FedRAMP 20x changes how cloud companies demonstrate security. Instead of rebuilding evidence around each assessment, teams need current validation information from the systems where security operates.
That shift can reduce repeated evidence work, surface issues earlier, and give security, engineering, compliance, assessors, and government stakeholders a clearer view of current status. Making it work requires a practical connection between the 20x rules and the infrastructure, identity systems, CI/CD pipelines, vulnerability tools, monitoring platforms, and workflows already supporting the cloud service.
That is what NorthWatch is built to provide.
Today, 38North Security is introducing NorthWatch, a compliance operations platform built first for FedRAMP 20x.
Vulnerability Response in the Context of Your System
A vulnerability scanner can identify a finding and assign a general severity score. NorthWatch goes further by evaluating what that finding means in the environment where it was detected.
NorthWatch ingests vulnerability scan output and analyzes each finding in the context of the affected asset, including its criticality, position in the security architecture, relevant countermeasures, and the attributes and known exploitability of the vulnerability itself.
From that analysis, NorthWatch calculates the Potential Agency Impact N-rating, or PAIN rating, and the applicable response timeframe. It preserves the original detection and scoring information, tracks the finding through its lifecycle, and produces the human-readable and machine-readable reporting outputs required by the FedRAMP 20x model.
Your scanners find the vulnerabilities. NorthWatch tells you which ones matter, and by when.
A Current View of How the System Is Performing
Vulnerability Detection and Response is one part of the operating model NorthWatch supports.
The platform also runs applicable Key Security Indicator checks, supports Significant Change Notification workflows, enables Certification Data Sharing, and preserves current and historical results as the system changes.
In practical terms, NorthWatch helps teams answer three questions:
What is passing?
What changed?
What needs attention?
Teams can review what was checked, what was expected, what the system returned, and whether the result met that expectation. They can also see how status changes over time instead of reconstructing the picture when the next assessment or reporting cycle begins.
The result is a shared, reviewable view of validation information across security, engineering, compliance, assessors, and authorized stakeholders.
Built Around the Environment You Already Have
Every cloud service has its own architecture, tooling, system boundaries, and operating responsibilities. NorthWatch is designed to work with those realities.
It can connect with cloud infrastructure, identity platforms, CI/CD pipelines, vulnerability scanners, monitoring tools, ticketing systems, GRC platforms, and customer-specific data sources. Existing technology remains part of the operating model when it can support the required data, validation, access, and reporting workflows.
Where the existing environment cannot yet support the required data, validation, access, or reporting workflows, 38North engineers can build the integrations, pipelines, telemetry, and system capabilities needed. NorthWatch is configured around the system and its Minimum Assessment Scope rather than requiring every company to fit the same preconfigured model.
NorthWatch also completes 38North’s end-to-end FedRAMP 20x portfolio. Advisory helps teams define the path, engineering implements and remediates what the environment requires, and NorthWatch provides the compliance operations layer that keeps the result visible and working over time.
Together, those capabilities allow one 38North team to carry the work from readiness through implementation and ongoing operation, without asking you to coordinate separate firms or manage the handoffs yourself.
Making FedRAMP 20x Operational
FedRAMP 20x is more than a different way to package evidence. It changes how validation information is produced, maintained, reviewed, and shared.
NorthWatch gives teams a practical operating layer for that change: vulnerability response grounded in system context, current KSI validation, supported significant-change workflows, structured information sharing, and a clear view of how the program is performing as the environment evolves.
Operationalize continuous validation.
To learn more or request a NorthWatch demonstration, contact info@38northsecurity.com.
About the Author
