FedRAMP 20x changes how cloud providers demonstrate that their security measures are working. It requires current operational information, automated verification and validation, and the ability to show how security conditions change over time.
Putting that into practice raises some fairly immediate questions:
- How do you turn vulnerability scan results into risk ratings and response deadlines?
- How do you verify that a required security measure is actually working?
- And how do you keep government customers informed when something significant changes in the environment?
Those are three of the workflows NorthWatch was built to support.
In our first NorthWatch product walkthrough, Ingrid Woodley, Senior Director of Revenue Strategy at 38North Security, joins Sam Leestma, Vice President of Solutions Engineering, to demonstrate how NorthWatch handles vulnerability evaluation and reporting (VER), Key Security Indicator (KSI) verification and validation, and Significant Change Notifications (SCNs).
Prefer to watch instead? Here’s the full NorthWatch walkthrough with Ingrid and Sam.
Turning Vulnerability Data Into Something Actionable
Vulnerability scanners are very good at identifying vulnerabilities. Determining what those vulnerabilities mean for a particular cloud environment requires additional information.
A vulnerability affecting an internet-facing system that processes sensitive data may warrant a different response from the same vulnerability on an isolated supporting service. Its severity, exploitability, location in the architecture, and existing security protections all contribute to the evaluation.
NorthWatch starts by ingesting vulnerability data from the cloud service provider’s existing scanners. Each vulnerability passes through a configurable risk engine that evaluates it against the security context of the system.
During onboarding, assets can be organized into classes with common attributes. These classifications allow NorthWatch to evaluate vulnerabilities using information such as asset criticality, exposure, and position within the security architecture. The engine also incorporates vulnerability intelligence, including the Known Exploited Vulnerabilities (KEV) catalog and Exploit Prediction Scoring System (EPSS).
The demonstration shows how these factors affect the initial CVSS score. NorthWatch applies configured adjustments, including applicable countermeasures, to produce a contextual risk evaluation. The result feeds into the Potential Agency Impact N-rating (PAIN) calculation and its associated response deadline.
Users can inspect that calculation rather than simply accepting the final rating. Opening an individual vulnerability reveals its original severity score, adjusted score, applicable risk factors, and the adjustments used during evaluation.
This detail matters when a security team needs to explain why a particular vulnerability received an N3 or N4 rating, understand the applicable response timeline, or review how its system-specific security context affected the outcome.
The resulting VDR view brings together vulnerability information, ratings, response deadlines, and status so teams can identify what requires attention and track vulnerabilities across scans.
Learn more: FedRAMP 20x VER and VDR is More Than Just Automation
Verifying What is Actually Working
FedRAMP 20x also introduces Key Security Indicators: security expectations that providers must verify and validate using defined methods.
NorthWatch supports this through checks against operational data sources. During implementation, the relevant sources are identified, the expected results are defined, and validation methods are configured to evaluate whether the system meets those expectations.
The dashboard provides a high-level view of the KSIs being monitored and their current status. From there, users can examine individual KSIs, the methods used to evaluate them, and the underlying validation results.
One example in the demonstration illustrates why that detail matters.
A KSI associated with identity and access management shows a Partial status. Drilling into the record reveals 19 individual validations, two of which are failing.
The detailed view identifies the resources queried, their data sources, the expected conditions, the actual results, and the reasons for failure. It also provides validation history and information about when the evidence was last collected.
Someone reviewing the result can trace the status back to the underlying checks and identify precisely which expectations were not met.
NorthWatch also makes the validation information available in JSON format, allowing it to be exported and used by other systems, including GRC platforms.
Historical results provide another important part of the picture. Teams can examine how validation status has changed, including whether a KSI has consistently met expectations or experienced failures over time.
That traceability gives security teams, compliance personnel, and authorized stakeholders a way to review both the current result and the information supporting it.
Learn more: From Controls to Security Outcomes: How to Think About KSIs in FedRAMP 20x
Making Significant Changes Visible
A cloud environment changes constantly. Some changes are routine. Others may affect the system’s security posture or require notification to government stakeholders.
FedRAMP’s Significant Change Notification rules establish processes for identifying, documenting, and communicating those changes.
NorthWatch includes an SCN module that allows users to create and review significant change notifications and maintain visibility into their status and history.
In the demonstration, Sam walks through the manual creation process. Users can select the change type, including Adaptive or Transformative, and enter the information associated with that classification. The fields adjust according to the selected change type.
The workflow also supports involving an independent assessor when applicable, including providing a one-time link for submitting supporting material.
Once created, a notification becomes available through NorthWatch for authorized stakeholders to review. The dashboard provides visibility into open notifications, while closed records remain available for historical reference.
Sam also discusses the intended integration approach: connecting NorthWatch with customers’ existing change-management systems so information can flow into the notification process without requiring teams to recreate the same records manually. The appropriate integration would depend on the customer’s environment.
The larger change-management process remains the provider’s responsibility, including determining significance, obtaining required approvals, and satisfying applicable reporting obligations. NorthWatch supports the notification workflow and makes that information accessible to the people who need it.
Connecting the Operational Picture
Vulnerability evaluation, KSI validation, and significant change notification serve different purposes, but they all depend on the same underlying capability: turning operational information into results that people can inspect, understand, and use.
A vulnerability rating needs to reflect the security context of the affected system. A KSI status needs to be traceable to the checks that produced it. A significant change notification needs enough information for affected stakeholders to understand what is changing.
NorthWatch brings these workflows into a common operational view, with access to current status, supporting details, and historical information.
For this first walkthrough, we concentrated on how those three workflows function at a high level. Upcoming videos in the NorthWatch series will examine the VDR and VER methodology, KSI verification and validation, Significant Change Notifications, and how NorthWatch fits into a customer’s broader operational environment.
See NorthWatch in Your Environment
38North Security helps cloud providers implement FedRAMP continuous validation through compliance advisory, security engineering, and NorthWatch. That includes defining validation methods, configuring vulnerability risk models, developing integrations, and establishing the workflows needed to support ongoing security assurance.
NorthWatch is currently undergoing a FedRAMP 20x Class C assessment, giving our team firsthand experience with the assessment process and the operational requirements the platform was built to support.
About the Authors
