GS|ATO™ writes your System Security Plan, policies and procedures from what you run. The system checks each statement. A named person approves it. The numbers here come from our own FedRAMP High package (Class D under the 2026 Consolidated Rules). Nothing on this page is typed in by hand.
Start small — $5,000 · a five-day readiness assessment of the SSP you already have.
Drop your own scan file. It is read in your browser. Nothing leaves your machine.
The home page shows ten real events and the control that decided each one. The same engine can look at what matters to you.
| What | Count | Minutes | Date |
|---|
These are the slowest times we measured, not averages. The clock stops when a scheduled check finds the batch done. That package is our test bed, not an authorized system. Your reviewers' calendar sets the rest.
Every gap has a name: the control, the evidence, the approver. We never show a percent without that list.
These are our own package's numbers on the snapshot date.
{n} characters, drafted from what you run
Each statement is one record. It has the rule, the draft, the review, the evidence and the approvals in it. A person approves it by typing in twelve characters from the record's code. That is just a confirmation, not a signature. Every later change still needs a named approver.
Today a new draft runs when an operator starts it. A scheduled run is your choice.
The NIST SP 800-53 Rev 5 catalog comes in as OSCAL (version {catalogIn}, catalog release {catalogRelease}). The FedRAMP baselines come from the OSCAL Foundation's fedramp-resources files. Your package goes out as OSCAL {out}: {exports}. We check each package before it leaves. The full FedRAMP schema check runs when we build. Same inputs, same package.
FedRAMP's own machine-readable indicators come from FedRAMP's files. We loaded them on {corpusAsOf}: {indicators} indicators in {themes} themes, linked to controls in {indicatorControlLinks} places. Your Rev 5 work already maps onto them: {controlMappings} mappings today. So the move to 20x starts from work you already did. On our own package as of {evalAsOf}, we checked {evalCount} of {ofIndicators} indicators. Of those, {manualReview} went to a person, {notMet} were not met, {met} were met.
We check that list against FedRAMP's current rules file. On {upstreamRetrievedAt} it listed {upstreamIndicators} indicators in {upstreamThemes} themes. Of the indicators we loaded, {notInCurrentFile} are no longer in that file.
| Category | What you get |
|---|---|
| Evidence-collection platforms | collect and check lists; you still write |
| Package tools and templates | fill a template; you still review |
| Consultancies and assessors | people, months, a fixed report |
| GS|ATO | drafts, checks each statement, names the gaps, hands each one to a named approver, keeps the record |
We reviewed other platforms on September 16, 2026. We did not find these there: timed, dated runs on a full package. A system check on each statement, separate from the drafter. A named approval on every statement. Statements, policies, procedures and fix drafts from one engine.
Pick your stack. See what you won't have to write.
Instant, with no AI in it. A fixed rule reads each provider's package and lists every control it covers, with the source and the split. For this stack at {baseline label}: {P+S} of {total}.
One batch. On our own package at the High baseline, 203 statements came back drafted in 14 minutes. For this stack: {Y} statements to draft.
Bring a scan file. Each real finding gets a draft fix with its source. Nothing is changed without your approval. A finding closes only when a later scan confirms it.
The baselines are FedRAMP Rev 5. The OSCAL Foundation publishes them: 156 controls at Low, 323 at Moderate, 410 at High. Control and family names are the official NIST SP 800-53 Rev 5 titles.
AWS GovCloud, Azure Government and Google Cloud split the work the same way. The provider owns 31 controls, all on its own. They are physical, environmental, maintenance, media, staff and alternate sites. It shares 37 more controls with you.
AWS service citations come from AWS's own OSCAL component definitions. We join those to the Security Hub → NIST 800-53 map that AWS publishes with its guard rules. They are shared, never complete on the provider's side.
cloud.gov rows come from cloud.gov's published control policies. Red Hat OpenShift rows come from the ComplianceAsCode OSCAL component definition at the Moderate baseline. That is why OpenShift stops counting at High.
Vendor rows are what each vendor's public FedRAMP package or trust page says. Each is one citation per control, with a link where the vendor's page still answers. At FedRAMP High, a vendor we hold at Moderate does not count until we map its High package. A vendor we have not mapped yet counts as yours to write. We map it at onboarding, from the vendor's own package.
A control is provider-covered when one of your picks says it owns it in full. It is shared when they say it is split. It is yours when no pick speaks to it.
The same engine runs inside the platform. This page holds a copy of its data as of the snapshot date above. The platform recomputes on every change.
This is not an audit of your setup. It is not legal, audit or compliance advice.
The full method, and how each claim above was checked, is on sources.html.