Compliance Layer

attest

Compile compliance frameworks into deployed AWS policy artifacts. Enforce controls continuously. Generate audit evidence from live state — not manually assembled documents.

Quick start Releases GitHub

Compile

Reads framework YAML definitions. Deduplicates controls across frameworks. Generates SCPs, Cedar policies, and AWS Config rules that fit within AWS's 5-SCP-per-target limit.

Enforce

Deploys SCPs to your AWS Organization. Runs a continuous Cedar PDP via EventBridge — every API call evaluated against compiled policies in real time.

Prove

Generates SSP, OSCAL, CMMC assessment packages, SPRS scores, and NIH DMSPs from live AWS state. Evidence is what's deployed, not what someone documented.

Quick start

From a blank AWS Organization to a CMMC 2.0 Level 2 self-assessment in one session. CMMC Level 2 = NIST SP 800-171 Rev 2 — activating cmmc-level-2 also activates nist-800-171-r2 automatically.

1

Install

# Build from source (Go 1.25+)
git clone https://github.com/provabl/attest
cd attest && go build -o /usr/local/bin/attest ./cmd/attest
attest version
2

Initialize

# Point attest at your AWS Organization
attest init --region us-east-1
# SRE initialized — org topology written to .attest/sre.yaml

# Tag accounts with data classification
aws organizations tag-resource --resource-id 123456789012 \
  --tags Key=attest:data-class,Value=CUI \
         Key=attest:owner,Value="Dr. Smith"
3

Activate frameworks

# cmmc-level-2 automatically activates nist-800-171-r2 (its control set)
attest frameworks add cmmc-level-2
attest frameworks add hipaa
attest frameworks list
4

Compile & deploy

# Merged strategy: deduplicates across frameworks, fits 5-SCP limit
attest compile --scp-strategy merged
attest preflight --region us-east-1
attest apply --approve --region us-east-1
# 110 controls compiled → 1 merged SCP, 15 Cedar policies, Config rules
# SCP deployed — every account in the org inherits immediately
5

Scan & generate evidence

attest scan
# nist-800-171-r2 (110 controls): 9 enforced, 21 partial, 80 AWS-covered, 0 gaps
# hipaa           (23 controls):  12 enforced, 11 via 800-171 supersession

attest generate ssp --framework cmmc-level-2
attest generate assess --framework cmmc-level-2  # CMMC 2.0 self-assessment score
attest generate sprs --level 2                  # DoD SPRS submission report
attest generate cmmc-bundle                     # Complete C3PAO evidence package

Full walkthrough: quickstart.md · Demo scenarios: demo/

Supported frameworks

Each framework compiles to SCPs, Cedar policies, and AWS Config rules. Delta frameworks extend a base.

DoD / Federal

  • cmmc-level-1 CMMC 2.0 Level 1 — 17 practices
  • cmmc-level-2 CMMC 2.0 Level 2 — 110 practices
  • cmmc-level-3 CMMC 2.0 Level 3 — delta on L2
  • nist-800-171-r2 NIST SP 800-171 Rev 2
  • nist-800-171-r3 NIST SP 800-171 Rev 3
  • itar ITAR Technology Control Plan
  • fisma-moderate FISMA Moderate

Health & Research

  • hipaa HIPAA Security Rule
  • nih-gds NIH Genomic Data Sharing Policy (2025)
  • nih-research-security NIH NOT-OD-26-017
  • 42-cfr-part-2 42 CFR Part 2 (substance use)
  • translational-medicine Translational research
  • ferpa FERPA
  • va-handbook-6500 VA Handbook 6500

FedRAMP / Cloud

  • fedramp-moderate FedRAMP Moderate
  • fedramp-high FedRAMP High — delta on Moderate
  • nist-800-53-r5 NIST SP 800-53 Rev 5
  • cjis CJIS Security Policy

International

  • gdpr GDPR (EU research data)
  • iso27001-2022 ISO 27001:2022
  • uk-cyber-essentials UK Cyber Essentials
  • asd-essential-eight ASD Essential Eight

Command reference

Setup

attest init
Initialize an SRE from an existing AWS Organization
attest preflight
Check AWS prerequisites before applying
attest sre
Manage multiple AWS Organizations

Frameworks

attest frameworks list
List available and active frameworks
attest frameworks add <id>
Activate a framework for this SRE
attest project add|list
Manage research project context

Compile & Deploy

attest compile
Generate SCPs, Cedar policies, Config rules
attest apply
Deploy compiled SCPs to the organization
attest rollback
Restore to a prior deployment snapshot
attest test
Run Cedar policy unit tests
attest simulate
Diff Cedar decisions: current vs proposed

Assess

attest scan
Analyze posture against active frameworks
attest evaluate
Run Cedar PDP evaluation against current state
attest watch
Continuous Cedar PDP evaluation (CloudTrail)
attest diff
Compare posture between history snapshots
attest audit-sim
Simulate a CMMC Level 2 assessor evaluation

Generate documents

attest generate ssp
System Security Plan
attest generate poam
Plan of Action & Milestones
attest generate assess
CMMC 2.0 self-assessment score
attest generate cmmc-bundle
Complete CMMC Level 2 assessment package
attest generate sprs
SPRS score report for DoD submission
attest generate dmsp
NIH Data Management and Security Plan
attest generate oscal
Full OSCAL export (SSP, AR, POA&M)

Manage

attest waiver
Time-bounded compliance exceptions
attest attest
Administrative control attestations
attest attest pi-sign
PI institutional attestation (NIH dbGaP)
attest incident
Security and compliance incident tracking
attest navigate
Show compliance obligations across active projects (--project, --timeline, --ai)
attest calendar
Upcoming review and renewal obligations
attest report
Posture trend report from history
attest serve
Launch the compliance dashboard

AI capabilities

attest ai ask
Ask the compliance analyst a question
attest ai onboard
Guided compliance onboarding
attest ai ingest <file>
Map an existing document to framework controls
attest ai translate
Natural language → Cedar policy
attest ai analyze
Detect anomalies in Cedar decision log
attest ai remediate <id>
Generate remediation artifact for a gap
attest ai impact <file>
Analyze compliance impact of a new framework

CI/CD & tooling

attest check
CI/CD compliance gate for Terraform plans
attest provision
Create a new compliant research environment
attest verify <binary>
Verify attest binary via cosign/Sigstore

Regulatory intelligence

attest regulatory ingest <url>
Fetch and analyze a specific notice URL or file (NIH Guide, Federal Register, etc.)
attest regulatory fetch
Check all configured sources for new notices (--since, --dry-run, --create-issues)
attest regulatory pending
List relevant notices not yet tracked as GitHub issues
attest regulatory sources
List configured regulatory sources and last-checked status