FedRAMP 20x with GitHub
GitHub org rulesets, required reviews, CODEOWNERS, and code scanning are common automated methods for change and software-supply indicators. They prove what the org settings were at collection time — not that every runtime host matches.
Educational resource only. scm.cc is not a FedRAMP Recognized Independent Assessor (3PAO) and is not FedRAMP-authorized; it grants no authorization, certification, or assessment outcome. FedRAMP.gov is the authoritative source. This is not legal advice.
Technical detail
The product QA engine already treats some GitHub checks as methods on CMT indicators. Do not stack extra ruleset types onto an indicator that already has its two methods. Duplicate exports of the same ruleset are not independence.
How to implement
Scope the org/enterprise to the authorization boundary. Record the collector identity in the SDR. Practice grading GitHub-shaped facts on the synthetic offering in the KSI evidence course.
Common mistakes
- Personal-fork settings offered as the production org evidence. - A branch-protection screenshot with no org id or retrieved date.
Related
Primary sources
- FedRAMP 20x overview & Core Principles (retrieved 2026-09-27)
- FedRAMP 20x Key Security Indicators (CR26) (retrieved 2026-09-27)
- Security Decision Record (retrieved 2026-09-27)
- FedRAMP Certification reference (retrieved 2026-09-27)
Last verified 2026-09-27. FedRAMP.gov is authoritative.
Explore the knowledge hub
Learn
- What is 20x?
- Fundamentals
- 20x vs Rev5
- Classes A–D
- Class A
- Class B
- Class C
- Class D
- KSIs
- SDR
- Evidence
- Continuous Monitoring
- Vulnerability Mgmt
- Identity & Access
- Logging
- Config Management
- Encryption
- Incident Response
- Compliance as Code
- OSCAL
- Glossary
- Controls
- AC-17
- AC-2
- AC-6
- AU-12
- AU-2
- AU-6
- CA-7
- CM-2
- CM-6
- CP-9
- IA-2
- IA-4
- IA-5
- IR-4
- IR-8
- RA-3
- RA-5
- SC-13
- SC-7
- SI-2
- SI-4