Vol III Book 07 — Federal Compliance — Multi-Cloud Evidence Fabric: One Compliance Picture from Many Stacks
The Unified Evidence Contract — Telemetry → CDM → FedRAMP 20x KSIs Across Every CSP, NEM, and OS
0.1 Draft Proposal — Subject to Review
This document is a draft proposal developed by the CSI Team (Cloud Services Infrastructure). It is an attempt at a comprehensive Agency-wide technical roadmap and has not been reviewed or approved by the Agency CIO Office, the Office of Information Security (OIS), or organizational leadership. All recommendations, vendor selections, control mappings, and implementation timelines are subject to revision pending formal review by the Agency CIO Office and organizational components.
Date Code: 2026-07-09 08:41 ET
Provisional position. This book was drafted at temporary series slot 23; its intended home is Volume III (Security Operations), after the SIEM/XDR book. Cross-references name other books by title and role, not number, so the series-wide renumber does not break them.
Series Context — The Management-Plane Coordination Doctrine (Executive Summary) splits the management plane in two: actuation is platform-native; governance is unified. This book is the unified-governance half made real — the evidence fabric where every native stack (Microsoft, AWS, Oracle, VMware, Red Hat), every network appliance (Cisco / Palo Alto / Juniper), and every OS agent emits the same machine-readable record into one lake, correlated on one authoritative asset identity, and delivered up to CISA CDM and the FedRAMP 20x KSI pipeline. It is a truth-plane function (plane 6): the fabric is depended on, not re-platformed.
1 What This Document Addresses
A multi-cloud federal agency runs five or more management stacks, and each one produces its own telemetry in its own schema: Azure Update Manager reports patch state one way, AWS Systems Manager another, vSphere Lifecycle Manager a third, a Palo Alto firewall a fourth, a Red Hat host a fifth. Five stacks, five inventories, five log formats. An assessor who asks “is CVE-X remediated across the whole estate, and prove it” cannot be answered by five partial views that do not reconcile.
The evidence fabric is the answer: a single, normalized evidence contract that every source emits into one lake, correlated on one authoritative asset identity, and delivered to the two consumers a federal agency owes — CISA CDM (enterprise asset/vulnerability/configuration visibility) and the FedRAMP 20x KSI evidence pipeline. This book defines that contract, names its FedRAMP-Moderate realizations, and closes the AU/CA/SI controls of the telemetry slot — two of which (AU-3 and AU-12(1)) only a cross-surface fabric can close.
1.1 What this book is not — the boundary with the SIEM/XDR and ConMon books
This is not the detection-engineering book. The SIEM / XDR Detection book owns analytics and response — KQL/correlation rules, UEBA, playbooks — the logic that finds a threat in the data. This book owns the layer beneath that: getting every source’s data into one normalized, correlated contract in the first place. And it is not the authorization book: the Authorization Package & ConMon book assembles the OSCAL AP/AR/POA&M bundle from the fabric’s output. The fabric is upstream of both — detection analyzes it, the OSCAL bundle attests it.
2 The Evidence Contract — the Coordination Mechanism (AU-3)
Coordination across heterogeneous stacks is not a console; it is a contract. Every source — a CSP patch stack, a NEM appliance, an OS agent — must emit a record with the same fields, regardless of what produced it:
| Field | Meaning |
|---|---|
asset_id |
Authoritative name/address from the naming plane (IPAM/DDI) — the join key |
source |
Which stack/appliance/agent produced the record |
surface |
CSP / NEM / OS |
control |
The NIST control the record is evidence for (e.g., SI-2, SC-8, CM-6) |
state |
The measured value (patch level, baseline conformance, cipher, posture) |
verdict |
pass / warn / fail against the intended state |
observed_at |
Timestamp (for time-correlation) |
disposition |
Applied / accepted-risk (POA&M ref) / open |
This is AU-3 (Content of Audit Records) raised to a cross-surface contract: the record’s content is standardized so records from any source are comparable, joinable, and rollup-able. It is a Closure Necessity — without a common contract, the five stacks cannot produce one compliance picture, and no amount of dashboarding after the fact recovers a schema the sources never agreed on.
4 Realizations — Aggregation, Coordination, and Delivery
The fabric is a contract, so more than one product can realize each role. Under the agency’s Microsoft-preference rule (a Microsoft product is the default when it genuinely coordinates the multi-vendor surface at FedRAMP Moderate — earned, not automatic), the realizations are:
| Role | Default (earns it) | Moderate alternative | Notes |
|---|---|---|---|
| Aggregation / analytics lake | Microsoft Sentinel — ingests AWS (Security Hub / GuardDuty / CloudTrail), OCI, GCP, and NEM syslog/CEF; FedRAMP-authorized | Splunk Cloud Platform (FedRAMP Moderate) | Both owned — dual-SIEM redundancy, not a default/alternative choice. Sentinel is the primary cross-vendor ingestion lake by breadth of native connectors; Splunk runs the same evidence contract in parallel, providing audit-log continuity if either platform’s ingestion path fails |
| Workflow / correlation hub / CMDB | ServiceNow (FedRAMP-authorized) | BMC Helix | CMDB reconciles to IPAM/DDI — it does not replace the naming-plane join key |
| Federal rollup | CISA CDM agency dashboard → federal dashboard | — | The federal coordination substrate; the fabric feeds it |
| Attestation | FedRAMP 20x KSI evidence pipeline + OSCAL bundle | — | Consumed by the Authorization Package & ConMon book |
The doctrine guardrail holds throughout: the fabric mandates the contract, never the vendor. Any lake that ingests the multi-surface record set, any hub that correlates on the authoritative asset_id, and any pipeline that emits the KSI/OSCAL evidence is admissible.
5 The Continuous-Monitoring Pipeline (CA-7)
The fabric is the ConMon evidence pipeline: sources emit on their own cadence → records normalize to the contract → correlate on asset identity + time → aggregate in the lake → roll up to CDM → attest as KSI/OSCAL. CA-7 continuous monitoring is closed here as the flow; the SIEM/XDR book adds detection analytics over the lake, and the Authorization Package book freezes a point-in- time OSCAL bundle from it. OMB M-26-14 (agency logging and network visibility, which rescinded M-21-31 on 22 May 2026 and replaced its EL0–EL3 tiers with a five-level maturity model scored to the lowest watermark) and NIST SP 800-137 (ISCM) are the driving authorities; AU-6(1) (automated process integration) and SI-4(16) (correlate monitoring information) are closed by the automated aggregation and cross-surface correlation the fabric performs.
7 FedRAMP 20x KSI Alignment
The fabric is the primary KSI-MLA (Monitoring, Logging, and Auditing) evidence source for the whole series: every book that emits a compliance record — identity, patch, network enforcement, posture, data — delivers it through this fabric, where it is normalized, correlated, and rolled up. The fabric does not compete with the SIEM/XDR book for KSI-MLA; it is the substrate that book’s analytics run on. Because the evidence is the aggregated, correlated record set (not a single-tenant configuration snapshot), none of these controls is attestable by a conformance tool alone — the Tool-attestable? column is uniformly No, and the coordination doctrine’s contract is what makes them evaluable.
7.1 Realization Selection Status
The agency owns both SIEM platforms: Sentinel and Splunk Cloud Platform run as dual-SIEM redundancy, not a default/alternative choice pending procurement. Sentinel is the primary aggregation lake on the Microsoft-preference rule (earned by genuine multi-cloud/NEM ingestion at FedRAMP Moderate); Splunk runs the same evidence contract in parallel. ServiceNow (FedRAMP-authorized, also owned) is the workflow/CMDB coordination hub, with its CMDB reconciled to the authoritative IPAM/DDI identity. Verify all authorizations on the FedRAMP Marketplace at procurement.
8 References
| Reference | Description |
|---|---|
| NIST SP 800-53 Rev 5 | AU-3, AU-6(1), AU-12, AU-12(1), CA-7, SI-4(16) |
| NIST SP 800-137 | Information Security Continuous Monitoring (ISCM) |
| OMB M-26-14 | Ensuring Effective and Efficient Agency Logging and Network Visibility (22 May 2026; rescinds M-21-31, Improving the Federal Government’s Investigative and Remediation Capabilities) (event-logging maturity) — https://www.whitehouse.gov/wp-content/uploads/2021/08/M-21-31-Improving-the-Federal-Governments-Investigative-and-Remediation-Capabilities-Related-to-Cybersecurity-Incidents.pdf |
| CISA CDM Program | Continuous Diagnostics & Mitigation — https://www.cisa.gov/cdm |
| CISA BOD 23-01 | Asset visibility & vulnerability enumeration — https://www.cisa.gov/news-events/directives/bod-23-01-improving-asset-visibility-and-vulnerability-detection-federal-networks |
| Microsoft Sentinel (multi-cloud data connectors) | https://learn.microsoft.com/azure/sentinel/connect-data-sources |
| Splunk Cloud Platform (FedRAMP Moderate) | https://www.fedramp.gov/marketplace/products/F1607197917/ |
| ServiceNow (FedRAMP-authorized; ITOM/CMDB/SecOps) | https://www.fedramp.gov/marketplace/products/F1305072116/ |
| NIST OSCAL | Open Security Controls Assessment Language — https://pages.nist.gov/OSCAL/ |