Latest:Casco becomes the First Agentic Pentesting Platform Certified via FedRAMP 20x
Skip to main content

Casco provides evidence for up to 42% of FedRAMP 20x controls

Book a FedRAMP demo
FedRAMP 20xEvidence / total

Class A

Evidence for

26/66

Mandatory
13/40
Recommended
7/11
Optional
6/15

Class B

Evidence for

87/203

Mandatory
56/136
Recommended
24/45
Optional
7/22

Class C

Evidence for

87/203

Mandatory
61/144
Recommended
23/44
Optional
3/15
Casco for Government · FedRAMP® Certified · Class A

Proof for your VDR/VER program.

VDR

Vulnerability Detection & Response

Find it. Fix it.

  • Continuous penetration testing
  • Vulnerability report triage
  • Retesting after fixes
VER

Vulnerability Evaluation & Reporting

Prove the risk.

  • Exploitability validation
  • Internet-reachability evidence
  • Reproducible findings for reporting

How Casco supports FedRAMP

FedRAMP requirements, evidence Casco provides, and customer actions
FedRAMP requirementCasco providesYour team does

Detect vulnerabilities

Continuously find weaknesses across your service.

VDR-CSO-DETVDR-CSO-ADT
Automated pentesting and vulnerability-report triage.Cover all in-scope resources, controls, and processes.

Test after changes

Check new or significantly changed resources.

VDR-CSO-DACKSI-CMT-VTD
Change-triggered tests and replayed attacks.Connect deployment workflows and set representative test scope.

Evaluate exploitability

Determine whether a vulnerability can be exploited.

VER-EVA-ELXVER-EVA-AIA
Reproduced exploits, prerequisites, and observed results.Assess every finding. Assume exploitation can be automated unless evidence proves otherwise.

Check internet reachability

Evaluate direct and indirect paths from the internet.

VER-EVA-EIR
Tested input paths and request-level traces.Review all entry points and affected services.

Assess agency impact

Estimate the likely effect on federal customers.

VER-EVA-EPAVER-EVA-EFA
Technical impact, affected behavior, and attack context.Add agency and mission context. Assign the Potential Agency Impact (PAIN) rating.

Verify remediation

Reduce vulnerability risk within the applicable timelines.

VDR-CSO-RESVDR-TFR-PVR
Reproduction steps, fix guidance, and retest results.Ship the fix, meet deadlines, and confirm mitigation or remediation.

Report vulnerability activity

Maintain persistent and monthly activity reports.

VER-RPT-PERVER-RPT-VDTVER-TFR-MHR
Findings, test history, and remediation evidence.Combine all sources, add required fields, and share reports with the necessary parties.

Validate controls

Document and validate how security measures work.

SDR-CSO-FRRIVV-CSO-SEE
Reproducible tests and observed control behavior.Complete the Security Decision Record and the required independent assessment.

Build your FedRAMP
evidence with Casco.

Book a FedRAMP demo Casco for Government