SSP Sprint
OSCAL-native SSP rebuild. We take a draft SSP from whatever state it is in and return a versioned, OSCAL-compliant artifact checked into your repository.
Contact us
6–8 weeks
- Lump sum · scoped engagement.
Documentation engineering, applied to diligence, authority, drift, and authorization.
Documentation engineering, applied to
Diligence.
1SSP
2OSCAL
3CI
4Audit
Pragma · Documentation Engineering
Engineering. Not narrative.
Pragma connects cloud providers and assessors in one workspace — with Specshift scoring every control's documentation before the 3PAO does.
What the work actually is
Engineering scope
Your SSP is an engineering artifact. We rebuild it as OSCAL — versioned, diff-able, continuously evaluated against your codebase. We staff senior engineers, not writers.
Authorization and posture
Pragma is the vehicle. Specshift is the meter. Pragma helps SaaS vendors reach FedRAMP authorization faster. Pragma itself is SOC 2 Type II aligned and does not claim FedRAMP authorization — the authorization attaches to your system, not to us.
CARL standard
Built on CARL — the open standard for AI-driven SDLC maturity. Every product on this page self-attests on every PR.
Build pipeline
Compliance documentation, treated as code. Versioned, tested, re-evaluated on every pull request. Pragma replaces the consultancy "writing pass" with a build pipeline that survives audit because it was always engineered to. OSCAL-native. Diff-able SSPs in CI. Drift gates on every PR. Senior engineers, not writers.
The meter.
retrieval
Do these docs contain the concepts that answer realistic developer questions? A content-coverage check, not vector recall.
agent
Do these docs surface the success criteria a representative task needs? A content-coverage check; no task is executed.
structure
Are the docs organised so a model can navigate without context overflow?
drift
Do the docs describe the platform's actual current behaviour?
Retrieval score
Your docs have a retrieval score. You just don't know it yet.
Authorization and posture
Specialized intelligence for FedRAMP authorization.
Pragma connects cloud providers and assessors in one workspace — with Specshift scoring every control's documentation before the 3PAO does.
Engagements.
We reply within one business day. Tell us your authorization timeline and the documentation you have today. We will tell you whether the work is a Sprint, an Acceleration, or a ConMon retainer.
ATO Acceleration
Full authorization push. Covers all documentation engineering from initial OSCAL build through 3PAO assessment, with Pragma engineers embedded in your CI pipeline.
Contact us
Milestone-based
- Milestone billing · custom SOW.
Continuous ConMon
Drift suite runs in your CI on every PR. Monthly deviation report with scored findings. The SSP stays current; your authorization does not rot.
Contact us
Retainer
- Monthly retainer.
Tools.
Specshift engine
The eval engine. Score any docs URL at /eval: no login, no install. The engine packages carry an MIT licence; the source and CLI are not yet publicly released.
Specshift Cloud
Hosted eval at scale under a proprietary source-available licence; the source is not yet publicly released. SBOM, signed builds, OSCAL components. The FedRAMP-aware methodology variant runs here.
Try Eval
Drop a docs URL. Get a scorecard — overall score, per-suite breakdown, every test — rendered inline, plus an unlisted shareable report link. No README badge yet. CARL-attested on every PR.
Talk to an engineer.
We reply within one business day. Tell us your authorization timeline and the documentation you have today. We will tell you whether the work is a Sprint, an Acceleration, or a ConMon retainer.