{"id":"FR2701557058","name":"NorthWatch","provider":"38North Security, LLC","providerSlug":"38north-security-llc","status":"Initial Implementation","impact":"Not yet listed","authType":"Program","serviceModel":["SaaS"],"deployment":"Public Cloud","businessFunctions":["Governance, Risk, and Compliance (GRC)"],"assessor":"A-LIGN Compliance and Security, Inc. dba A-LIGN","assessorId":"138665","smallBusiness":false,"website":"https://38northsecurity.com/northwatch/","description":"NorthWatch is a security assurance and visibility SaaS platform built to meet the reporting standards of FedRAMP 20x and the FedRAMP Consolidated Rules for 2026 (CR26).\n\nIt consists of the following services:\n\nKey Security Indicators (KSI). This module presents the KSIs measured in a customer environment. It visualizes and reports the current and historical status of each KSI, and it provides the implementation, the validations, and a JSON summary of each KSI's source, measure and value. If the customer uses the NorthWatch validation engine, a validation agent is enrolled in the customer environment. The agent performs the KSI validations against the telemetry sources present there and reports the results to the NorthWatch service.\n\nVulnerability Evaluation and Reporting (VER). This module ingests the customer's scan results by API, applies the defined security context of the customer system to each result, and derives the Potential Agency Impact N-rating (PAIN). The risk equation is automated from the factors in the VER ruleset and can be customized to capture the security context of the customer system. The module polls the CISA Known Exploited Vulnerabilities (KEV) catalog, the FIRST Exploit Prediction Scoring System (EPSS), and the NIST National Vulnerability Database (NVD) to determine the exploitability of each identified vulnerability. It also accepts findings from other sources and applies the same contextual logic to them. It sets the remediation and mitigation SLAs from the PAIN rating, the likely exploitability, and the internet reachability of each vulnerability. The module records accepted vulnerabilities and their reporting requirements, the full vulnerability history, the remediation plans a customer authors in the module, and the mitigation activities taken to reduce risk.\n\nSignificant Change Notification (SCN). This module provides the form that meets the SCN reporting requirements for adaptive and transformative changes. It tracks each change through its lifecycle, collects evidence from third parties, and keeps a historical record of every change that meets the adaptive or transformative criteria. The module is built to take notifications from the customer's change-management system through its API, so the form is populated from that system rather than retyped. The notifications are published to the customer's assessor and agency customers through the Certification Data Sharing module as the twelve-month archive the ruleset requires.\n\nDocuments. This module is the customer's register of the governance documents FedRAMP 20x requires: policies, procedures, plans, inventories and records. Each document has a defined class with its required sections and accepted formats. A customer authors a document in the module, uploads one produced elsewhere, or has the module generate it from live system data (for example the certification package overview, the SCN twelve-month archive, the incident evaluation log and the quarterly review record). The module versions each document, checks its completeness and staleness against the rules, and lets the customer publish selected documents to its assessor and its agency customers as part of the signed certification package.\n\nCertification Data Sharing (CDS). This module publishes the machine-readable JSON artifacts the FedRAMP rulesets define, each signed, together with a human-readable form. It is not a standalone service; it is the public face of the information held in the other modules: the certification package and its overview, the KSI summary, the SCN archive, the retained snapshot series, and the documents the customer has chosen to publish. Every artifact is reachable from a well-known discovery document on the customer's trust domain, so an assessor or an agency can find and verify it without an account.\n\nReporting. This module produces the reports the customer, its assessor and FedRAMP read, on a schedule or on demand. It includes the three FedRAMP vulnerability reports (Vulnerability Detail, Accepted Vulnerability Information, and Historical Activity) and the asset inventory, compliance, corrective action plan, detailed vulnerability, executive summary and trend analysis reports. A customer defines a report from these types with its own scope, format and schedule, and the module keeps the history of every run. Reports are produced as JSON, CSV, PDF or XLSX.\n","logo":"https://dashboard.northwatch.io/images/northwatch-icon.png","inMarketplace":false,"agencies":[],"reuseCount":0,"leverages":[],"leveragedBy":[],"cr26":{"type":"20x","trustCenterUrl":"https://dashboard.northwatch.io/trust/northwatch","trustCenterAuth":false,"secureConfigUrl":"https://dashboard.northwatch.io/documents","nextOcr":"2026-12-31","ocrOverdue":false,"valid":true,"findings":[],"assessor":"A-LIGN Compliance and Security, Inc. dba A-LIGN"},"timeline":[{"date":"2026-10-16","to":"Initial Implementation","certType":"20x"}],"trustCenterCheck":{"url":"https://dashboard.northwatch.io/trust/northwatch","ok":true,"kind":"answered","reason":"HTTP 200","status":200,"ms":674,"checkedAt":"2026-11-02T18:00:37.751Z"}}