Open-source work across commercial and federal control sets. Cards link out to GitHub; the README in each repo is the deep dive.
Six leads. Three federal, three commercial. The commercial three are one arc: own the corpus, answer as the vendor, assess as the customer.
The layer after the audit scripts. Findings land in DuckDB against a per-source contract. dbt stages them into a queryable model; schema, completeness, and reconciliation tests pin that contract at the data layer. Fail loud. Lineage from source through staging to mart.
I turn secret-scanner findings into OSCAL Assessment Results JSON. oscal-pydantic builds the models, and every CLI emit is validated against a vendored copy of the NIST OSCAL Assessment Results schema before it ships. Target shape: FedRAMP 20x machine-readable evidence.
SCPs deny the non-compliant action at the org. CloudFormation lays down a baseline that is compliant by default: CloudTrail, IAM, KMS, Config, GuardDuty, Security Hub. The controls map to CJIS Security Policy, FedRAMP, and NIST 800-53. The point is showing how those frameworks turn into enforceable cloud policies, not paperwork.
One mappings.yaml. SOC 2 Common Criteria as the pivot, with NIST 800-53 Rev 5 and ISO 27001:2022 Annex A hung off each criterion and a Strong/Partial/Contextual label. build_crosswalk.py emits Markdown, JSON, and CSV. --check fails on drift.
Drafts grounded answers to customer security questionnaires from a version-controlled SOC 2 / ISO 27001 control corpus, and abstains loudly when it can't. Every drafted answer carries an inline citation and a confidence tier inherited from the corpus. Questions the corpus cannot support return INSUFFICIENT_COVERAGE instead of a plausible guess.
score_vendor.py scores a vendor on two axes against a CC9.2 / ISO A.5.19-A.5.23 checklist: the data-handling profile sets inherent risk, the weighted checklist sets assurance, and a matrix resolves the residual Low/Medium/High tier. Writes a memo plus JSON you can diff at annual re-review.
Shipped or in progress. Each card links to the GitHub repo.
Config rules fire. SSM automation documents run the remediation. Lambda classifies severity and notifies. Continuous monitoring mapped to SI-4 and AU-6, with FedRAMP 20x KSI tracking in mind.
A user access review as a data pipeline, shaped by the reviews I used to run. Six identity extracts land in SQLite and reconcile against HR as the population of record, then SQL control checks find terminated-but-active, orphaned, dormant, and ownerless access. A recursive CTE flattens nested groups so privileged reach is the effective answer, not the direct-membership one. Emits an evidence packet with SHA-256 input hashes that regenerates byte-identical. Stdlib only. SOX ITGC framing, crosswalked to AC-2/AC-6 and SOC 2 CC6. v1.0 shipped 2026-08-23.
FedRAMP High is not CJIS. I encoded where v6.x is stricter (AAL2 MFA, agency-managed CMKs) and where CJIS-only privacy controls have no FedRAMP High home. The output is an OSCAL overlay, not a spreadsheet.
31 NIST 800-53 Rev 5 controls mapped to AWS services as an OSCAL Component Definition. A Python generator filters the output to FedRAMP High. Five of those controls call out where CJIS v6.1 forces a law enforcement deploy past the FedRAMP High baseline.
I wrote a Python CLI that flags IAM policies that are too wide. Wildcard actions, missing MFA on CJI paths, open cross-account trusts. Non-zero exit and JSON evidence out. Runs in GitHub Actions.
Scans repos for the usual secrets, plus CJI identifiers most scanners miss: ORI numbers, NCIC codes, FBI Numbers, State IDs. Non-zero exit for CI. Mapped to IA-5(7), SC-12, SC-13, SC-28.
Planned next.
Planned. Check that CJI encryption in KMS meets FIPS 140-2/3 and agency-managed key rules where those go past FedRAMP High.
Planned template for public-safety AI risk, mapped to NIST AI RMF and ISO 42001 Annex A. Facial recognition, predictive policing, AI-assisted dispatch.