Trust Center

Security we'll prove, not just promise.

FedSpire is in development and does not yet hold any compliance authorizations. This page shows where we are headed and how we are building toward it. We will update it as we reach each milestone.

Compliance roadmap

FedRAMP 20x — Class C

Planned

Our authorization target. Class C is the FedRAMP 20x level that replaces the legacy Moderate baseline and covers systems handling Controlled Unclassified Information.

Status as of November 2026. "Planned" means it is on our roadmap; no assessment has been completed yet.

FedRAMP 20x Class C — Key Security Indicators

Class C KSIs

Themes

Planned

Validated

Cybersecurity Education

KSI-CED · 1

KSI-CED-RAT
Reviewing All Training
Planned

Change Management

KSI-CMT · 4

KSI-CMT-LMC
Logging Changes
Planned
KSI-CMT-RMV
Redeploying vs Modifying
Planned
KSI-CMT-RVP
Reviewing Change Procedures
Planned
KSI-CMT-VTD
Validating Throughout Deployment
Planned

Cloud Native Architecture

KSI-CNA · 8

KSI-CNA-DFP
Defining Functionality and Privileges
Planned
KSI-CNA-EIS
Enforcing Intended State
Planned
KSI-CNA-IBP
Implementing Best Practices
Planned
KSI-CNA-MAT
Minimizing Attack Surface
Planned
KSI-CNA-OFA
Optimizing for Availability
Planned
KSI-CNA-RNT
Restricting Network Traffic
Planned
KSI-CNA-RVP
Reviewing Protections
Planned
KSI-CNA-ULN
Using Logical Networking
Planned

Identity and Access Management

KSI-IAM · 6

KSI-IAM-AAM
Automating Account Management
Planned
KSI-IAM-APM
Adopting Passwordless Methods
Planned
KSI-IAM-ELP
Ensuring Least Privilege
Planned
KSI-IAM-JIT
Authorizing Just-in-Time
Planned
KSI-IAM-SNU
Securing Non-User Authentication
Planned
KSI-IAM-SUS
Responding to Suspicious Activity
Planned

Incident Response

KSI-INR · 3

KSI-INR-AAR
Generating After Action Reports
Planned
KSI-INR-RIR
Reviewing Incident Response Procedures
Planned
KSI-INR-RPI
Reviewing Past Incidents
Planned

Monitoring, Logging, and Auditing

KSI-MLA · 5

KSI-MLA-ALA
Authorizing Log Access
Planned
KSI-MLA-EVC
Evaluating Configurations
Planned
KSI-MLA-LET
Logging Event Types
Planned
KSI-MLA-OSM
Operating SIEM Capability
Planned
KSI-MLA-RVL
Reviewing Logs
Planned

Policy and Inventory

KSI-PIY · 5

KSI-PIY-GIV
Generating Inventories
Planned
KSI-PIY-RES
Reviewing Executive Support
Planned
KSI-PIY-RIS
Reviewing Investments in Security
Planned
KSI-PIY-RSD
Reviewing Security in the SDLC
Planned
KSI-PIY-RVD
Reviewing Vulnerability Disclosures
Planned

Recovery Planning

KSI-RPL · 4

KSI-RPL-ABO
Aligning Backups with Objectives
Planned
KSI-RPL-ARP
Aligning Recovery Plan
Planned
KSI-RPL-RRO
Reviewing Recovery Objectives
Planned
KSI-RPL-TRC
Testing Recovery Capabilities
Planned

Supply Chain Risk

KSI-SCR · 2

KSI-SCR-MIT
Mitigating Supply Chain Risk
Planned
KSI-SCR-MON
Monitoring Supply Chain Risk
Planned

Service Configuration

KSI-SVC · 8

KSI-SVC-ACM
Automating Configuration Management
Planned
KSI-SVC-ASM
Automating Secret Management
Planned
KSI-SVC-EIS
Evaluating and Improving Security
Planned
KSI-SVC-PRR
Preventing Residual Risk
Planned
KSI-SVC-RUD
Removing Unwanted Data
Planned
KSI-SVC-SIN
Securing Information
Planned
KSI-SVC-VCM
Validating Communications
Planned
KSI-SVC-VRI
Validating Resource Integrity
Planned

KSI list from the FedRAMP Consolidated Rules for 2026 (Class C). "Planned" means work toward the indicator is on our roadmap; none has been validated by an assessor yet.

Sub-processors

The third-party services and tools FedSpire uses to run and secure the platform. Cloud services are listed with their FedRAMP Marketplace package; self-hosted tools run inside our own boundary.

FedRAMP Certified

AWS Commercial

Amazon Web Services, Inc.

Cloud infrastructure hosting

Package ID: AGENCYAMAZONEW
Offering: AWS US East/West
Class: Class C (Moderate)

FedRAMP Certified

Okta

Identity, single sign-on and MFA

Package ID: F1512167750
Offering: Okta IDaaS Regulated Cloud
Class: Class C (Moderate)

FedRAMP Certified

Halo

Halo (HaloITSM)

IT service management and ticketing

Package ID: FR2621445678
Offering: Halo
Class: Class C (Moderate)

Self-hosted

Splunk Enterprise

Splunk

Security logging and SIEM

Runs inside FedSpire's own authorization boundary, so it is assessed as part of our system rather than through a separate FedRAMP listing.

Self-hosted

Trend Micro Deep Security Manager

Trend Micro Inc.

Workload protection: anti-malware, intrusion prevention and integrity monitoring

Runs inside FedSpire's own authorization boundary, so it is assessed as part of our system rather than through a separate FedRAMP listing.

Package IDs link to each offering on the FedRAMP Marketplace (checked November 2026). A vendor's FedRAMP certification covers its own offering; it is not a FedRAMP authorization of FedSpire. Product names and logos belong to their respective owners.

How we're building it

We are designing the platform around the security areas FedRAMP 20x measures through its Key Security Indicators, so that controls are in place before an assessor asks for them.

Cloud-native architecture

Infrastructure as code, immutable deployments and segmented networks from day one.

Service configuration

Hardened baseline configurations, checked automatically for drift.

Identity & access management

Phishing-resistant MFA and least-privilege access for everyone on the team.

Monitoring, logging & auditing

Centralized, tamper-evident logs, which are also the raw material for our evidence.

Change management

Peer-reviewed changes with automated testing gates before anything reaches production.

Policy & inventory

A maintained asset inventory and a policy set we review as the platform grows.

Vulnerability detection & response

Continuous scanning, with remediation timelines set by severity.

Third-party resources

Security reviews of every vendor we rely on before we rely on them.

Incident reporting

A documented response plan with federal notification timelines built in.

Recovery planning

Backups and disaster-recovery procedures that we test, not just write down.

Documentation

Security documentation will be published here as our programs progress.

Reports that require an NDA, such as assessment results, will be available on request once they exist.

Frequently asked questions

Is FedSpire FedRAMP authorized? +

Not yet. FedSpire is in development, and FedRAMP 20x Class C authorization is on our roadmap. We will update this page as we reach each milestone, and we will never list an authorization here before we hold it.

What is FedRAMP 20x? +

FedRAMP 20x is the modernized FedRAMP program. It replaces the Low, Moderate and High baselines with Classes A to D and puts more weight on automated, machine-readable validation of security, which is the kind of evidence FedSpire is built to produce.

Can I review your security documentation? +

Not yet: formal documentation such as a System Security Plan or assessment reports will exist once our assessments are underway. Join the list on our homepage and we will let you know when documents become available.

How do I reach the FedSpire team? +

Leave your work email on our homepage and we will get back to you.

Get early access

FedSpire is in development. Join the list to hear when we launch.

Notify Me