y 6.7 12.4 x

FedRAMP Class C (Moderate), drafted from your repo.

Your AWS infrastructure-as-code already holds most of the evidence. Efterlev reads your Terraform, CloudFormation, and CDK Python — classifies it against the 60 thematic Key Security Indicators — and drafts the FRMR attestations, OSCAL POA&M, and remediation diffs a 3PAO can actually use. Open source. Runs locally. Apache 2.0.

A 100-person SaaS company gets told by its biggest prospect: "we'll buy, but only if you're FedRAMP Class C (Moderate)." Consulting engagements start at $250K. SaaS GRC platforms cover SOC 2 beautifully and treat FedRAMP as a footnote. Efterlev is the tool a single engineer can install on a Tuesday and bring concrete results to Wednesday's standup.

Pronounced "EF-ter-lev." From Swedish efterlevnad (compliance).

How it works

Efterlev reads your AWS infrastructure-as-code in your own terms. FedRAMP 20x — the new outcome-based authorization track — replaces narrative System Security Plans with structured machine-readable data organized around 60 thematic Key Security Indicators (KSIs). KSIs are concrete things ("encrypt network traffic," "enforce phishing-resistant MFA") assessed against actual evidence, not paragraphs of intent. Efterlev classifies each KSI against your code, drafts an FRMR-compatible attestation grounded in file-and-line citations, and emits OSCAL 1.0.4 POA&M and Component-Definition exports your 3PAO can consume directly. Output is aligning toward the Security Decision Record — FedRAMP's emerging machine-readable submission artifact — as that format firms up.

What FedRAMP 20x actually grades. An assessor isn't grading a folder of config screenshots — a Terraform block on its own is just text that can be swapped out. They're confirming your process persistently verifies and validates each KSI: changes traced to approvals, who's allowed to modify what, the integrity of the code that's actually deployed, and that reality matches your IaC. The deterministic detectors are the signal, not the deliverable; the persistent-validation surface is the rest — the provenance chain (claim → file → line → commit), the change-control detectors (branch protection, required reviews, SDLC gates), continuous re-scan on every PR, and runtime-finding ingestion. Honest scope: IaC-vs-deployed-reality drift detection is on the roadmap — Efterlev ingests the runtime side today; the comparison build comes next.

Built for 20x. Not retrofitted from Rev 5. Most compliance tooling was designed for narrative SSPs and quarterly evidence packages, then bolted onto KSI workflows after FedRAMP announced 20x. Efterlev was architected for the KSI target from day one — every detector is a self-contained Python folder; every agent prompt is a plain .md file an assessor can read; the provenance chain walks back from any claim to the exact file, line, and commit. Not a Rev 5 tool wearing a 20x hat.

See it

The Gap Report HTML — all 60 KSIs classified, color-coded by status, grouped by theme

What it does, what it doesn't

Honest by design

Compliance tooling that overclaims gets thrown out by 3PAOs. Efterlev's design treats that as the hard constraint.

• Scanner findings are facts; AI output is DRAFT. Detectors run deterministic Python — same input, same output, no model in the loop. Agent claims are clearly distinguished, carry a requires_review: Literal[True] marker at the type level, and never get a "compliant" badge.
• Every claim walks back to its source. efterlev provenance show <id> traces any generated line to the exact file and line range that produced it. Tamper-evident via efterlev provenance verify.
• Secrets never leave the machine unredacted. Seven secret families (AWS, GCP, GitHub, Slack, Stripe, PEM keys, JWTs) scrubbed unconditionally before any prompt. No opt-out path.
• Open source and supply-chain hardened. Apache 2.0. Every release ships with cosign keyless OIDC signatures, SLSA v1 provenance attestations, PEP 740 PyPI attestations, and SBOMs. Verify any wheel or container with bash scripts/verify-release.sh v0.1.221.
• Sits alongside AWS-native services, not in place of them. Efterlev is the pre-deploy IaC layer; AWS Config / Security Hub / CloudTrail remain the runtime layer. The two compose: ingest the runtime findings into Efterlev's evidence store, then classify both sources uniformly.
• Active maintenance. 222 releases since v0.1.0 (April 2026), v0.1.221 current. Full CI gate on every PR: mypy strict, ruff, real-API end-to-end smoke. Five LLM backends — Anthropic API, AWS Bedrock for FedRAMP-authorized GovCloud, Claude Code Pro/Max subscription ($0 per call), OpenAI (gpt-5.4-mini: 100% recall + ~80–96% precision, single fixture), and OpenAI on Bedrock (v0.1.217 — gpt-5.5 / gpt-5.4 via the bedrock-mantle Responses API in us-east-2 / us-west-2, for Bedrock billing and governance without Anthropic egress).

Why we built this

A first-time FedRAMP Class C (Moderate) authorization typically runs $500K to $700K over 12 to 18 months. Most of that is paperwork an engineering team could produce from their own infrastructure definitions if anyone had built the right tool. Efterlev removes the boilerplate so engineers and 3PAOs can focus on the parts that genuinely require their attention.

Open source because compliance tooling that overclaims gets thrown out by 3PAOs — and the only durable answer to that scrutiny is showing your work.

Articles

Notes on FedRAMP 20x, KSIs, and what it actually takes to ship a federal authorization.

Get involved

Apache 2.0. Detector contributions, issues, and PRs welcome at github.com/efterlev/efterlev. The detector contract is designed so adding a new one is a self-contained folder you can submit without touching the rest of the codebase. If you have run a first-time FedRAMP authorization, the most useful contribution you can make is honest feedback about where the tool fell short.