{ "metadata": { "accountableOfficial": { "name": "Scott", "title": "Chief Executive Officer", "contact": "scott@lytix.xyz" }, "version": "4c2b24aad8ac", "lastUpdated": "2026-09-22T00:00:00Z", "updateSource": "tools/assemble_package.py (generated from docs/cert-package/ inputs and the policy corpus)" }, "serviceIdentification": { "fedRampPackageId": "PENDING-FEDRAMP-ID", "providerName": "Lytix LLC", "serviceName": "FedCredIQ", "serviceAcronym": "FedCredIQ", "serviceDescription": "FedCredIQ is a credit program modeling platform for federal agencies that administer direct loan and loan guarantee programs. Agencies model program cash flows at the loan (disbursement) level and at the cohort level: amortization schedules, prepayments, delinquencies, deferrals, defaults and recoveries, fees, and other cash flow events are projected with configurable, expression-driven transformers and event processors, supporting baseline projections, scenario analysis, and reestimates. Results are exportable for budget formulation and program analysis workflows. The service is delivered as a single-tenant-per-agency-partition SaaS application operated entirely within AWS GovCloud (US); agency data is segregated by tenancy controls at the application and storage layers and handled as Controlled Unclassified Information (CUI) at the Moderate security category.", "certificationType": "20x", "website": "https://fedcrediq.com", "logo": "https://fedcrediq.com/assets/logo.png" }, "serviceProperties": { "serviceType": [ "SaaS" ], "deploymentModel": "Government-Only Cloud", "businessCategory": [ "Finance", "Analytics" ], "trustCenter": { "repositoryType": [ "Trust Center", "Certification Package", "Assessment Reports", "Ongoing Certification Reports" ], "url": "https://trust.fedcrediq.com", "repositoryDescription": "FedRAMP-compatible trust center (CDS-CSO-UTC) holding every version of the FedCredIQ certification package: Certification Package Overview, Security Decision Record, Ongoing Certification Reports and the policy register, each as JSON and Markdown, plus announcements to all necessary parties and a documented JSON API (https://trust.fedcrediq.com/api). The public overview, secure configuration guide and vulnerability disclosure policy are available without sign-in.", "authenticationRequired": true, "accessRequestInstructions": "No request is needed for federal users: sign in at https://trust.fedcrediq.com with a .gov or .mil email address and the one-time code sent to it; access is provisioned on first sign-in. Assessors and other parties: email security@lytix.xyz for an invitation, then sign in the same way. API keys are issued from your account page after sign-in." }, "nextOngoingCertificationReportDate": "2027-02-15", "secureConfigurationGuidance": { "repositoryType": [ "Secure Configuration Guide" ], "url": "https://fedcrediq.com/secure-configuration-guide.html", "repositoryDescription": "The FedCredIQ Secure Configuration Guide (SCG-CSO-RSC): account tiers and naming, top-level administrative account lifecycle (access, operate, decommission), Admin-only settings with security implications, and the fixed secure-default posture. Machine-readable settings inventory alongside at /secure-configuration-guide.json (SCG-ENH-MRG). Public page goes live with the first production deployment; the authoritative version-controlled source is infrastructure/docs/secure-configuration-guide.md.", "authenticationRequired": false, "accessRequestInstructions": "None required \u2014 the guide is public." }, "additionalRepositories": [ { "repositoryType": [ "Policies", "Procedures", "Security Decision Record", "Certification Package" ], "url": "https://github.com/Lytix-LLC/FedCredIQ", "repositoryDescription": "Version-controlled source repository holding the infrastructure-as-code the package describes, the policy and procedure corpus (infrastructure/docs/policies/), the Security Decision Record narratives and the package assembler. The assembled certification package itself is published to the trust center; repository access is for assessors who want to read the source.", "authenticationRequired": true, "accessRequestInstructions": "Email security@lytix.xyz from an assessor or .gov/.mil address stating the requesting organization and purpose; access is granted as read-only repository membership." } ] }, "contactInformation": [ { "contactType": "Security", "contactName": "Lytix Security (both partners; FedRAMP Security Inbox)", "contactEmail": "security@lytix.xyz" }, { "contactType": "Sales", "contactName": "Scott, Chief Executive Officer", "contactEmail": "scott@lytix.xyz" }, { "contactType": "Primary", "contactName": "Steve Patterson, Chief Technology Officer", "contactEmail": "steve@lytix.xyz" } ], "assessorEngagement": { "name": "Prescient Security", "assessorID": "PENDING-ASSESSOR-ID" }, "certifiedServices": [ { "serviceName": "FedCredIQ Web Application", "serviceDescription": "The agency-facing application (browser UI and its API): credit program administration, model and assumption configuration, input data management, execution management, and reporting/export. Security category: Moderate (CUI)." }, { "serviceName": "FedCredIQ Model Execution Service", "serviceDescription": "The isolated compute tier that executes loan-level and cohort-level model runs on behalf of the web application. Not independently addressable by customers; invoked only by the application. Security category: Moderate (CUI)." } ], "thirdPartyInformationResources": { "certified": [ { "fedRampCertifiedThirdPartyInformationResource": "F1603047866", "useCase": "AWS GovCloud (US) provides all infrastructure hosting the offering: compute (ECS Fargate, Lambda), storage (RDS MySQL, S3), networking, KMS cryptography, identity (Cognito), and the monitoring/compliance services. All federal customer data is handled exclusively within AWS GovCloud. NOTE: verify this FedRAMP ID against the current Marketplace listing before submission (pre-submission checklist)." } ], "nonCertified": [ { "name": "GitHub", "provider": "GitHub, Inc.", "website": "https://github.com", "useCase": "Source control, CI, and deployment workflow triggering for the offering's code and infrastructure definitions. No federal customer data leaves the AWS boundary; GitHub holds code and configuration only. Mitigations and compensating controls are documented in the scope-and-flows section and docs/policies/supply-chain.md." }, { "name": "Organizational email (lytix.xyz)", "provider": "Lytix mail provider", "website": "https://lytix.xyz", "useCase": "Organizational communication including the FedRAMP Security Inbox (security@lytix.xyz) and alert delivery. Carries notifications and correspondence, never federal customer data. Provider compromise is treated as an incident per docs/policies/supply-chain.md." } ] }, "policyRegister": [ { "name": "Access Management Policy", "file": "infrastructure/docs/policies/access-management.md", "summary": "Access surface inventory, quarterly access reviews, and the privileged-account suspension runbook (either partner may unilaterally disable the other on suspicion; restoration is a two-person decision).", "wordCount": 1994, "version": "ba96ad57", "lastUpdated": "2026-10-28", "relatedFedRampPractices": [ "KSI-IAM-ELP", "KSI-IAM-SUS" ] }, { "name": "Change Management Procedure", "file": "infrastructure/docs/policies/change-management.md", "summary": "Branch-agnostic change invariants (PR-only, CI gate, CODEOWNERS, gated deploy, daily drift detection), significant-change evaluation and notification per the SCN rules, and the emergency/expedited path.", "wordCount": 1327, "version": "edec807a", "lastUpdated": "2026-09-23", "relatedFedRampPractices": [ "KSI-CMT-RVP", "SCN-CSO-EVA", "SCN-CSO-MAR", "SCN-CSO-INF", "SCN-CSO-NOM" ] }, { "name": "Data Removal Procedure", "file": "infrastructure/docs/policies/data-removal.md", "summary": "Agency data deletion workflow (dry-run manifest, fail-loud ordered execution, completion report as evidence), the 35-day backup expiry horizon, spill-purge path, and restore-triggers-re-deletion rule.", "wordCount": 844, "version": "a28e71a6", "lastUpdated": "2026-09-22", "relatedFedRampPractices": [ "KSI-SVC-RUD" ] }, { "name": "Incident Response Plan", "file": "infrastructure/docs/policies/incident-response.md", "summary": "PAIN-native severity, FedRAMP reportability evaluation, the Class C IIR/OIR/FIR reporting clocks transcribed verbatim, after-action reports for every declared incident, and the annual tabletop with timed practice-IIR drill.", "wordCount": 1469, "version": "454b7cb5", "lastUpdated": "2026-10-27", "relatedFedRampPractices": [ "KSI-INR-AAR", "KSI-INR-RIR", "KSI-INR-RPI", "IEC-CSO-IIR", "IEC-CSO-OIR", "IEC-CSO-FIR", "IEC-CSO-EFR", "IEC-CSO-EFI", "IEC-CSO-DPR" ] }, { "name": "Log Source Inventory", "file": "infrastructure/docs/policies/log-sources.md", "summary": "Inventory of all log sources derived from the infrastructure code, with retention, encryption, and access notes per source.", "wordCount": 1503, "version": "ec4ef9a8", "lastUpdated": "2026-10-28", "relatedFedRampPractices": [ "KSI-MLA-LET" ] }, { "name": "Recovery Objectives", "file": "infrastructure/docs/policies/recovery-objectives.md", "summary": "RTO 24h / RPO 1h, the region-loss posture (data survives via cross-region copies; service restoration best-effort), and the quarterly capability review plus annual CEO ratification with a PITR-validating DR exercise.", "wordCount": 698, "version": "d123bf78", "lastUpdated": "2026-09-21", "relatedFedRampPractices": [ "KSI-RPL-RRO", "KSI-CNA-OFA" ] }, { "name": "Recovery Plan", "file": "infrastructure/docs/policies/recovery-plan.md", "summary": "Six scenario playbooks covering instance, data, and region loss, including the full-environment-loss data path and the restore-triggers-re-deletion warning for removed agency data.", "wordCount": 758, "version": "065892e6", "lastUpdated": "2026-09-21", "relatedFedRampPractices": [ "KSI-RPL-ARP", "KSI-RPL-ABO" ] }, { "name": "Secure Development Practice", "file": "infrastructure/docs/policies/secure-development.md", "summary": "The SDLC as practiced (PR gates, dependency and policy scanning, test suite, immutable delivery) mapped to CISA Secure by Design principles.", "wordCount": 530, "version": "90ca3b48", "lastUpdated": "2026-09-22", "relatedFedRampPractices": [ "KSI-PIY-RSD" ] }, { "name": "Security Program", "file": "infrastructure/docs/policies/security-program.md", "summary": "Program goals (obtain/maintain Class C; protect federal data confidentiality and integrity as the protection priority), executive support demonstrated via CEO-signed quarterly reviews, and investment categories with an annual effectiveness review.", "wordCount": 833, "version": "924f502f", "lastUpdated": "2026-09-23", "relatedFedRampPractices": [ "KSI-PIY-RES", "KSI-PIY-RIS" ] }, { "name": "Security Training Program", "file": "infrastructure/docs/policies/security-training.md", "summary": "Identical full curriculum for both partners from curated reputable materials, annual cycle with completion log (AT-4 record), IR tabletop and DR exercise as the IR/DR component, and a mid-year targeted-refresh trigger.", "wordCount": 558, "version": "59d557db", "lastUpdated": "2026-09-22", "relatedFedRampPractices": [ "KSI-CED-RAT" ] }, { "name": "Supply Chain Review", "file": "infrastructure/docs/policies/supply-chain.md", "summary": "Third-party boundary (AWS + GitHub + email, no data-touching third parties), base-image inventory, the new-supplier intake rule, and the quarterly exposure review.", "wordCount": 1065, "version": "30a40653", "lastUpdated": "2026-09-23", "relatedFedRampPractices": [ "KSI-SCR-MIT", "MAS-CSO-TPR" ] }, { "name": "Vulnerability Disclosure Program & Vulnerability Response", "file": "infrastructure/docs/policies/vulnerability-disclosure.md", "summary": "Public disclosure program (scope, safe harbor, intake), the register for all detection sources, and the Class C clocks: 5-day evaluation, VDR-TFR-PVR remediation table, KEV due dates, incident-escalation threshold, and the 192-day acceptance boundary.", "wordCount": 856, "version": "53bc7134", "lastUpdated": "2026-09-22", "relatedFedRampPractices": [ "KSI-PIY-RVD", "VDR-TFR-PVR", "VER-TFR-EVU", "VER-TFR-MAV", "VER-TFR-IRI", "VDR-TFR-KEV" ] } ] }