Pragma · Product documentation

How Pragma works.

Pragma is documentation engineering for regulated software. It has two parts. Pragma engagements rebuild your FedRAMP System Security Plan as OSCAL: versioned, diffable source that lives in your repository. Specshift, the evaluator, scores a body of documentation against a pinned, published methodology, and you can run it today at /eval.

01

What a Pragma engagement delivers

Three engagement shapes, each scoped to one stage of the FedRAMP journey.

SSP Sprint

OSCAL-native SSP rebuild for one service, typically 6–8 weeks.

  • OSCAL-compliant SSP artifact in your repository
  • OSCAL component definitions
  • ATO milestone plan
  • 3PAO handoff packet

ATO Acceleration

Full authorization push through 3PAO assessment, typically 4–6 months.

  • Everything in SSP Sprint
  • Continuous narrative engineering
  • 3PAO liaison and drift remediation
  • Evidence packaging and an executive dashboard

Continuous ConMon

Keeps the SSP, POA&M and OSCAL current as the codebase changes.

  • Drift suite in CI on every PR
  • Monthly deviation report with scored findings
  • Quarterly re-scoring on current methodologies

Quotes are scoped per engagement; see Pricing.

02

How an engagement runs

  1. 1
    Tell us where you are
    Send your authorization timeline and the current state of your SSP through the contact form. The request is stored first, then routed to the team.
  2. 2
    Scope the engagement
    We pick the engagement shape with you and write a Statement of Work. First-time engagements use a simple MSA; larger SOWs use a custom MSA.
  3. 3
    Engineer the documentation
    Engineers rebuild the SSP as OSCAL in your repository, so control narratives are versioned, diffable and reviewed like code.
  4. 4
    Hand off to the assessor
    The 3PAO assesses; Pragma engineers the documentation. The authorization attaches to your system, never to Pragma.

03

Specshift: score your docs

Paste a public docs URL into /eval. Specshift fetches the site and runs four suites, and the scorecard (overall score, per-suite breakdown and every test) renders in the response. Each run is saved under a report id with its own page, and that id powers a README badge. Give an email address and the scorecard is also sent as a PDF. Runs are rate-limited per IP address and private network targets are refused.

retrieval

Do these docs contain the concepts that answer realistic developer questions? A content-coverage check, not vector recall.

agent

Do these docs surface the success criteria a representative task needs? A content-coverage check; no task is executed.

structure

Are the docs navigable with limited context? HTML heuristics such as a sitemap, a table of contents, anchored sections and semantic landmarks.

drift

Does the site behave the way the docs say? A small set of low-cost probes: HTTPS serving, an evaluable robots.txt, a landing page that loads, and a 401 check when the docs claim one.

Agent and retrieval scores measure documentation content coverage against the v1 Specshift corpus. Each expected concept is a synonym group, and a test that matches at least one group scores no lower than 0.5. No task is executed and no vector recall is measured.

04

Why the scores are reproducible

Every report records the methodology version and engine version it ran against. The methodology is published with a limitations document that states what the current version does not measure, so a score can be checked rather than taken on trust.

05

What Pragma does and does not claim

Pragma helps your system reach FedRAMP authorization; the authorization attaches to your system. Pragma is not FedRAMP authorized, not a FedRAMP service provider and not a 3PAO. The FedRAMP page is the full statement, and the Trust page covers security posture.

06

FAQ

Does Pragma hold a FedRAMP authorization?
No. Pragma is the documentation-engineering vehicle that gets your system to FedRAMP authorization. The authorization belongs to your system. Pragma is not a 3PAO and never claims FedRAMP authorization.
What is Pragma's SOC 2 status?
SOC 2: Aligned (self-assessment); auditor engagement pending; no report issued. The Trust page carries the current details.
How much does an engagement cost?
Engagements are scoped per customer and quoted against the price book. Pragma does not publish self-serve list prices; the Pricing page describes each engagement shape.
Can I run Specshift myself?
Yes, at /eval: paste a public docs URL and the scorecard renders in the response. The Specshift CLI is not yet published to npm, so /eval is the way to run it today.
Does the agent score mean an AI agent completed a task?
No. The agent and retrieval suites check whether the docs contain the concepts the v1 corpus expects. No task is executed and no vector recall is measured.
Where do I get help?
The Support page answers common questions and opens a ticket. Engagement and partnership questions go through the contact form.
Contact PragmaRun Specshift on your docs