivery engagement is optional. ## Delivery, if you want the record stood up for you Licensing does not depend on it, but a fixed-scope delivery engagement is available: thirty days, one agreed primary cloud environment, an evidence package built and defended through assessor review. The independent assessor makes the certification decision. No certification is guaranteed. The standard engagement scope is a CMMC Level 2 package in one primary environment; AWS GovCloud is in scope. - **engagement.scope**: Thirty days. One agreed primary cloud environment. - **engagement.outcome**: An evidence package built and defended through assessor review. - **engagement.limit**: The independent assessor decides. No certification is guaranteed. [Every term of the engagement, on its own page.](https://policycortex.com/engagement) ## Questions assessors and buyers ask **Q: Is GovCloud supported?** A: Yes. PolicyCortex deploys in us-gov-east-1 and us-gov-west-1. ITAR-scoped workloads are supported when the boundary is declared. **Q: Does this replace AWS Config?** A: No. It consumes Config rule evaluations and Security Hub findings and adds what they lack: a hash-chained record of state as of any date, the authority behind each change, framework mappings, and gated remediation. Existing Config investment is preserved. **Q: Multi-account and Organizations?** A: Yes. Member accounts are discovered through the Organizations API. SCPs are honored; PolicyCortex operates within your guardrails, never around them. **Q: How does remediation execute?** A: Through SSM Run Command, State Manager, or direct SDK calls, inside an autonomy envelope and in the trust mode you set. GATED is the default: a named human approves each action and becomes part of its record. A rollback identifier is armed before any modification, and every action lands in proof of agency. **Q: Where does the data live?** A: In your own tenant. There is no telemetry pipeline to PolicyCortex servers and no egress of evidence. **Q: What happens when a collector is down?** A: The chain carries a declared gap: the stream, the interval, the reason, and when it was declared. Evidence never silently has fewer rows. Connect an AWS account read only. Recompute what you see. [Request verification](https://policycortex.com/contact) · [Book a call](https://policycortex.com/book) ## Register colophon | Seq | Label | SHA3-256 | Prev | |---|---|---|---| | REC 0000 | OBLIGATION | 6637af0399ed | cf04d1c3f16b | | REC 0001 | EVIDENCE | 9e7d5b5e195b | 6637af0399ed | | REC 0002 | VERIFICATION | 4a213cfcde85 | 9e7d5b5e195b | | REC 0003 | EVALUATION | 401fa1710978 | 4a213cfcde85 | | REC 0004 | DELIVERY | c2d1d94be9f7 | 401fa1710978 | | REC 0005 | QUESTIONS | b7dc0f7b8502 | c2d1d94be9f7 | Head sha3:b7dc0f7b8502537fec7928cdcd6d0f784d50f6ed8bf9d9f5a610ad989ff61ac9. Each digest is SHA3-256 over the previous digest, the register key, the record label, and the record copy; a second party can recompute it from this document.