# FedCredIQ — FedRAMP Certification Package Overview

| | |
|---|---|
| **Responsible & accountable official** (CPO-CSO-MTD) | Scott, Chief Executive Officer — scott@lytix.xyz |
| **Version** | `4c2b24aad8ac` (content hash of package inputs) |
| **Last updated** | 2026-09-22T00:00:00Z |
| **Source of update** | tools/assemble_package.py (generated from docs/cert-package/ inputs and the policy corpus) |

## Service identification

| | |
|---|---|
| Provider | Lytix LLC |
| Service | FedCredIQ (FedCredIQ) |
| FedRAMP ID | `PENDING-FEDRAMP-ID` |
| UEI | *not yet registered — SAM.gov registration is a pre-submission task* |
| Certification type | FedRAMP 20x, Class C |
| Service model | SaaS |
| Deployment model | Government-Only Cloud |
| Business category | Finance, Analytics |
| Website | https://fedcrediq.com |
| Logo | https://fedcrediq.com/assets/logo.png *(goes live with the public product site)* |
| Next Ongoing Certification Report (CCM-OCR-NRD) | 2027-02-15 (planned first report; mid-quarter cycle per CCM-OCR-SOR) |
| Next Quarterly Review (CCM-QTR-NRD) | 2027-02-22 |
| OCR feedback mechanism (CCM-OCR-FBM) | security@lytix.xyz |

## Service description

FedCredIQ is a credit program modeling platform for federal agencies that administer direct loan and loan guarantee programs. Agencies model program cash flows at the loan (disbursement) level and at the cohort level: amortization schedules, prepayments, delinquencies, deferrals, defaults and recoveries, fees, and other cash flow events are projected with configurable, expression-driven transformers and event processors, supporting baseline projections, scenario analysis, and reestimates. Results are exportable for budget formulation and program analysis workflows. The service is delivered as a single-tenant-per-agency-partition SaaS application operated entirely within AWS GovCloud (US); agency data is segregated by tenancy controls at the application and storage layers and handled as Controlled Unclassified Information (CUI) at the Moderate security category.

## Contacts (CDS-CSO-PUB)

| Type | Contact | Email |
|---|---|---|
| Security | Lytix Security (both partners; FedRAMP Security Inbox) | security@lytix.xyz |
| Sales | Scott, Chief Executive Officer | scott@lytix.xyz |
| Primary | Steve Patterson, Chief Technology Officer | steve@lytix.xyz |

## Independent assessment service

**Prescient Security** (assessor ID: `PENDING-ASSESSOR-ID`) is engaged as the
FedRAMP Recognized independent assessment service.

## Certified services (CDS-CSO-SVC)

| Service | Description |
|---|---|
| FedCredIQ Web Application | The agency-facing application (browser UI and its API): credit program administration, model and assumption configuration, input data management, execution management, and reporting/export. Security category: Moderate (CUI). |
| FedCredIQ Model Execution Service | The isolated compute tier that executes loan-level and cohort-level model runs on behalf of the web application. Not independently addressable by customers; invoked only by the application. Security category: Moderate (CUI). |

## Policy and procedure register (CDS-CSO-IRP)

*Generated from `infrastructure/docs/policies/` — word counts, versions
(content hashes), and last-updated dates (latest dated review-log entry)
are computed, never hand-maintained. Machine-readable copy:
`policy-register.json`.*

| Policy | File | Words | Version | Last updated | Related practices |
|---|---|---|---|---|---|
| **Access Management Policy** — Access surface inventory, quarterly access reviews, and the privileged-account suspension runbook (either partner may unilaterally disable the other on suspicion; restoration is a two-person decision). | `infrastructure/docs/policies/access-management.md` | 1994 | `ba96ad57` | 2026-10-28 | KSI-IAM-ELP, KSI-IAM-SUS |
| **Change Management Procedure** — Branch-agnostic change invariants (PR-only, CI gate, CODEOWNERS, gated deploy, daily drift detection), significant-change evaluation and notification per the SCN rules, and the emergency/expedited path. | `infrastructure/docs/policies/change-management.md` | 1327 | `edec807a` | 2026-09-23 | KSI-CMT-RVP, SCN-CSO-EVA, SCN-CSO-MAR, SCN-CSO-INF, SCN-CSO-NOM |
| **Data Removal Procedure** — Agency data deletion workflow (dry-run manifest, fail-loud ordered execution, completion report as evidence), the 35-day backup expiry horizon, spill-purge path, and restore-triggers-re-deletion rule. | `infrastructure/docs/policies/data-removal.md` | 844 | `a28e71a6` | 2026-09-22 | KSI-SVC-RUD |
| **Incident Response Plan** — PAIN-native severity, FedRAMP reportability evaluation, the Class C IIR/OIR/FIR reporting clocks transcribed verbatim, after-action reports for every declared incident, and the annual tabletop with timed practice-IIR drill. | `infrastructure/docs/policies/incident-response.md` | 1469 | `454b7cb5` | 2026-10-27 | KSI-INR-AAR, KSI-INR-RIR, KSI-INR-RPI, IEC-CSO-IIR, IEC-CSO-OIR, IEC-CSO-FIR, IEC-CSO-EFR, IEC-CSO-EFI, IEC-CSO-DPR |
| **Log Source Inventory** — Inventory of all log sources derived from the infrastructure code, with retention, encryption, and access notes per source. | `infrastructure/docs/policies/log-sources.md` | 1503 | `ec4ef9a8` | 2026-10-28 | KSI-MLA-LET |
| **Recovery Objectives** — RTO 24h / RPO 1h, the region-loss posture (data survives via cross-region copies; service restoration best-effort), and the quarterly capability review plus annual CEO ratification with a PITR-validating DR exercise. | `infrastructure/docs/policies/recovery-objectives.md` | 698 | `d123bf78` | 2026-09-21 | KSI-RPL-RRO, KSI-CNA-OFA |
| **Recovery Plan** — Six scenario playbooks covering instance, data, and region loss, including the full-environment-loss data path and the restore-triggers-re-deletion warning for removed agency data. | `infrastructure/docs/policies/recovery-plan.md` | 758 | `065892e6` | 2026-09-21 | KSI-RPL-ARP, KSI-RPL-ABO |
| **Secure Development Practice** — The SDLC as practiced (PR gates, dependency and policy scanning, test suite, immutable delivery) mapped to CISA Secure by Design principles. | `infrastructure/docs/policies/secure-development.md` | 530 | `90ca3b48` | 2026-09-22 | KSI-PIY-RSD |
| **Security Program** — Program goals (obtain/maintain Class C; protect federal data confidentiality and integrity as the protection priority), executive support demonstrated via CEO-signed quarterly reviews, and investment categories with an annual effectiveness review. | `infrastructure/docs/policies/security-program.md` | 833 | `924f502f` | 2026-09-23 | KSI-PIY-RES, KSI-PIY-RIS |
| **Security Training Program** — Identical full curriculum for both partners from curated reputable materials, annual cycle with completion log (AT-4 record), IR tabletop and DR exercise as the IR/DR component, and a mid-year targeted-refresh trigger. | `infrastructure/docs/policies/security-training.md` | 558 | `59d557db` | 2026-09-22 | KSI-CED-RAT |
| **Supply Chain Review** — Third-party boundary (AWS + GitHub + email, no data-touching third parties), base-image inventory, the new-supplier intake rule, and the quarterly exposure review. | `infrastructure/docs/policies/supply-chain.md` | 1065 | `30a40653` | 2026-09-23 | KSI-SCR-MIT, MAS-CSO-TPR |
| **Vulnerability Disclosure Program & Vulnerability Response** — Public disclosure program (scope, safe harbor, intake), the register for all detection sources, and the Class C clocks: 5-day evaluation, VDR-TFR-PVR remediation table, KEV due dates, incident-escalation threshold, and the 192-day acceptance boundary. | `infrastructure/docs/policies/vulnerability-disclosure.md` | 856 | `53bc7134` | 2026-09-22 | KSI-PIY-RVD, VDR-TFR-PVR, VER-TFR-EVU, VER-TFR-MAV, VER-TFR-IRI, VDR-TFR-KEV |

## Secure Configuration Guide (SCG-CSO-AUP)

Available at https://fedcrediq.com/secure-configuration-guide.html (authentication required: False).
The FedCredIQ Secure Configuration Guide (SCG-CSO-RSC): account tiers and naming, top-level administrative account lifecycle (access, operate, decommission), Admin-only settings with security implications, and the fixed secure-default posture. Machine-readable settings inventory alongside at /secure-configuration-guide.json (SCG-ENH-MRG). Public page goes live with the first production deployment; the authoritative version-controlled source is infrastructure/docs/secure-configuration-guide.md.

## Trust center (CDS-CSO-UTC)

https://trust.fedcrediq.com (authentication required: True).
FedRAMP-compatible trust center (CDS-CSO-UTC) holding every version of the FedCredIQ certification package: Certification Package Overview, Security Decision Record, Ongoing Certification Reports and the policy register, each as JSON and Markdown, plus announcements to all necessary parties and a documented JSON API (https://trust.fedcrediq.com/api). The public overview, secure configuration guide and vulnerability disclosure policy are available without sign-in.

**Access:** No request is needed for federal users: sign in at https://trust.fedcrediq.com with a .gov or .mil email address and the one-time code sent to it; access is provisioned on first sign-in. Assessors and other parties: email security@lytix.xyz for an invitation, then sign in the same way. API keys are issued from your account page after sign-in.

## Additional repositories

- **Policies, Procedures, Security Decision Record, Certification Package**: https://github.com/Lytix-LLC/FedCredIQ (authentication required: True) — Version-controlled source repository holding the infrastructure-as-code the package describes, the policy and procedure corpus (infrastructure/docs/policies/), the Security Decision Record narratives and the package assembler. The assembled certification package itself is published to the trust center; repository access is for assessors who want to read the source.

---

# Minimum Assessment Scope: Information Resources, Flows, and Security Categories

*CPO section satisfying MAS-CSO-IIR (identify information resources),
MAS-CSO-FLO (information flows and security categories), MAS-CSO-MDI
(metadata), and MAS-CSO-TPR (third-party information resources). The
authoritative definition of every in-boundary resource is the CDK
application (`infrastructure/src/FedCredIQ.Infrastructure/`); this section
is the narrative over that code.*

## The cloud service offering (MAS-CSO-IIR)

The offering is the complete set of information resources deployed and
operated in **AWS GovCloud (US), us-gov-west-1** (with a recovery footprint
in us-gov-east-1), defined entirely as code in six application/platform
stacks plus a recovery stack:

| Resource set | Stack | What it is |
|---|---|---|
| Network tier | NetworkStack | VPC with public (ALB), application, and isolated data subnets; WAFv2 on the ALB; Network Access Analyzer scopes asserting the tier invariants |
| Encryption | EncryptionStack | Customer-managed KMS keys for every data store and log group |
| Monitoring & compliance | ComplianceStack | CloudTrail, AWS Config + managed rules, GuardDuty, Security Hub (FSBP + NIST 800-53 r5), IAM Access Analyzer, alerting topics, the daily evidence-export Lambda |
| Data stores | DataStack | RDS MySQL (agency program data), S3 files bucket (agency-prefixed keys), audit/evidence bucket, daily AWS Backup plan with cross-region copy, weekly automated restore test |
| Identity | IdentityStack | Cognito user pool — passwordless (passkeys), email OTP only for invite/recovery bootstrap |
| Application compute | ServiceStack | ECS Fargate API/frontend service behind the ALB, ECR repositories (immutable tags, scan-on-push), the one-off migration task, the Lambda model-execution workers in the isolated tier, and the Windows Fargate CSC worker (OMB SubsidyCLI.exe behind SQS) |
| Recovery | RecoveryStack (us-gov-east-1) | DR KMS key, backup vault for cross-region copies, files-replica bucket |
| Delivery system | GitHub repository + CI/CD | Source control, PR gates (build, tests, dependency audits, cdk-nag), OIDC-federated deployment — in scope as the supply chain that produces the offering, holding code only |

Software delivered for installation on agency systems: **none** (browser
access only), so no out-of-scope agent/client software exists.

## Information flows and security categories (MAS-CSO-FLO)

All federal customer data is **Controlled Unclassified Information (CUI)
categorized Moderate** for confidentiality, integrity, and availability.
There is one security category across the offering — no resource handles a
higher or lower category.

1. **Agency user → application**: browser → WAFv2 → ALB (TLS) → API
   container (ECS Fargate, application subnets). Authentication is
   passwordless (WebAuthn passkeys via Cognito); the application authorizes
   from database-stamped role/agency claims.
2. **Application → data stores**: API → RDS MySQL (TLS, IAM
   authentication, DML-only application user) and → S3 files bucket
   (agency-prefixed keys). Both KMS-encrypted at rest.
3. **Application → model execution**: API gzips run context to the
   compute-context bucket (KMS, 7-day expiry) and invokes the Lambda
   workers by SDK/IAM. Workers run in the isolated data tier: no ingress,
   443-only egress, no internet route.
4. **Application → OMB CSC3 (external interconnection)**: subsidy-rate
   and SER calculations require OMB's Credit Subsidy Calculator. The API
   stages the input workbook in the compute-context bucket and enqueues a
   job; the Windows Fargate CSC worker runs OMB's SubsidyCLI.exe, which
   POSTs the workbook over HTTPS (443) to OMB's hosted CSC3 service at
   `csccli.max.gov` and receives the computed results workbook back. The
   workbook contains cohort-level cash flow aggregates for the program
   being modeled; the destination is a U.S. government (OMB MAX) system.
   Authentication is an OMB-issued credential embedded in the
   OMB-distributed binary. This is the only flow in which agency-derived
   data leaves the boundary, and the CSC worker's security group is the
   only place that egress exists.
5. **Backup/recovery flows**: RDS automated backups + daily AWS Backup
   plan with copy to the us-gov-east-1 vault; S3 replication to the
   files-replica bucket. All copies KMS-encrypted with region-local keys.
6. **Evidence/audit flows**: CloudTrail, Config, and the daily
   evidence-export Lambda write to the audit bucket (read access via the
   scoped log-reader role). Evidence contains configuration and compliance
   state, not agency program data.
7. **Egress**: the data tier has no internet route; the application
   tier's security groups permit outbound TCP 443 only, with every AWS
   dependency pinned to a VPC endpoint (FIPS PrivateLink services for
   Bedrock runtime and Cognito, matching the hostnames the FIPS-mode SDKs
   dial). NAT carries exactly three documented residual destinations:
   AWS Lambda via its public `lambda-fips` hostname (worker invokes; no
   GovCloud PrivateLink for it), `api.stlouisfed.org` (FRED macro data, no
   agency data), and `csccli.max.gov` (OMB CSC3, flow 4 above). A daily
   Network Access Analyzer scope asserts no non-443 egress path exists.
8. **Delivery flow (no customer data)**: GitHub → CI gates → ECR image
   push / CDK deploy via OIDC-federated, environment-gated roles; a one-off
   migration task must succeed before the service updates.

## Metadata about federal customer data (MAS-CSO-MDI)

Agency data comprises credit program definitions, loan/disbursement
records, cohort assumptions, model configurations, execution inputs and
results, and uploaded input files. Every root entity carries an `AgencyId`;
queries are filtered by the caller's agency claim; S3 keys are
agency-prefixed (`agencies/{id}/...`). The deletion workflow
(docs/policies/data-removal.md) can produce a complete manifest of an
agency's stored data — the working proof that data location metadata is
accurate.

## Third-party information resources (MAS-CSO-TPR)

Documented with usage, justification, mitigations, and compensating
controls in `docs/policies/supply-chain.md`, summarized here:

- **AWS GovCloud (US)** (FedRAMP-authorized): all hosting, storage,
  cryptography, and identity infrastructure. Justification: FedRAMP-High
  authorized government community cloud with FIPS-validated service
  endpoints and in-region AI services. Mitigations: least-privilege IAM,
  customer-managed KMS keys, all the monitoring in ComplianceStack.
- **GitHub** (not FedRAMP certified): source control and CI for code and
  configuration only — no federal customer data ever reaches it.
  Mitigations: branch protection with CODEOWNERS review, CI gates,
  OIDC-federated deploy credentials bound to reviewer-gated environments
  (no long-lived cloud secrets in GitHub), daily drift detection comparing
  deployed state to reviewed code.
- **Organizational email** (not FedRAMP certified): alerting and
  correspondence, never federal customer data. Mitigations: both partners
  on every security alias; provider compromise is treated as an incident.
- **OMB CSC3 hosted service** (`csccli.max.gov`, a U.S. government OMB
  MAX system): authoritative credit-subsidy calculation — OMB requires
  official subsidy rates and SERs to come from CSC3, so this dependency
  is not substitutable. The interface is OMB's own distributed client
  (SubsidyCLI.exe, verified by decompilation), reached only from the
  dedicated CSC worker's security group over HTTPS. Mitigations: the
  binary is stored outside source control and container images (it embeds
  an OMB-issued shared credential), fetched at task startup from the
  KMS-encrypted compute-context bucket; job files expire in 7 days; an
  outage degrades to a clear execution failure (no data loss).

No other third party is within the boundary; the supply-chain intake rule
requires review before any new third party enters it.

---

# Cryptographic Module Documentation

*CPO section satisfying CMU-CSO-CMD. All cryptography protecting federal
customer data is provided by AWS GovCloud (US) services whose modules hold
active CMVP validations or are update streams of validated modules; the
application implements no custom cryptography.*

| Where used | Service / module | CMVP status |
|---|---|---|
| Data at rest — RDS MySQL, S3 buckets (files, audit/evidence, compute-context, replica), SNS, CloudTrail, log groups, backups and cross-region copies | AWS KMS customer-managed keys; storage-service encryption using keys held in KMS HSMs | AWS KMS HSMs are CMVP-validated (FIPS 140-3); GovCloud KMS operates on validated modules |
| Data in transit — user to service | TLS termination at the ALB (WAF-fronted); AWS service TLS stacks | AWS TLS implementations (s2n/ACM) are update streams of CMVP-validated modules; GovCloud endpoints operate in FIPS mode |
| Data in transit — service to service | TLS to FIPS service endpoints (explicitly configured for Cognito; GovCloud defaults elsewhere), RDS TLS (required for the application user: `REQUIRE SSL`), SDK calls over TLS | Same AWS validated TLS stacks |
| Authentication | Cognito-managed WebAuthn/passkey verification and token signing; RDS IAM authentication token generation (AWS SDK) | AWS-operated, on GovCloud FIPS endpoints |
| Application layer | No custom cryptographic implementations; token validation uses the platform's standard libraries against Cognito's published keys | Platform (.NET) cryptographic primitives defer to OS/AWS-provided modules |

Grouping note (per CMU-CSO-CMD's allowance): services are grouped by
shared module rather than enumerated individually, because every in-scope
service uses the same two module families — AWS KMS for at-rest keys and
the AWS TLS stacks for transit.

Verification: the module inventory is derivable from the infrastructure
code (every data store declares its KMS key; endpoint configuration is
explicit where GovCloud requires it) and the no-custom-cryptography claim
is checked in secure-development review (docs/policies/secure-development.md).
The CMVP-status claims rest on AWS's published FIPS documentation and are
re-confirmed at the quarterly supply-chain review.

---

# Overall Summary of Assessment

*CPO section satisfying CPO-CSO-OSA / IVV-CSO-ICP.*

> **PLACEHOLDER — no independent assessment has been performed yet.**
>
> Prescient Security is engaged as the FedRAMP Recognized independent
> assessment service for FedCredIQ. When the initial independent
> verification and validation assessment completes, the assessor-supplied
> overall summary (including any failures or areas of dispute, per
> IVV-IAS-OSA) will replace this placeholder **verbatim** — formatting
> adjustments only, no modification of content or intent (IVV-CSO-ICP).

---

## Known placeholders and pending items

- FedRAMP ID and assessor ID are `PENDING-` placeholders until assigned (CDS-CSO-FID).
- UEI blank pending SAM.gov registration (pre-submission checklist).
- AWS GovCloud third-party FedRAMP ID to be verified against the current Marketplace listing before submission.
- Website, logo, and the public certification-data page go live with the public product site (pre-listing task).