Step 1 · Welcome

SPARKAE · a browser reference for the Examine method

§01 Initial Assessment runs the real deterministic engine in this browser — FedRAMP Low, Moderate, or High against a sample SSP or a package you drop in. Nothing is uploaded. INTERVIEW and TEST stay with the assessor. The other eight tabs are guided walkthroughs of the rest of a FedRAMP lifecycle; they are labelled as such and do not run the engine.

The control catalog is NIST SP 800-53 Rev5; the tailoring and baselines are FedRAMP Rev5. §01 exports OSCAL 1.1.2 assessment-results and CSVs computed from that run. They are automated EXAMINE preparation, not a Security Assessment Report and not a substitute for a recognized assessment service.

Use cases

QA rules

OSCAL constraints

211

fedramp.gov refs

Step 2 · Connect your evidence sources

Walkthrough: how evidence sources map

Tab §09 Data Sources is a guided walkthrough, not a live connector. It illustrates the mapping from evidence sources and GRC platforms into an OSCAL-aligned record. None of those connectors run in this browser build, and PDF/OCR, webhooks and two-way GRC sync are server-product features rather than part of this page.

Tier 1 · Doc reposDrive · GitHub · Confluence · Box → SSP · IaC · policies · ATO letters

Tier 1 · WorkflowJira → POA&M · CM-3 changes · IR-4 incidents

Tier 1 · EvidenceTenable · Okta · AWS Config · Splunk → KSI evidence + ConMon

Tier 2 · GRC peersServiceNow GRC · Drata · Vanta · ZenGRC · OneTrust · Hyperproof · AuditBoard · Archer

Tier 3 · CustomJSON · CSV · PDF/OCR · webhook for unstructured / non-conforming tools

Tier 3 uses namespaced extensions (per fedramp.gov OSCAL prop pattern) so vendor-specific data round-trips losslessly without breaking canonical guarantees. Each connector card carries a ▸ View schema mapping link, which opens that connector's full mapping in a new window.

Step 3 · Run an assessment

Pick a use case · pick an SSP · run the demo

The platform is organized around the FedRAMP authorization lifecycle. Tabs are grouped by phase, each citing the relevant fedramp.gov reference.

AuthorizationInitial · Annual · SCR

OperationsConMon · KSI Validation

QualityQA Audit · Package Validator · Portfolio

FoundationData Sources

Try §01 Initial Assessment with the CloudVault sample first. That tab runs the seven gates and writes the exports this build actually ships: OSCAL assessment-results, findings / RET / POA&M / TCW CSV, a summary, and a reproducibility receipt.

Step 4 · Generate AO briefing

Walkthrough: a printable briefing from §08

§08 Portfolio is a guided walkthrough. Its one-pager is an illustrative AO briefing generated from the walkthrough’s reference portfolio, not from a §01 live-engine run, and it is not an official Security Assessment Report.

✓ Walkthrough one-pager structured like a SAR outline (§5 · Appendix A · §1-§4)

✓ Illustrative composite posture per system (SAR Sat · ConMon SLA · KSI Auto · Defensibility; SparkAE-authored weighting)

✓ Review-readiness notes by system tier (sample wording · not an authorization recommendation)

✓ References block citing fedramp.gov authoritative sources

✓ Print-optimized for letter size · save as PDF from print dialog

Live Demo · Deterministic Engine · runs in your browser

Run the engine on a package. See every determination.

Pick a sample SSP, or upload your own package. §01 runs the real deterministic engine in your browser — it indexes what you give it, walks every determination statement in the baseline through seven gates, and reports verdicts it computed, each citing the document it came from. Nothing is uploaded anywhere. The other eight sections are guided walkthroughs of the rest of the FedRAMP lifecycle, and are labelled as such.

Public preview This build runs the engine, not a recording. It reads the documents you give it and computes every determination in the baseline. Those determinations are automated EXAMINE preparation an assessor checks, not an authorization decision, and their accuracy rests on a small published case set rather than on real authorization packages — what the engine gets wrong is published beside what it gets right: the accuracy benchmark →. This describes the public build in this repository, not the commercial server product.

Authorization per fedramp.gov · Authorization Process

Operations per fedramp.gov · ConMon Playbook (Rev5)

Quality per fedramp.gov · SAR Quality Review

Foundation per fedramp.gov/documents-templates

Sample portfolio

Choose an SSP

Profile

Assessed as of

EngineDeterministic

VerifierAdversarial · ON

ModeEXAMINE · automated

OutputOSCAL AR · CSV · receipt

◆ READY · Awaiting input Elapsed 00:00

▸

Engine is idle

Select an SSP from the rail and press Run assessment. The deterministic engine ingests, retrieves, adjudicates, verifies, and exports.

Control	Verdict · Risk · Status	Method	Finding · Evidence · Recommendation

◆ Exports from this run Built in your browser from the §01 live-engine run · deterministic: the same run yields byte-identical files · automated EXAMINE preparation, not submission deliverables · INTERVIEW and TEST not performed

OSCAL AR Assessment Results · OSCAL 1.1.2

Findings Per-objective determinations

RET · POA&M Risk Exposure Table · Plan of Action

TCW Test Case Workbook · EXAMINE rows

Summary · Receipt Executive summary · reproducibility receipt

§01 Initial Assessment runs the real deterministic engine in your browser: its verdicts, gate tallies, defensibility scores and reproducibility receipt are computed from the document set you select or upload, every finding cites the file it came from, and its console reports only what was computed — files parsed or refused, objectives adjudicated, gate tallies. It is automated EXAMINE preparation; INTERVIEW and TEST are not performed. The other eight sections are guided walkthroughs built on an internal reference portfolio — they illustrate the workflow, and their figures are illustrative rather than computed. Nothing here is a FedRAMP PMO endorsement, and no output substitutes for a formal 3PAO assessment.