Related · tier-1 reading. For what a portable artifact actually is, see Portable Artifact.
This is H33-74 — the portable 74-byte post-quantum evidence primitive that produces and anchors operational proof — applied to FedRAMP. The primitive is unchanged; only the application context differs, and the evidence it produces supports (does not by itself satisfy) the authorization. Federal Risk and Authorization Management Program requires verifiable evidence of operational controls. H33-74 produces that evidence as a chain-portable post-quantum proof that survives the systems and chains it was anchored to.
Federal Risk and Authorization Management Program (United States, cloud service providers and federal agencies) places obligations on organizations to demonstrate that operational controls were in place, that automated decisions were governed, and that an audit trail exists for regulatory inquiry. Most existing audit-log architectures meet the letter of the requirement but produce evidence tied to the operator's current systems. If those systems change or fail, the evidence weakens.
FedRAMP requires cloud service providers to demonstrate continuous compliance with NIST SP 800-53 controls including audit and accountability (AU family), system and information integrity (SI family), and configuration management (CM family). The 3PAO assesses controls annually and the agency authorizing official reviews continuous monitoring evidence on an ongoing basis. Authorization horizons extend across multi-year ATO cycles.
FedRAMP continuous monitoring requires evidence that controls have operated continuously over the authorization period, including across infrastructure transitions, contractor changes, and tooling updates. H33-74 produces each privileged action, each configuration change, each security event, and each access decision as a cryptographically verifiable proof. The 3PAO and the agency AO can verify the operation of any control directly, independent of the CSP's current logging and monitoring stack.
H33-74 is the same primitive across every regulation — only the crosswalk differs. Compare the sibling mappings for SOX and GDPR. Where authorized controls must be shown to stay true continuously between assessments, HATS records that ongoing control evidence on this same H33-74 substrate.
Read the architectural concept underneath every H33-74 regulatory deployment.
Chain Portability Why Chain Migration Shouldn't Exist