Compliance automation platform for NIST 800-171 and FedRAMP
You are building "ControlPlane," a multi-tenant compliance automation SaaS. It connects via read-only APIs to a customer's cloud and SaaS stack, collects evidence, continuously monitors controls, and generates audit artifacts. Its differentiator is depth on NIST 800-171 (CMMC Level 2) and NIST 800-53 (FedRAMP) — including SSP, POA&M, and control inheritance — not breadth. GLOBAL CONSTRAINTS (apply to every step): - State budget is 1GB hard cap. Evidence artifacts (screenshots, config exports, documents) go to object storage; the database persists ONLY metadata, control mappings, test results, current-state snapshots, and deltas. Monitoring history is stored compact (latest state + deltas), never as raw logs. - Multi-tenant with strict row-level isolation from day one. - Use the platform's built-in auth, secrets vault, encryption, and audit primitives. Read-only OAuth scopes by default; any write scope is separate and gated. - Build incrementally. After each step, output what was built and self-check against "Done when" before proceeding. STEP 1 — Scaffold & architecture App shell, multi-tenant context, module boundaries: frameworks, connectors, evidence, controls-engine, policies, monitoring, artifacts, ai, audit, ui. Done when: a tenant can be created and isolated; health check passes.
What this prompt builds
ControlPlane is a multi-tenant compliance automation SaaS that connects to cloud and SaaS infrastructure via read-only APIs to continuously monitor security controls and generate audit artifacts. It specializes in NIST 800-171 (CMMC Level 2) and NIST 800-53 (FedRAMP) compliance frameworks, automating evidence collection and producing System Security Plans, Plans of Action & Milestones, and control inheritance documentation. The platform enforces strict multi-tenant isolation and compact state storage while leveraging built-in security primitives.
The problem
Organizations pursuing NIST 800-171 (CMMC Level 2) or NIST 800-53 (FedRAMP) certification face a labor-intensive compliance process that requires continuous evidence collection, control monitoring, and complex audit artifact generation across their cloud and SaaS infrastructure. Manual compliance workflows consume hundreds of hours, create gaps in monitoring, and make it difficult to maintain audit-ready documentation for System Security Plans, Plans of Action & Milestones, and control inheritance. This workflow builds a multi-tenant compliance automation platform that connects via read-only APIs to a customer's entire stack, automatically collects and stores evidence in object storage, continuously monitors control states, and generates the specialized audit artifacts required for NIST frameworks, reducing compliance overhead while ensuring continuous audit readiness.
Solution and impact
The platform automates the entire compliance lifecycle by connecting to cloud and SaaS environments through read-only APIs, eliminating manual evidence gathering and providing real-time visibility into control compliance status. Organizations gain continuous monitoring with compact state tracking and automatic delta detection, while audit artifacts—including SSPs, POA&Ms, and control inheritance documentation—are generated on demand rather than assembled manually. Compliance teams save hundreds of hours per audit cycle, close monitoring gaps that could lead to failed audits, and maintain perpetual audit readiness for NIST 800-171 and FedRAMP certifications without scaling headcount.