From 1 January 2027 AWS validates MSP partners exclusively against Validation Checklist 8.0: 61 controls, 24 new, 27 rewritten, focused on demonstrable AI delivery. monsys measures the technical controls — GenAI observability, toil reduction, AI dependencies in vulnerability management, signed change management — and bundles them in an Ed25519-signed evidence pack an AWS auditor can verify independently.
From the control mapping on this page to the dashboard, the signed evidence pack and the docs — with realistic demo data (Northwind Cloud). English subtitles.
Demo tenant with synthetic data. No customer data.
The previous checklist asked whether you could deliver AI. The new one demands proof that you operate it: observability, cost, governance and toil reduction have to come out of systems, not slides.
New. Agent session tracing, inference performance monitoring, drift detection, decision audit trails and cost observability. Every MSP must show this for its own AI workloads and those of its customers.
New. Toil must be tracked as a percentage of ops time, with an automation backlog and demonstrated quarterly reduction. That needs a time series, not a snapshot.
Rewritten. Change management (GOVP-001), vulnerability management (SEC-003) and FinOps (OPS-009) now explicitly cover AI workloads, AI dependencies and inference cost.
Not a marketing list but the actual mapping shipped in the platform (compliance_framework_controls, framework AWS-MSP-VCL-8.0). Every row has an executable evidence query; the dashboard shows per control how much evidence exists.
monsys supplies the measurements per control; the AWS validation partner judges the file. The dashboard shows the evidence count per control — including where it is zero.
OPSP-003 asks for toil as a percentage of ops time. Nobody measures human minutes reliably, but the proxy auditors accept is measurable: what share of remediation actions on your fleet was automated, and how many alerts resolved themselves.
In Germany, Belgium and the Netherlands, per-employee productivity measurement can require works-council consent. That is why monsys aggregates toil per tenant per month and agent sessions per hashed session — there is no table of per-operator performance.
So you can show the numbers to AWS and to your works council without a separate procedure. FINMA-bound (CH) and Baltic MSPs with strict data-residency requirements keep everything on their own EU infrastructure.
One signed PDF + JSONL bundle, generated from the report centre, offline-verifiable with your tenant's public key. Six sections:
monsys supplies measurements and signed evidence. The AWS validation partner judges the file; we do not replace that judgement.
SECP-004 requires input validation on the endpoint itself. monsys detects the consequences (refusals, anomalies, cost spikes) but does not build the guardrail.
BUS-002, PEO-003 and PEO-004 are organisational controls. You attest them yourself; monsys supplies the measurements the roadmap steers on.
CloudWatch, Security Hub and Cost Explorer stay. monsys adds the host and AI layer AWS does not see, and signs the evidence.
VCL 7.1 sunsets on 31 December 2026. Every validation or revalidation from 1 January 2027 runs on 8.0. Because OPSP-003 asks for a quarterly trend, you need at least six months of time series before your audit — so start measuring in 2026.
No. monsys supplies measurable evidence for 15 technical controls and an attestation checklist for the declarative ones. Business, people and policy controls remain your work. We show honestly per control what is automatic, partial or declarative.
Then OPS-004 and OPS-009 show 'no evidence' and you see that immediately on the dashboard. The toil, CVE and change controls work from day one on your ordinary servers. Register your first AI app as soon as it exists; the SDK is open source.
Yes. Every customer is a separate tenant with its own AI apps, traces and evidence pack. As an MSP you see everything in one dashboard and generate a signed pack per customer.
On servers in Belgium, operated by GoTrust BV. No US cloud in the path for storage, alerts or authentication — relevant for FINMA, NIS2 and data-residency requirements.
5 servers are free, then €3 per server per month. AI observability is part of the platform; the VCL 8.0 evidence pack is a standard report template at no extra cost.
Five servers free, EU-hosted, no credit card.
Guides that solve everything by hand first, and only then show what monsys automates.
Architecture, Trust Score formula, supply-chain pipeline, NIS2 / AI Act / CRA mapping. Free PDF after a short form.
Download whitepaper →