{
  "profile": {
    "uuid": "d4f2a3b8-7e91-4c6d-9a84-3f17c2b5d092",
    "metadata": {
      "title": "Aegix FedRAMP 20X Moderate Profile (Tiaki)",
      "published": "2026-04-21T00:00:00Z",
      "last-modified": "2026-04-21T00:00:00Z",
      "version": "0.1.0",
      "oscal-version": "1.1.2",
      "parties": [
        {
          "uuid": "2d7a9e42-5f8c-4c11-8b6a-1e0a3d5b4c77",
          "type": "organization",
          "name": "Aegix Safety Platform",
          "short-name": "Aegix",
          "remarks": "System owner. Responsible for product engineering, compliance posture, and customer deployments."
        },
        {
          "uuid": "8a6f4c19-2b7d-48e3-9c05-4fa8d1e6b3a2",
          "type": "organization",
          "name": "DuploCloud",
          "short-name": "DuploCloud",
          "remarks": "Platform provider (EKS, networking, IAM boundaries). Inherits SOC 2 Type II + FedRAMP Moderate at the platform layer per doc/compliance/compliance-stack-layers.md."
        }
      ],
      "roles": [
        {
          "id": "system-owner",
          "title": "System Owner",
          "short-name": "SO",
          "description": "Responsible for overall system operation, authorization, and compliance posture."
        },
        {
          "id": "security-engineering",
          "title": "Security Engineering",
          "short-name": "SecEng",
          "description": "Authors ADRs, owns compliance automation (ADR 099), reviews PRs against the compliance preamble."
        },
        {
          "id": "platform-provider",
          "title": "Platform Provider",
          "short-name": "Platform",
          "description": "DuploCloud — operates the underlying infrastructure controls (SC-7, SC-8 at load balancer, AU-2 at platform)."
        },
        {
          "id": "customer",
          "title": "Customer (School District)",
          "short-name": "Customer",
          "description": "Responsible for FERPA school-official designation (AC-20), user provisioning, and the directory-information classification registry."
        }
      ]
    },
    "imports": [
      {
        "href": "https://raw.githubusercontent.com/usnistgov/oscal-content/main/nist.gov/SP800-53/rev5/json/NIST_SP-800-53_rev5_catalog.json",
        "include-controls": [
          {
            "with-child-controls": "no",
            "with-ids": [
              "ac-2",
              "ac-3",
              "ac-4",
              "ac-6",
              "ac-17",
              "ac-20",
              "au-2",
              "au-3",
              "au-6",
              "au-9",
              "au-11",
              "au-12",
              "ca-2",
              "ca-7",
              "ca-9",
              "cm-2",
              "cm-3",
              "cm-8",
              "cp-2",
              "cp-9",
              "cp-10",
              "ia-2",
              "ia-5",
              "ia-8",
              "ir-4",
              "ir-6",
              "ir-8",
              "mp-4",
              "mp-6",
              "pl-2",
              "pl-8",
              "pm-14",
              "ps-3",
              "ra-3",
              "ra-5",
              "sa-8",
              "sa-10",
              "sa-11",
              "sa-22",
              "sc-7",
              "sc-8",
              "sc-12",
              "sc-13",
              "sc-28",
              "sc-32",
              "si-2",
              "si-4",
              "si-7",
              "sr-3",
              "sr-4",
              "sr-10",
              "sr-11"
            ]
          }
        ]
      }
    ],
    "merge": {
      "as-is": true
    },
    "modify": {
      "alters": [
        {
          "control-id": "sc-13",
          "adds": [
            {
              "position": "ending",
              "parts": [
                {
                  "name": "guidance",
                  "prose": "Aegix implements SC-13 via the FIPS 140-3 approved-algorithm list in ADR 098 §1. Non-approved algorithms (MD5, SHA-1 signatures, DES/3DES, RC4, bcrypt/scrypt/argon2 for passwords, ChaCha20-Poly1305, Curve25519) are detected at commit time by the compliance-lint PreToolUse hook (AP-250) and at CI time by tools/semgrep/aegix-compliance.yml."
                }
              ]
            }
          ]
        },
        {
          "control-id": "ia-5",
          "adds": [
            {
              "position": "ending",
              "parts": [
                {
                  "name": "guidance",
                  "prose": "Aegix implements IA-5 via the three-tier credential lifecycle in ADR 098 §2: Tier 1 (eliminate via workload identity — WIF/IRSA/KMS), Tier 2 (automated Secrets Manager rotation — 30/90 day), Tier 3 (manual-with-policy — annual + event-driven, Secrets Manager tagged). Rotation cadence per tier resolves the NIST 800-53 Rev 5 IA-5(1)(d) rotation obligation."
                }
              ]
            }
          ]
        },
        {
          "control-id": "sr-3",
          "adds": [
            {
              "position": "ending",
              "parts": [
                {
                  "name": "guidance",
                  "prose": "Aegix implements SR-3/SR-4/SR-10/SR-11 (supply chain) via cosign keyless signing + CycloneDX SBOM on every Lambda and container artifact per ADR 099 Layer 4 (AP-265, AP-270). Sigstore transparency log provides tamper-evident build provenance."
                }
              ]
            }
          ]
        }
      ]
    },
    "back-matter": {
      "resources": [
        {
          "uuid": "e8f9c72a-4a6b-4f91-b2d3-9c8e7f1a5b42",
          "title": "ADR 091 — Isolated Service Standard",
          "description": "Module boundary rules. Primary owner of AC-4, SC-7, SC-32.",
          "rlinks": [
            { "href": "../../../adr/091-isolated-service-standard.md" }
          ]
        },
        {
          "uuid": "b1c3d5e7-9f0a-4b2c-8d4e-6f8a0b1c2d3e",
          "title": "ADR 094 — SOC 2 Over Legal Separation",
          "description": "Strategic posture. Primary owner of CA-2, CA-7.",
          "rlinks": [
            { "href": "../../../adr/094-soc2-over-legal-separation.md" }
          ]
        },
        {
          "uuid": "c2d4e6f8-a0b1-4c3d-9e5f-7a8b9c0d1e2f",
          "title": "ADR 098 — FIPS 140-3 Remediation + Credential Lifecycle",
          "description": "Primary owner of SC-12, SC-13, SC-28, IA-5, AC-6, AU-6.",
          "rlinks": [
            { "href": "../../../adr/098-fips-140-3-remediation.md" }
          ]
        },
        {
          "uuid": "d3e5f7a9-b1c2-4d4e-8f6a-0b1c2d3e4f5a",
          "title": "ADR 099 — Compliance Automation Architecture",
          "description": "Primary owner of CA-2, CA-7, CM-3, PM-14, SR-3, SR-4, SR-10, SR-11.",
          "rlinks": [
            { "href": "../../../adr/099-compliance-automation-architecture.md" }
          ]
        }
      ]
    }
  }
}