The Examine pass of a Rev5 engagement, prepared by a deterministic 7-gate engine: every “Determine if” objective traced to the evidence passage the engine used, every ODP checked for a stated value, draft findings written with citations. Interview, Test, overrides, and the signature stay with you. Nothing leaves your network.
Public preview This build runs the engine, not a recording. It reads the documents you give it and computes every determination in the baseline. Those determinations are automated EXAMINE preparation an assessor checks, not an authorization decision, and their accuracy rests on a small published case set rather than on real authorization packages — what the engine gets wrong is published beside what it gets right: the accuracy benchmark →. This describes the public build in this repository, not the commercial server product.
Deterministic gates, no model drift. Two assessors on the same SSP get the same Examine draft, and a rerun on version 14 of the package is a diff, not a fresh read.
The passage, the failed gate, the confidence, the defensibility grade, and the correction — on every objective, in the SAR shape the PMO expects and in OSCAL.
Every determination is a draft until you adopt, override, or reject it. Your conclusion is recorded as yours, attributed separately from the provider’s claim, with the evidence and reasoning attached.
You keep scope, testing, conclusions, overrides, and the final deliverables. SparkAE holds the workspace, the evidence lineage, and the attribution. It is not a FedRAMP Recognized independent assessment service, it does not replace one, and it never marks work as done on your behalf.
SSP, policies, POA&M, scan exports. Or your team uploads on their behalf.
All selected controls assessed against evidence. Deterministic mode — no data leaves your environment.
Pre-drafted Satisfied / Other Than Satisfied verdicts with evidence citations, defensibility grades (A–F), and confidence scores. Assessor validates, overrides where needed, adds judgment.
OTS findings tell you where to probe first. A Satisfied here is a lexical result an assessor still checks — 81 of the bundled sample’s 153 Satisfied carry a review flag — so it narrows the order of work, not the scope of it.
SAR (JSON + DOCX), SAP, RET CSV, POA&M, CRM, CIS, OSCAL assessment-results — 14+ formats in the server product (the public reference build ships six). Drop them into your workflow; the recognized assessment service finalizes and submits.
missing_implementation, incomplete_policy, missing_evidence, contradictory_evidence, temporal_gap, other_gap.The opposite. SparkAE is a third-party tool — not built by the CSP, not built by you. Using an independent validation engine is more defensible than homegrown tooling. When the PMO questions a finding, "the Examine method was run by an independent engine, and here is the evidence trace" is a stronger answer than "our assessor read it." SparkAE is not the assessor of record.
The commercial server product’s default self-contained mode (LLM_PROVIDER=none) makes zero external calls — zero outbound HTTP, zero DNS lookups, zero CDN, typically in a Docker container with a read-only filesystem, cap_drop ALL, non-root. That install is not this public repository. The browser demo on this site also makes no outbound calls: it runs in your tab and uploads nothing. Whether a given deployment is suitable for CUI depends on how you deploy and accredit it — the software supports the boundary, it does not confer the authorization.
It doesn't try to. SparkAE automates the EXAMINE method only — document review against DIFs. INTERVIEW and TEST still require your assessors. Professional judgment still drives the final SAR. The tool removes reading. Not thinking.
Expect it to, and by a wide margin. SparkAE runs EXAMINE against the documents you hand it, and nothing else. Your SAR also carries INTERVIEW and TEST evidence and the judgment your assessors applied, so every objective your team satisfied by interviewing an engineer or observing a control in operation comes back Other Than Satisfied here — the document set on its own does not carry that proof. The bundled sample returns 808 of its 981 objectives (82%) Other Than Satisfied, and it is a sample written to pass much of the baseline. A gap in this output is a statement about what the package proves on its face, not a verdict on your assessment. That is precisely what makes it useful before submission, while an unsupported statement is still cheap to fix.
You could. Then you maintain the catalog, the parameter rules, the OSCAL schema and the tests every time NIST or FedRAMP changes them. We do that work in the open: the engine, catalog and test suite are published.
SparkAE produces deterministic, reproducible findings. Same SSP + same rules = same output every time. The engine is auditable. The rules are transparent. The PMO wants consistency — that's exactly what a deterministic engine delivers.
Then you both start from the same evidence trace and the same rule version, and you can see what the provider found and fixed before you arrive. Your conclusions are still yours, recorded separately from theirs.
FedRAMP is moving authorization packages toward machine-readable form. RFC-0024, which first proposed the mandate, was closed — its requirements were modified and folded into the 2026 Consolidated Rules rather than adopted as drafted, so the specifics are still settling. What does not change is the direction: a Word/Excel-only workflow does not produce structured authorization data, and retrofitting it later is the expensive path. Under the 2026 Consolidated Rules, Rev5 Class D (High) providers supply comprehensive machine-readable authorization data in FedRAMP’s own format (JSON documents valid against FedRAMP’s schemas), with OSCAL as one accepted option, and the other classes move to structured text. The browser demo exports OSCAL 1.1.2 assessment-results today; OSCAL POA&M is a server-edition export.
FedRAMP 20x support is not part of this product and is not sold. What ships today is the Rev5 Examine engine. The firms that adopt it own the assessment.
SparkAE prepares the Examine pass. The recognized assessment service still signs.
Availability. The server product is not generally released yet. A fit call covers what is available today. The browser demo on this site is available to everyone now.
Request a fit callThe browser demo is the public proof. If you want to discuss whether the engine fits an assessment-firm workflow, request a fit call or email. Nothing on this page starts a paid Day-0 pilot.
SparkAE is independence-preserving assessment infrastructure. It is not a FedRAMP Recognized independent assessment service (historically, a 3PAO), it does not replace one, and it does not issue the official Security Assessment Report or an Authorization to Operate. It prepares the Examine pass your assessors own and sign. FedRAMP 20x support is not part of this product and is not sold.