Beacon
BETAKey Security Indicators, emitted continuously.
FedRAMP 20x replaces annual ConMon paperwork with a continuous stream of Key Security Indicators — machine-validated against the infrastructure that actually runs your service. Beacon emits that stream from inside your boundary, signed, in the machine-readable format the program is moving to.
Run it yourself
Beacon deploys in your own environment.
A signed KSI emission on stdout for the bundled Okta policy export and Terraform plan. Read-only, deterministic, and no network call during evaluation.
Python 3.11 or later.
$ git clone https://gitea.novaprospekt.cc/Novaprospekt/beacon-ksi-evaluator.git
$ cd beacon-ksi-evaluator
$ pip install -e .
$ ksi-eval --input-dir examples/This is the open evaluator, which implements KSI-IAM-01 and KSI-CMT-RMV. The production emitter covers the Phase 2 Moderate baseline and signs with a key held inside your boundary.
The shift
ConMon becomes a continuous signal.
Traditional FedRAMP ConMon centers on a monthly artifact: vulnerability scans rolled up, POA&Ms summarized, an SSP reconciled against whatever has drifted. The work is reconciliation on a quarterly rhythm.
FedRAMP 20x changes the shape of the obligation. Authorization is structured around Key Security Indicators — measurable, automatable outcomes that replace the 325+ Rev 5 controls with about 60 indicators per impact level. The program asks for those indicators continuously. For 20x Moderate, the floor is one validation pass every three days.
Beacon produces those indicators. It reads your cloud, Kubernetes, identity and configuration state directly, evaluates each KSI against current infrastructure, and emits a signed evidence package the FedRAMP Management Engine — or any RFC-0024 consumer — holds as the authoritative record.
How it works
Four pillars of continuous KSI emission.
Each pillar produces a concrete artifact Beacon emits and keeps current against live infrastructure state, under your signing key inside your boundary.
Reads infrastructure, emits indicators
Beacon reads cloud, Kubernetes, IAM, and identity state directly — then emits Key Security Indicators against the FedRAMP 20x baselines. 56 KSIs for Low, 61 for Moderate, mapped to the categories the program publishes: CNA, IAM, SVC, CMT, monitoring, recovery.
Three-day persistent validation
For 20x Moderate, KSI validation must run at least every three days. Beacon runs continuously by default; the three-day window is the floor. Each emission is a signed, machine-readable record of what was true when it ran.
Machine-readable, RFC-0024 ready
Beacon writes the FedRAMP machine-readable package format that becomes mandatory September 30, 2026 under RFC-0024. JSON-first; OSCAL when your authorization is on the Rev 5 path. The output is the artifact the assessor reads — no template intermediary.
Signed at the source
Every KSI emission is signed with ed25519 inside your boundary before it lands in any evidence ledger. The 3PAO verifies the signature itself. Tamper-evident across the chain from infra read to authorization package.
Capability
What it is built to do, and where the beta actually is.
Each claim below is labelled with its basis. Measured means you can run it and check it today. Designed means it is what the emitter is built for. Beta means it is still moving, and we would rather say so.
Reproducible KSI output, verbatim
The open-source Beacon KSI evaluator emits real JSON for KSI-IAM-01 and KSI-CMT-RMV from its own bundled examples. You can run it on your machine and get the same bytes — it is not a rendering of what output might look like.
Emission at the three-day 20x cadence
20x Moderate requires KSI validation at least every three days. Beacon is built to run continuously, treating the three-day window as a floor.
Signed inside your boundary
Every emission is signed with ed25519 before it leaves the boundary, so the 3PAO verifies the signature rather than trusting Novaprospect as an intermediary.
RFC-0024 machine-readable packages
Output targets the FedRAMP machine-readable package format mandatory from 30 September 2026, JSON-first, with OSCAL where the authorization is on the Rev 5 path. No template intermediary.
Reads cloud primitives and IaC directly
Cloud, Kubernetes, IAM and identity state are read at source rather than re-keyed from a questionnaire, which is what makes an emission a statement about the running system.
Coverage still expanding
Beacon is in beta. KSI coverage grows category by category against the 56-KSI Low and 61-KSI Moderate baselines, and we will show you exactly where it is today rather than demoing around the gaps.
Coverage
Every KSI category, emitted live.
Beacon implements the seven KSI categories published by FedRAMP for the 20x Phase 2 Moderate baseline. Coverage numbers below reflect what's shipping in the beta today.
A single KSI, end to end
Phishing-resistant MFA, every three days.
KSI-IAM-01 asks for phishing-resistant MFA on privileged access. Beacon reads your identity provider's policy, evaluates the rule, and emits a signed result — not a narrative attestation.
$ ksi-eval --ksi KSI-IAM-01 --input examples/okta-policy.json
{
"emission": [
{
"ksi-id": "KSI-IAM-01",
"result": "pass",
"evidence": {
"source": "examples/okta-policy.json",
"policy-id": "00p1k4z3a2cN9rT",
"applies-to": [
"privileged-users"
],
"factors": [
"fido2",
"webauthn"
],
"disallowed": [
"email",
"push",
"sms",
"totp"
]
},
"rev5-mapping": [
"IA-2(1)",
"IA-2(2)",
"IA-2(11)"
],
"rule-version": "0.1.0",
"evaluated-at": "2026-08-19T05:11:05Z"
}
]
} That is the literal output of the open-source beacon-ksi-evaluator against the policy export bundled in its own examples/ directory — not a rendering of one. The reference evaluator implements
two indicators today and does not sign its output; signing keys held in
the customer boundary, cadence scheduling and RFC-0024 package emission
are the production emitter's job.
Compliance alignment
Built for the rules as they're being written.
Beacon tracks the consolidated rules and RFC outcomes as they land. What ships today is what works with the Phase 2 Moderate spec; what ships next quarter follows the rules into Phase 3.
FedRAMP 20x · Phase 2 / Phase 3
Emits against the 56-KSI Low and 61-KSI Moderate baselines published in RFC-0006 and the Phase 2 Moderate spec. Tracks the consolidated rules as they finalize through June 2026.
RFC-0024 machine-readable packages
Generates the FedRAMP machine-readable package format mandated for all CSPs (Rev 5 and 20x) by September 30, 2026.
NIST 800-53 Rev 5 mapping
Each KSI carries its Rev 5 control mapping so organizations on the traditional path can use the same infrastructure scans for OSCAL evidence.
Architecture
Inside your boundary. Under your signing key.
Beacon is delivered as a single container with Helm and Terraform modules. It runs inside your authorization boundary — on-prem, customer cloud, or GovCloud tenant — and reads infrastructure through short-lived credentials scoped to inventory and configuration APIs.
Every emission is signed with a key generated and held inside your boundary. The signature is what makes the evidence assessor-verifiable; Novaprospect is never on the trust path.
Beacon writes emissions to a customer-owned data store. The FedRAMP Management Engine consumes them natively, but the format is RFC-0024-compliant, so any conforming consumer works.
The beta
A small group, through Phase 3.
Beacon is still in beta — unlike NAICOM and Citadel, which are released. We're running it with a small number of CSPs through the FedRAMP 20x Phase 2 and early Phase 3 window, for organizations already in or planning to apply for the program this calendar year.
You get the running Beacon build, direct input on the KSI emitter implementations, and the rev-by-rev coverage updates as the consolidated rules finalize. The intent is two-way: we want the implementation feedback as much as you want the tooling.
Who this is for
Four things that make the Beacon beta worth your time.
These are not gates — if your situation is close but not exactly this, the conversation is still worth having.
In or applying to 20x Phase 2 / Phase 3
Your authorization plan includes 20x — Phase 2 cohort participation, the Phase 2 Cohort 2 window, or Phase 3 wide-scale adoption starting Q3 2026.
Cloud-native infrastructure
Production runs on cloud primitives (AWS / Azure / GCP) and IaC (Terraform, Pulumi, Helm) the KSI emitter can read directly. On-prem is workable where the read path is well-defined.
A real authorization timeline
An authorization milestone this calendar year. A beta is worth your time under genuine timeline pressure, and rarely worth it without one.
Tolerance for a beta
Coverage is still expanding KSI by KSI. You should want to see the current output against your own infrastructure before you plan around it.
What the demo covers
The running build, gaps included.
- The running Beacon build emitting against real infrastructure — not slides, and not a recorded video.
- Current KSI coverage, category by category, including the categories that are not done yet.
- A signed emission end to end, and how a 3PAO verifies it without trusting us.
- The machine-readable package as RFC-0024 wants it, and how the FedRAMP Management Engine consumes it.
- What the read path into your own cloud and IaC would look like.
What we need from you
Thirty minutes and a named contact.
- A named technical contact who can speak for the infrastructure Beacon would read.
- A rough shape of that environment — cloud provider, Kubernetes or not, and which IaC you use.
- Your 20x position: which phase, which baseline, and the authorization milestone driving it.
- Thirty minutes. A second, deeper session is common; the first one does not need to be long.
FAQ
What people usually ask first.
Is Beacon released?
No. Beacon is in beta, and the FedRAMP Management Engine that consumes its output is in limited release. Both are demonstrable today, and we will tell you plainly what is and is not implemented rather than demoing around the gaps.
Can I see real output before talking to anyone?
Yes. The open-source KSI evaluator emits verbatim JSON for KSI-IAM-01 and KSI-CMT-RMV from its bundled examples, and the KSI Quick Check tool runs a check in your browser with nothing installed.
How often does it emit?
Continuously. 20x Moderate requires KSI validation at least every three days, and Beacon treats that window as a floor rather than a cadence, so an emission reflects what was true when it ran.
Who verifies the signature?
Your 3PAO. Emissions are signed with ed25519 inside your boundary before they land in any evidence ledger, so verification does not route through Novaprospect.
Do I need the FedRAMP Management Engine as well?
No. The Engine consumes Beacon output natively, but the format is RFC-0024-compliant, so any conforming consumer works. Beacon stands alone against your own package.
What does it cost?
Beacon is quoted per engagement, because environment shape moves the number more than anything else does. The price is open in the first conversation.
Elsewhere in the platform
FedRAMP Management Engine →
Holds Beacon's KSI emissions as the authorization package record. Generates Rev 5 OSCAL alongside the 20x machine-readable package.
Citadel →
Signed host-state results feed Beacon as the host-side input for KSI-CNA and KSI-CMT categories.
NAICOM →
AI-session provenance records feed Beacon as evidence for KSI-MLA (monitoring/logging) categories.
Build against 20x while the rules are still being written.
The Consolidated Rules 2026 finalize at the end of June. The machine-readable package requirement is mandatory September 30. Beacon is for teams who want to be ready for both before they land.
Ask about the Beacon betaAsk about the Beacon beta.
Tell us where you are with 20x — which phase, which baseline, and the authorization milestone driving it — plus the shape of the infrastructure Beacon would read. We answer every request, usually inside a business day.