This actually sounds like an amazingly simple (at least in principle), and probably effective solution to a problem that does exist that I didn't realize needed to be solved.
i am currently working on fedramp certification for a big system, and all requirements are serious pain in the ass to comply with, in case your organization not used to it