{ "assessment-results": { "uuid": "1a7e3147-e9f2-591a-9251-0e908d672b04", "metadata": { "title": "Aegix Tiaki Assessment Results \u2014 2026-07-25", "last-modified": "2026-07-25T00:00:00Z", "version": "2026-07-25", "oscal-version": "1.1.2", "remarks": "Continuous-monitoring assessment results for the 30-day window ending 2026-07-25. 44/52 reviewed controls satisfied. Control-implementation self-assessment (no runtime-evidence bucket provisioned yet; see AP-571). Auto-generated by tools/oscal/generate-assessment-results.py (AP-570)." }, "import-ap": { "href": "../assessment-plans/tiaki-assessment-plan.json" }, "results": [ { "uuid": "d539077f-e9b7-587e-b3f8-2d9c0ad93d17", "title": "Monthly continuous-monitoring result \u2014 2026-07-25", "description": "Assessment of the FedRAMP 20X Moderate control set against the Aegix Tiaki SSP over the 30-day window ending 2026-07-25.", "start": "2026-06-25T00:00:00Z", "end": "2026-07-25T00:00:00Z", "reviewed-controls": { "control-selections": [ { "include-controls": [ { "control-id": "ac-2" }, { "control-id": "ac-3" }, { "control-id": "ac-4" }, { "control-id": "ac-6" }, { "control-id": "ac-17" }, { "control-id": "ac-20" }, { "control-id": "au-2" }, { "control-id": "au-3" }, { "control-id": "au-6" }, { "control-id": "au-9" }, { "control-id": "au-11" }, { "control-id": "au-12" }, { "control-id": "ca-2" }, { "control-id": "ca-7" }, { "control-id": "ca-9" }, { "control-id": "cm-2" }, { "control-id": "cm-3" }, { "control-id": "cm-8" }, { "control-id": "cp-2" }, { "control-id": "cp-9" }, { "control-id": "cp-10" }, { "control-id": "ia-2" }, { "control-id": "ia-5" }, { "control-id": "ia-8" }, { "control-id": "ir-4" }, { "control-id": "ir-6" }, { "control-id": "ir-8" }, { "control-id": "mp-4" }, { "control-id": "mp-6" }, { "control-id": "pl-2" }, { "control-id": "pl-8" }, { "control-id": "pm-14" }, { "control-id": "ps-3" }, { "control-id": "ra-3" }, { "control-id": "ra-5" }, { "control-id": "sa-8" }, { "control-id": "sa-10" }, { "control-id": "sa-11" }, { "control-id": "sa-22" }, { "control-id": "sc-7" }, { "control-id": "sc-8" }, { "control-id": "sc-12" }, { "control-id": "sc-13" }, { "control-id": "sc-28" }, { "control-id": "sc-32" }, { "control-id": "si-2" }, { "control-id": "si-4" }, { "control-id": "si-7" }, { "control-id": "sr-3" }, { "control-id": "sr-4" }, { "control-id": "sr-10" }, { "control-id": "sr-11" } ] } ] }, "observations": [ { "uuid": "32a8b751-c4d5-5d86-8b82-d2a65bd583a8", "description": "Account lifecycle is managed via customer SSO/IdP with SCIM provisioning and deprovisioning; just-in-time provisioning maps IdP claims to roles under a least-privilege default-deny model (new users start with zero permissions). Account changes propagate immediately through the permissions_version JWT claim driving server-side cache invalidation (AAS-776); SCIM deprovisioning or an is_active/permission change invalidates active sessions. Periodic account-review automation is in progress (FedRAMP gap AC-2). [gap-assessment: Partial; owner: System Owner + Customer; evidence: SimpleJWT + customer SSO/IdP. JIT provisioning from IdP claims.; residual: Formal periodic account review cadence not automated \u2014 planned per ADR 099 L5 nightly evidence job.]", "methods": [ "EXAMINE" ], "collected": "2026-07-25T00:00:00Z", "subjects": [] }, { "uuid": "32547f75-4db5-509d-8e86-e1e2c4af662f", "description": "Access enforcement is implemented in Django via DRF permission classes + custom AlertType opt-in system per ADR 100. Safe-default resource reads require explicit admin opt-in (e.g., AlertType ?include_system=true gated by schools.change_alerttype). SimpleJWT with permissions_version claim drives JWT-level authorization (AAS-776). [gap-assessment: Implemented; owner: System Owner; evidence: DRF permission classes + ADR 100 safe-default read pattern. SSP \u00a7ac-3.; residual: \u2014]", "methods": [ "EXAMINE" ], "collected": "2026-07-25T00:00:00Z", "subjects": [] }, { "uuid": "7fa8aa43-684c-5394-ad49-a8904f840dcf", "description": "Information flow control between isolated zones (tiaki / tiaki-trust / tiaki-intel) is enforced per ADR 091 module boundaries, extended in ADR 099 \u00a73 with data-tier depConstraints in @nx/enforce-module-boundaries. Lower-tier Nx projects cannot import higher-tier types; enforced at lint time on every PR via tools/scripts/sync-tier-tags.mjs + ci-data-classification.yml (AP-259). [gap-assessment: Implemented; owner: Security Engineering; evidence: ADR 091 + ADR 099 \u00a73 tier depConstraints (AP-259). `@nx/enforce-module-boundaries` blocks cross-tier imports.; residual: \u2014]", "methods": [ "EXAMINE" ], "collected": "2026-07-25T00:00:00Z", "subjects": [] }, { "uuid": "3412bca5-d03b-5fc2-8b0d-e70f355ac7bf", "description": "Least privilege is implemented via ADR 098 \u00a72 three-tier credential lifecycle: Tier 1 eliminates standing credentials via workload identity (IRSA for Lambdas, K8s ServiceAccounts for Django pods). Tier 2 narrows Secrets Manager secrets to scoped IAM roles with automated rotation. AP-249 audit verified zero stale long-lived AWS_ACCESS_KEY_ID/SECRET pairs in active workflows (ABE-41, AAA-428 scheduled for deletion). [gap-assessment: Implemented; owner: Security Engineering; evidence: ADR 098 \u00a72 three-tier credentials. AP-249 verified no stale long-lived keys.; residual: \u2014]", "methods": [ "EXAMINE" ], "collected": "2026-07-25T00:00:00Z", "subjects": [] }, { "uuid": "cc0a36e7-40f8-50ce-9e0b-803ba49a00ff", "description": "Control AC-17 is in the FedRAMP 20X Moderate baseline but has no dedicated SSP implementation statement; assessed from the gap assessment. [gap-assessment: Inherited; owner: Platform Provider; evidence: DuploCloud VPN + bastion; Security Hub NIST.800-53.rev5 checks.; residual: \u2014]", "methods": [ "EXAMINE" ], "collected": "2026-07-25T00:00:00Z", "subjects": [] }, { "uuid": "5927ee34-cba7-5571-baeb-c21fdb6c5d84", "description": "External connections are governed by the FERPA school-official designation runbook (doc/compliance/runbooks/ferpa-school-official-designation.md). Customer contracts must include school-official language before Aegix accesses Education Records. Vendor/sub-processor DPAs tracked in doc/compliance/pia-register.md. [gap-assessment: Implemented; owner: Customer; evidence: [FERPA school-official designation runbook](runbooks/ferpa-school-official-designation.md). PIA register tracks sub-processor DPAs.; residual: \u2014]", "methods": [ "EXAMINE" ], "collected": "2026-07-25T00:00:00Z", "subjects": [] }, { "uuid": "01cb94cd-cc0c-5872-98c7-f1dd33dbb894", "description": "Event logging covers: (1) Sentry for application-level exceptions + performance traces; (2) CloudWatch Logs for Lambda + Django structured logs; (3) CloudTrail at platform level (DuploCloud-managed); (4) FERPA disclosure log per doc/compliance/runbooks/ferpa-disclosure-log.md. Retention per AU-11: 7 years on compliance-artifacts bucket (deployed \u2014 Object Lock COMPLIANCE, 7-year retention, AAS-1303 / ADR 099 Layer 5). [gap-assessment: Implemented; owner: System Owner; evidence: Sentry + CloudWatch + CloudTrail + FERPA disclosure log. SSP \u00a7au-2.; residual: \u2014]", "methods": [ "EXAMINE" ], "collected": "2026-07-25T00:00:00Z", "subjects": [] }, { "uuid": "7214b2d3-ddd6-5b59-8397-3dccb2a0a913", "description": "Control AU-3 is in the FedRAMP 20X Moderate baseline but has no dedicated SSP implementation statement; assessed from the gap assessment. [gap-assessment: Implemented; owner: System Owner; evidence: Django structured logging (ADR-020); shared Lambda structured logger `apps/aws/_shared/logger` (uniform JSON envelope) adopted across **all 29 service Lambdas** \u2014 incl. `compliance-evidence-collector` (AP-598) and the prod-deployed `api/authorizer` (AP-599; live function emits the schema). AP-596.; residual: \u2014]", "methods": [ "EXAMINE" ], "collected": "2026-07-25T00:00:00Z", "subjects": [] }, { "uuid": "53c8e8bb-80d2-52e3-8218-d3e45a8a107c", "description": "Audit review/analysis/reporting is automated (AAS-1305, was Partial). Two complementary surfaces feed a single Security Hub review console: (1) the ADR-099 Conformance Pack routes infrastructure/cloud-posture Config findings into Security Hub; (2) server.apps.audit_review (Celery beat, weekly) reviews the application-level audit trail \u2014 the four append-only Django models UserLoginActivity, PlatformLog, AlertLog, ReleaseLog \u2014 for anomalies (failed-login clusters per IP reusing the realtime 3+/10min alert + 10+ IP-block thresholds, outsized student-release volume by a single actor, and multi-guardian double-releases). Notable application-audit anomalies are pushed into Security Hub as ASFF custom findings via securityhub:BatchImportFindings (no parallel review console), and a weekly anomaly report is emailed to Security Engineering (AUDIT_REVIEW_REPORT_RECIPIENTS). Complements GuardDuty + the login-anomaly path rather than duplicating them. [gap-assessment: Implemented; owner: Security Engineering; evidence: `audit_review` automated-review app (scheduled queries + weekly anomaly report \u2192 AWS Security Hub) deployed and enforcing in prod (AAS-1302); GuardDuty + login-anomaly detection; Sentry triage.; residual: \u2014]", "methods": [ "EXAMINE" ], "collected": "2026-07-25T00:00:00Z", "subjects": [] }, { "uuid": "4a6697ff-58e8-58cb-82b1-85f44cfe27e5", "description": "Audit log integrity protected via CloudTrail \u2192 S3 with KMS SSE (inherited from DuploCloud platform). Write-once, tamper-resistant retention is implemented: the compliance-artifacts S3 bucket is deployed with Object Lock COMPLIANCE mode (AAS-1303, ADR 099 Layer 5), which prevents deletion or overwrite of anchored audit evidence by any principal \u2014 including root \u2014 for the duration of the retention period. Audit-evidence objects (Merkle roots per AU-10, retention evidence per AU-11) are thereby protected against modification at rest. [gap-assessment: Implemented; owner: System Owner; evidence: Compliance-artifacts S3 bucket with Object Lock COMPLIANCE mode (7-year) deployed and operating (AAS-1303); CloudTrail \u2192 S3 with KMS SSE + log-file validation; per-DB HMAC-SHA-256 hash-chain (ADR-125) deployed and enforcing.; residual: \u2014]", "methods": [ "EXAMINE" ], "collected": "2026-07-25T00:00:00Z", "subjects": [] }, { "uuid": "905be1ee-988d-5c71-8eb4-9f672a05b429", "description": "7-year retention on compliance evidence per IA-5(1)(h) + AU-11 is implemented. The compliance-artifacts S3 bucket is deployed (AAS-1303, ADR 099 Layer 5) with Object Lock COMPLIANCE mode and a 7-year (2557-day) default retention period, so anchored audit and compliance evidence is retained \u2014 and cannot be deleted or shortened \u2014 for the full retention window. The application-level audit trail is sourced from the four append-only Django models (UserLoginActivity, PlatformLog, AlertLog, ReleaseLog), whose periodic Merkle roots are anchored into this WORM bucket per AU-10. [gap-assessment: Implemented; owner: Security Engineering; evidence: 7-year write-once retention on the compliance-artifacts bucket (Object Lock COMPLIANCE mode) deployed and operating (AAS-1303); authentication logs additionally carry 12+ month Object Lock.; residual: \u2014]", "methods": [ "EXAMINE" ], "collected": "2026-07-25T00:00:00Z", "subjects": [] }, { "uuid": "f5b23012-d597-5461-9e2a-67b0a46a4b28", "description": "Control AU-12 is in the FedRAMP 20X Moderate baseline but has no dedicated SSP implementation statement; assessed from the gap assessment. [gap-assessment: Implemented; owner: System Owner; evidence: Django + Lambda + CloudTrail emit by default.; residual: \u2014]", "methods": [ "EXAMINE" ], "collected": "2026-07-25T00:00:00Z", "subjects": [] }, { "uuid": "7e646445-75c6-5dae-a747-d3d07677a05c", "description": "Control assessments driven by SOC 2 Type II per ADR 094 (zone-scoped boundary). ADR 099 Layer 4 OSCAL generation produces this SSP + monthly assessment-results. Semgrep (tools/semgrep/aegix-compliance.yml) + compliance-lint hook provide continuous source-code assessment. [gap-assessment: Implemented; owner: Security Engineering; evidence: SOC 2 Type II (ADR 094 zone boundary). This gap assessment. Semgrep continuous source assessment.; residual: \u2014]", "methods": [ "EXAMINE" ], "collected": "2026-07-25T00:00:00Z", "subjects": [] }, { "uuid": "d11d6494-cb52-527f-8d6f-f24c0f02428e", "description": "Continuous monitoring via the ADR 099 Layer 5 CloudWatch compliance-posture dashboard (infra/cloudwatch/dashboards/compliance-posture.json; the prior Steampipe+Grafana design was superseded by ADR-099-A). AWS-resource panels consume Security Hub findings (NIST 800-53r5, FSBP, FedRAMP, AWS Config managed + Aegix Conformance Pack custom rules). Monthly OSCAL assessment-results publication satisfies the FedRAMP 20X continuous-authorization cadence. [gap-assessment: Implemented; owner: Security Engineering; evidence: CloudWatch `tiaki-prod-compliance-posture` dashboard deployed (ADR-099-A); AWS Security Hub continuous NIST 800-53r5 conformance (99.3%) + Aegix Conformance Pack; nightly evidence collector + monthly OSCAL assessment-results publication (AP-570); GuardDuty.; residual: \u2014]", "methods": [ "EXAMINE" ], "collected": "2026-07-25T00:00:00Z", "subjects": [] }, { "uuid": "f80c101a-0000-5d79-a656-679967e0f73b", "description": "Control CA-9 is in the FedRAMP 20X Moderate baseline but has no dedicated SSP implementation statement; assessed from the gap assessment. [gap-assessment: Inherited; owner: Platform Provider; evidence: DuploCloud K8s network policies.; residual: \u2014]", "methods": [ "EXAMINE" ], "collected": "2026-07-25T00:00:00Z", "subjects": [] }, { "uuid": "29dfa840-f406-5fb6-9612-1281c3338931", "description": "Control CM-2 is in the FedRAMP 20X Moderate baseline but has no dedicated SSP implementation statement; assessed from the gap assessment. [gap-assessment: Implemented; owner: Security Engineering; evidence: ADRs + CLAUDE.md preambles (9 repos) are the baseline.; residual: \u2014]", "methods": [ "EXAMINE" ], "collected": "2026-07-25T00:00:00Z", "subjects": [] }, { "uuid": "8bbe2395-f2c3-51bd-bf2f-9a0e2053e1b8", "description": "Configuration change control enforced via: (1) ADRs for architectural decisions (doc/adr/); (2) PR-based merges with block-bad-git hook preventing squash/rebase; (3) Semgrep + compliance-lint at commit time; (4) ci-data-classification.yml gating every project.json change. [gap-assessment: Implemented; owner: Security Engineering; evidence: PR-based merges; block-bad-git hook; ADR process; compliance-lint. SSP \u00a7cm-3.; residual: \u2014]", "methods": [ "EXAMINE" ], "collected": "2026-07-25T00:00:00Z", "subjects": [] }, { "uuid": "af685649-8828-534a-8789-4dff87347399", "description": "Control CM-8 is in the FedRAMP 20X Moderate baseline but has no dedicated SSP implementation statement; assessed from the gap assessment. [gap-assessment: Implemented; owner: Security Engineering; evidence: project.json `dataClassification` across all 74 projects (tiaki+trust+intel). CycloneDX SBOM per artifact.; residual: \u2014]", "methods": [ "EXAMINE" ], "collected": "2026-07-25T00:00:00Z", "subjects": [] }, { "uuid": "c7ba00da-4867-5a4b-a968-d06f81ec32a6", "description": "Contingency plan documented in `doc/compliance/policies/customer-portal/bcdr-plan.md`. Quantified targets: RTO = 4 hours for critical services (alert dispatch, messaging, check-in, reporting); RPO = 1 hour. Four-phase recovery sequencing ensures the safety-critical alerting path is restored first, non-critical reporting last. Plan is reviewed annually and tested semi-annually; test results logged to the compliance-artifacts bucket (deployed \u2014 Object Lock COMPLIANCE, AAS-1303 / ADR 099 Layer 5). Roles + responsibilities assigned to Platform Engineering on-call + Security on-call. [gap-assessment: Implemented; owner: Platform Engineering + Security Engineering; evidence: [`policies/customer-portal/bcdr-plan.md`](policies/customer-portal/bcdr-plan.md). Quantified RTO=4h / RPO=1h; 4-phase recovery sequence. SSP \u00a7cp-2.; residual: \u2014]", "methods": [ "EXAMINE" ], "collected": "2026-07-25T00:00:00Z", "subjects": [] }, { "uuid": "5d9b1983-58b0-5c1f-a7eb-e34d33aaca78", "description": "System backup: RDS PostgreSQL automated point-in-time recovery (7-day retention for daily snapshots, 35-day for continuous transaction logs) via DuploCloud-managed RDS. DynamoDB point-in-time recovery enabled on student-record tables + FERPA disclosure log + notification-delivery records. S3 versioning enabled on media and audit buckets. Cross-region replication on audit bucket to us-west-2 for regional isolation. All backup storage KMS-encrypted with customer-managed keys. Backup restoration tested quarterly; results logged. [gap-assessment: Implemented; owner: Platform Engineering; evidence: RDS PITR (7d snapshots + 35d transaction logs), DynamoDB PITR, S3 versioning + cross-region replication, KMS-CMK encryption. SSP \u00a7cp-9.; residual: \u2014]", "methods": [ "EXAMINE" ], "collected": "2026-07-25T00:00:00Z", "subjects": [] }, { "uuid": "c3f6faef-3268-5e84-be07-19618a636f3a", "description": "System recovery: EKS workloads restart automatically via Kubernetes restart policies + DuploCloud-managed replica sets. Django backend achieves zero-downtime rolling restart per ADR 037; WebSocket drain via ShutdownCoordinator (close code 4010) preserves client connections per ADR 049. Region-failover procedure in bcdr-plan.md \u00a75: primary region us-east-1; failover to us-west-2 within RTO target. Quarterly failover drill recorded; most-recent-drill date surfaced on CloudWatch compliance-posture dashboard (Layer 5, deployed per ADR-099-A). [gap-assessment: Implemented; owner: Platform Engineering; evidence: ADR 037 zero-downtime rolling restart + ADR 049 WebSocket ShutdownCoordinator (close 4010); region-failover procedure in bcdr-plan.md \u00a75. SSP \u00a7cp-10.; residual: Quarterly failover drill + compliance-dashboard integration depends on Layer 5 deployment.]", "methods": [ "EXAMINE" ], "collected": "2026-07-25T00:00:00Z", "subjects": [] }, { "uuid": "d9bb1a7a-d433-5070-8a5f-1c6fe35afe7d", "description": "Staff identification + authentication via SimpleJWT (AAS-776). SSO via OAuth/OIDC with customer IdPs. MFA enforced at IdP level for privileged roles. JWT includes permissions_version claim driving server-side permission revalidation. [gap-assessment: Implemented; owner: System Owner; evidence: SimpleJWT + OAuth/OIDC SSO. SSP \u00a7ia-2.; residual: \u2014]", "methods": [ "EXAMINE" ], "collected": "2026-07-25T00:00:00Z", "subjects": [] }, { "uuid": "79e1bedb-9c46-5c92-972f-f5c03e58d00b", "description": "Authenticator management per ADR 098 \u00a72 three-tier credential lifecycle. Tier 1: eliminate via WIF/IRSA/KMS. Tier 2: automated Secrets Manager rotation (30/90 day). Tier 3: manual-with-policy (annual + event-driven, Secrets Manager tagged). Passwords (when used) hashed with PBKDF2 per ADR 098 \u00a71 approved list \u2014 bcrypt/scrypt/argon2 explicitly disallowed. [gap-assessment: Implemented; owner: Security Engineering; evidence: ADR 098 \u00a72 three-tier credential lifecycle. PBKDF2 passwords (not bcrypt/scrypt/argon2). SSP \u00a7ia-5.; residual: \u2014]", "methods": [ "EXAMINE" ], "collected": "2026-07-25T00:00:00Z", "subjects": [] }, { "uuid": "9746cb06-2272-5c9b-9b76-07a831e445a6", "description": "Control IA-8 is in the FedRAMP 20X Moderate baseline but has no dedicated SSP implementation statement; assessed from the gap assessment. [gap-assessment: Partial; owner: Customer; evidence: School-official designation scopes; customer IdP handles most.; residual: Explicit guest-user control needs doc pointer.]", "methods": [ "EXAMINE" ], "collected": "2026-07-25T00:00:00Z", "subjects": [] }, { "uuid": "7a98cfa8-491e-5186-a9d4-e8110771146a", "description": "Incident handling procedure in doc/compliance/runbooks/privacy-incident.md. Covers detection, containment, regulatory notification (FERPA + state privacy laws per doc/compliance/state-privacy-deltas.md), customer notification, post-incident review. Severity escalation per on-call runbook. [gap-assessment: Implemented; owner: Security Engineering; evidence: [runbooks/privacy-incident.md](runbooks/privacy-incident.md).; residual: \u2014]", "methods": [ "EXAMINE" ], "collected": "2026-07-25T00:00:00Z", "subjects": [] }, { "uuid": "cc744c91-3063-569a-b63b-6218c02312a2", "description": "Control IR-6 is in the FedRAMP 20X Moderate baseline but has no dedicated SSP implementation statement; assessed from the gap assessment. [gap-assessment: Implemented; owner: Security Engineering; evidence: State + federal notification matrix in privacy-incident.md + state-privacy-deltas.md.; residual: \u2014]", "methods": [ "EXAMINE" ], "collected": "2026-07-25T00:00:00Z", "subjects": [] }, { "uuid": "64293aad-54e1-5e6a-871b-824d6dc6bf03", "description": "Control IR-8 is in the FedRAMP 20X Moderate baseline but has no dedicated SSP implementation statement; assessed from the gap assessment. [gap-assessment: Implemented; owner: Security Engineering; evidence: privacy-incident.md.; residual: \u2014]", "methods": [ "EXAMINE" ], "collected": "2026-07-25T00:00:00Z", "subjects": [] }, { "uuid": "b41cf51e-219b-5398-aa6c-defb124902f9", "description": "Media storage at rest encrypted with KMS-managed keys (SSE on all S3 buckets, RDS, DynamoDB). S3 ServerSideEncryption enforced in provider Lambdas (e.g., apps/aws/service/provider/cleartouch-announce). Approved algorithm set per ADR 098 \u00a71 (AES-GCM/CBC/CTR, SHA-2, RSA \u22652048). [gap-assessment: Implemented; owner: Platform Provider; evidence: KMS SSE on all stores. Approved algorithms per ADR 098 \u00a71. SSP \u00a7mp-4.; residual: \u2014]", "methods": [ "EXAMINE" ], "collected": "2026-07-25T00:00:00Z", "subjects": [] }, { "uuid": "e613c547-3613-57f8-a3d1-e24e29bdab29", "description": "Control MP-6 is in the FedRAMP 20X Moderate baseline but has no dedicated SSP implementation statement; assessed from the gap assessment. [gap-assessment: Inherited; owner: Platform Provider; evidence: AWS standard: EBS + EFS cryptographic erase via KMS key deletion.; residual: \u2014]", "methods": [ "EXAMINE" ], "collected": "2026-07-25T00:00:00Z", "subjects": [] }, { "uuid": "23978aa4-65df-5671-bb39-21698e51ae9f", "description": "Control PL-2 is in the FedRAMP 20X Moderate baseline but has no dedicated SSP implementation statement; assessed from the gap assessment. [gap-assessment: Implemented; owner: Security Engineering; evidence: This SSP (AP-276).; residual: \u2014]", "methods": [ "EXAMINE" ], "collected": "2026-07-25T00:00:00Z", "subjects": [] }, { "uuid": "969e46e8-af73-59b3-8e69-83a273411454", "description": "Control PL-8 is in the FedRAMP 20X Moderate baseline but has no dedicated SSP implementation statement; assessed from the gap assessment. [gap-assessment: Implemented; owner: Security Engineering; evidence: ADRs 091, 094, 098, 099 + compliance-stack-layers.md.; residual: \u2014]", "methods": [ "EXAMINE" ], "collected": "2026-07-25T00:00:00Z", "subjects": [] }, { "uuid": "2d505bb4-c48a-5b04-8f1c-75284e723fc8", "description": "Testing, training, monitoring of security controls centralized in ADR 099 (this system). Layer 1 CLAUDE.md preambles (9 repos) ensure every engineer inherits compliance context. Layer 2 hooks (compliance-lint, block-bad-commands, prompt-context, session-edit-recorder) enforce at commit time. Layer 3 skills (compliance-review, secret-lifecycle, crypto-review, data-classification, oscal-export, privacy-review) provide operational procedures. Layer 4 CI (Semgrep, cosign, SBOM, Conformance Pack). Layer 5 CloudWatch compliance-posture dashboard + monthly OSCAL publication. [gap-assessment: Implemented; owner: Security Engineering; evidence: ADR 099 all layers. SSP \u00a7pm-14.; residual: \u2014]", "methods": [ "EXAMINE" ], "collected": "2026-07-25T00:00:00Z", "subjects": [] }, { "uuid": "e3448e7e-fbd0-55fb-942d-4b8086cc88ea", "description": "Control PS-3 is in the FedRAMP 20X Moderate baseline but has no dedicated SSP implementation statement; assessed from the gap assessment. [gap-assessment: Outside Scope; owner: HR; evidence: Outside this repo's authorization boundary.; residual: Documented at HR layer.]", "methods": [ "EXAMINE" ], "collected": "2026-07-25T00:00:00Z", "subjects": [] }, { "uuid": "7077c4cc-f883-5d5b-a47c-66675ee9328f", "description": "Control RA-3 is in the FedRAMP 20X Moderate baseline but has no dedicated SSP implementation statement; assessed from the gap assessment. [gap-assessment: Partial; owner: Security Engineering; evidence: PIA register + ADRs.; residual: Formal annual risk assessment cadence documented but not executed for current year.]", "methods": [ "EXAMINE" ], "collected": "2026-07-25T00:00:00Z", "subjects": [] }, { "uuid": "cb327aa6-b447-5200-92ae-2fb1d0d41c14", "description": "Continuous vulnerability monitoring runs across the SDLC (ADR 099 Layer 4): GitHub Dependabot (dependency CVEs), AWS Inspector (runtime/container/host CVEs), and Semgrep + CodeQL SAST on every pull request. Findings aggregate into AWS Security Hub against the NIST 800-53 r5 standard. Remediation is tracked via SI-2 flaw-remediation (Dependabot auto-PRs + the ADR-098/099 classifier gate). [gap-assessment: Implemented; owner: Security Engineering; evidence: Dependabot + AWS Inspector + Security Hub + Semgrep.; residual: \u2014]", "methods": [ "EXAMINE" ], "collected": "2026-07-25T00:00:00Z", "subjects": [] }, { "uuid": "6ef7b3d7-ef9b-5f76-9b36-e7ea49408ac8", "description": "Security + privacy engineering principles codified in ADR 091 (isolated service standard), ADR 098 (FIPS + credential tiers), ADR 099 \u00a73 (5-tier data taxonomy). Every new project.json requires dataClassification per tools/scripts/check-data-classification.mjs. [gap-assessment: Implemented; owner: Security Engineering; evidence: ADR 091 + ADR 098 + ADR 099 \u00a73. SSP \u00a7sa-8.; residual: \u2014]", "methods": [ "EXAMINE" ], "collected": "2026-07-25T00:00:00Z", "subjects": [] }, { "uuid": "26407ec6-0435-5a1d-b6fb-9db0e498d5f2", "description": "Control SA-10 is in the FedRAMP 20X Moderate baseline but has no dedicated SSP implementation statement; assessed from the gap assessment. [gap-assessment: Implemented; owner: Security Engineering; evidence: Git + PR process + ADR process.; residual: \u2014]", "methods": [ "EXAMINE" ], "collected": "2026-07-25T00:00:00Z", "subjects": [] }, { "uuid": "36fdb18c-95c9-5196-8220-7188e6b80ca2", "description": "Developer testing: Semgrep (12 rules, NIST control citations) at CI time via ci-compliance-semgrep.yml. ERROR-level rules block merge; WARNING-level surface in SARIF upload to GitHub code scanning. Complements existing unit/integration/E2E suites. [gap-assessment: Implemented; owner: Security Engineering; evidence: Semgrep (AP-269) + unit/integration/E2E. SSP \u00a7sa-11.; residual: \u2014]", "methods": [ "EXAMINE" ], "collected": "2026-07-25T00:00:00Z", "subjects": [] }, { "uuid": "2a61de36-b500-5bc5-b45b-8b578c9a3ff9", "description": "Control SA-22 is in the FedRAMP 20X Moderate baseline but has no dedicated SSP implementation statement; assessed from the gap assessment. [gap-assessment: Partial; owner: Security Engineering; evidence: DIRS is EOL (read-only reference). Dependabot surfaces outdated deps.; residual: EOL inventory needs explicit register (future ticket).]", "methods": [ "EXAMINE" ], "collected": "2026-07-25T00:00:00Z", "subjects": [] }, { "uuid": "dabaea82-63b4-5524-ac94-d8155c9a1acc", "description": "Boundary protection: DuploCloud-managed ALBs with TLS 1.2+ enforcement. WAF rules at ingress. Isolated service standard per ADR 091 segregates tiaki / tiaki-trust / tiaki-intel at both network and module-boundary layers. Security Hub surfaces boundary-check findings via NIST 800-53r5 + AWS FSBP managed rules. [gap-assessment: Inherited; owner: Platform Provider; evidence: DuploCloud ALB + WAF + ADR 091 zones. Security Hub boundary checks. SSP \u00a7sc-7.; residual: \u2014]", "methods": [ "EXAMINE" ], "collected": "2026-07-25T00:00:00Z", "subjects": [] }, { "uuid": "7e29c455-772e-5d20-9866-e16983b6b3d9", "description": "Transmission confidentiality + integrity via TLS 1.2+ on all HTTP(S) + WebSocket endpoints per ADR 098 \u00a71. rejectUnauthorized:false, verify_ssl=0, CERT_NONE, NSAllowsArbitraryLoads, cleartextTrafficPermitted='true' explicitly disallowed. Enforced at commit time by compliance-lint hook + at CI time by tools/semgrep/aegix-compliance.yml. Redis connections use TLS via server/settings.py rediss:// scheme. [gap-assessment: Implemented; owner: Security Engineering; evidence: TLS 1.2+ enforced. ADR 098 \u00a71. SSP \u00a7sc-8.; residual: \u2014]", "methods": [ "EXAMINE" ], "collected": "2026-07-25T00:00:00Z", "subjects": [] }, { "uuid": "e991334e-3f05-5193-a6fc-3187273ccb0e", "description": "Cryptographic key establishment + management via AWS KMS (FIPS 140-3 Level 3 HSMs). Automatic annual rotation on customer-managed keys. Key usage audited via CloudTrail. AWS_USE_FIPS_ENDPOINT=true enforced on all Lambdas + Django via env var injection in .docker/Dockerfile.base + _deploy-lambda-template.yml + _deploy-python-lambda-template.yml. [gap-assessment: Implemented; owner: Security Engineering; evidence: AWS KMS FIPS 140-3 L3 HSMs. AWS_USE_FIPS_ENDPOINT=true everywhere. SSP \u00a7sc-12.; residual: \u2014]", "methods": [ "EXAMINE" ], "collected": "2026-07-25T00:00:00Z", "subjects": [] }, { "uuid": "5cccc144-34dc-54e7-97fb-aa97ab1c74c1", "description": "Cryptographic protection via FIPS 140-3 approved algorithm list per ADR 098 \u00a71. Approved: AES-GCM/CBC/CTR, SHA-2/SHA-3, HMAC-SHA-2, RSA \u22652048 with PSS/OAEP, ECDSA P-256/384/521, Ed25519, PBKDF2/HKDF. Disallowed: MD5, SHA-1 signatures, DES/3DES, RC4, bcrypt/scrypt/argon2 for passwords, ChaCha20-Poly1305, Curve25519 X25519. Enforced by compliance-lint hook (AP-250) + Semgrep (AP-269). [gap-assessment: Implemented; owner: Security Engineering; evidence: ADR 098 \u00a71 approved list. compliance-lint + Semgrep. SSP \u00a7sc-13.; residual: \u2014]", "methods": [ "EXAMINE" ], "collected": "2026-07-25T00:00:00Z", "subjects": [] }, { "uuid": "7708530f-4e93-5fee-8d37-3fe0c7b3d945", "description": "Protection of information at rest via KMS-managed SSE on S3 + RDS + DynamoDB + EBS. Approved algorithms only per ADR 098 \u00a71. Conformance Pack rule `s3-bucket-aegix-kms-encrypted` enforces customer-managed KMS on Restricted-tier buckets. [gap-assessment: Implemented; owner: Security Engineering; evidence: KMS SSE + Conformance Pack `s3-bucket-aegix-kms-encrypted` rule. SSP \u00a7sc-28.; residual: \u2014]", "methods": [ "EXAMINE" ], "collected": "2026-07-25T00:00:00Z", "subjects": [] }, { "uuid": "1c4f788d-8d96-5f14-b829-68311dafc363", "description": "System partitioning via ADR 091 isolated-zone model (tiaki / tiaki-trust / tiaki-intel). Data-tier taxonomy per ADR 099 \u00a73 ensures Restricted-Student-Record-PII does not flow into Confidential or Internal zones. Enforced at build time via @nx/enforce-module-boundaries tier depConstraints. [gap-assessment: Implemented; owner: Security Engineering; evidence: ADR 091 zones + ADR 099 \u00a73 tier taxonomy + ESLint tier depConstraints. SSP \u00a7sc-32.; residual: \u2014]", "methods": [ "EXAMINE" ], "collected": "2026-07-25T00:00:00Z", "subjects": [] }, { "uuid": "5f28d7f6-db4c-57f5-81d3-982f2c575f60", "description": "Flaw remediation: Dependabot for npm + Python packages. AWS Inspector for Lambda runtime + container image scanning (surfaced via Security Hub). Sentry for runtime exception triage. Dependabot compliance-lens auto-triage is ADR 099 L4 open item. [gap-assessment: Implemented; owner: Security Engineering; evidence: Dependabot (`.github/dependabot.yml`) + AWS Inspector + Semgrep SAST (`ci-compliance-semgrep.yml`) + Sentry; the ADR-098/099 \"Classify Dependabot PR\" workflow auto-triages dependency PRs. SSP \u00a7si-2.; residual: \u2014]", "methods": [ "EXAMINE" ], "collected": "2026-07-25T00:00:00Z", "subjects": [] }, { "uuid": "155d56e5-9cf6-51ec-a181-052c629235c2", "description": "Control SI-4 is in the FedRAMP 20X Moderate baseline but has no dedicated SSP implementation statement; assessed from the gap assessment. [gap-assessment: Partial; owner: Platform Provider + Security Engineering; evidence: CloudWatch + Sentry + GuardDuty.; residual: Unified SIEM beyond Security Hub pending L5 deployment.]", "methods": [ "EXAMINE" ], "collected": "2026-07-25T00:00:00Z", "subjects": [] }, { "uuid": "16cea5a3-b6f6-5bef-90a2-1f9e9b2e7aac", "description": "Control SI-7 is in the FedRAMP 20X Moderate baseline but has no dedicated SSP implementation statement; assessed from the gap assessment. [gap-assessment: Implemented; owner: Security Engineering; evidence: cosign keyless signing + CycloneDX SBOMs per artifact.; residual: \u2014]", "methods": [ "EXAMINE" ], "collected": "2026-07-25T00:00:00Z", "subjects": [] }, { "uuid": "680a7f9f-a8d7-559f-beda-f56c51b3a710", "description": "Supply chain controls: cosign keyless signing (Sigstore) on every Lambda zip + every backend container image per AP-265 (_deploy-lambda-template.yml, _deploy-python-lambda-template.yml) and AP-270 (deploy-services-python-tiaki.yml). CycloneDX SBOMs generated per artifact (@cyclonedx/cdxgen for Node, cyclonedx-py for Python, syft for containers). Tamper-evident provenance via the Sigstore transparency log. [gap-assessment: Implemented; owner: Security Engineering; evidence: cosign + SBOM on Lambdas (AP-265) + containers (AP-270). SSP \u00a7sr-3.; residual: \u2014]", "methods": [ "EXAMINE" ], "collected": "2026-07-25T00:00:00Z", "subjects": [] }, { "uuid": "0edb0208-5915-5e3b-a2c2-fd01d2cf2684", "description": "Control SR-4 is in the FedRAMP 20X Moderate baseline but has no dedicated SSP implementation statement; assessed from the gap assessment. [gap-assessment: Implemented; owner: Security Engineering; evidence: Sigstore transparency log per build.; residual: \u2014]", "methods": [ "EXAMINE" ], "collected": "2026-07-25T00:00:00Z", "subjects": [] }, { "uuid": "4d11bbf9-4db8-5f9a-9f78-92c9502dd40f", "description": "Every backend deploy generates a CycloneDX SBOM and signs it with cosign (AP-270); Lambda artifacts are signed with SBOMs generated per build (AP-265). Cross-deploy SBOM comparison is not yet implemented: a per-release SBOM diff on prod promotion, with the diff stored beside the release bundle, is planned under AP-755 (AP-762 / AP-767). [gap-assessment: Partial; owner: Security Engineering; evidence: CycloneDX SBOM generated and cosign-signed per backend deploy (AP-270); no cross-deploy SBOM comparison exists yet. SSP \u00a7sr-10.; residual: Cross-deploy SBOM diff on prod promotion, stored per release, once the per-release bundle lands (AP-755 / AP-762 / AP-767).]", "methods": [ "EXAMINE" ], "collected": "2026-07-25T00:00:00Z", "subjects": [] }, { "uuid": "e7cae450-5e37-5157-b632-00f76078fbbd", "description": "Control SR-11 is in the FedRAMP 20X Moderate baseline but has no dedicated SSP implementation statement; assessed from the gap assessment. [gap-assessment: Partial; owner: Security Engineering; evidence: cosign keyless signing on every Lambda zip + backend container image (AP-265, AP-270); no pipeline or consumer performs signature verification yet.; residual: Pipeline-side `cosign verify` on deploy, then end-to-end `cosign verify-blob` in consumers (mobile, Beacon updater).]", "methods": [ "EXAMINE" ], "collected": "2026-07-25T00:00:00Z", "subjects": [] } ], "findings": [ { "uuid": "0e8e8562-a156-5f75-a5e6-2503a4b106ce", "title": "AC-2 \u2014 Partial", "description": "Control partially implemented; residual tracked in the gap assessment.", "target": { "type": "objective-id", "target-id": "ac-2_obj", "status": { "state": "not-satisfied", "reason": "fail", "remarks": "Partial \u2014 Control partially implemented; residual tracked in the gap assessment." } }, "related-observations": [ { "observation-uuid": "32a8b751-c4d5-5d86-8b82-d2a65bd583a8" } ] }, { "uuid": "fc5cb002-5074-5579-9b1d-cca80ed59fb8", "title": "AC-3 \u2014 Implemented", "description": "Control implemented and evidenced in the SSP.", "target": { "type": "objective-id", "target-id": "ac-3_obj", "status": { "state": "satisfied", "reason": "pass", "remarks": "Implemented \u2014 Control implemented and evidenced in the SSP." } }, "related-observations": [ { "observation-uuid": "32547f75-4db5-509d-8e86-e1e2c4af662f" } ] }, { "uuid": "1c419d68-aa25-53f9-9b13-0e50ee799e66", "title": "AC-4 \u2014 Implemented", "description": "Control implemented and evidenced in the SSP.", "target": { "type": "objective-id", "target-id": "ac-4_obj", "status": { "state": "satisfied", "reason": "pass", "remarks": "Implemented \u2014 Control implemented and evidenced in the SSP." } }, "related-observations": [ { "observation-uuid": "7fa8aa43-684c-5394-ad49-a8904f840dcf" } ] }, { "uuid": "9dc3aa98-8ad1-592d-8c3e-e3bf9ae33629", "title": "AC-6 \u2014 Implemented", "description": "Control implemented and evidenced in the SSP.", "target": { "type": "objective-id", "target-id": "ac-6_obj", "status": { "state": "satisfied", "reason": "pass", "remarks": "Implemented \u2014 Control implemented and evidenced in the SSP." } }, "related-observations": [ { "observation-uuid": "3412bca5-d03b-5fc2-8b0d-e70f355ac7bf" } ] }, { "uuid": "f561c503-8633-5c58-ad5d-c8ab23314d83", "title": "AC-17 \u2014 Inherited", "description": "Control inherited from the platform provider (DuploCloud / AWS Security Hub).", "target": { "type": "objective-id", "target-id": "ac-17_obj", "status": { "state": "satisfied", "reason": "pass", "remarks": "Inherited \u2014 Control inherited from the platform provider (DuploCloud / AWS Security Hub)." } }, "related-observations": [ { "observation-uuid": "cc0a36e7-40f8-50ce-9e0b-803ba49a00ff" } ] }, { "uuid": "1936cb0d-2177-50df-b692-57b3a730567b", "title": "AC-20 \u2014 Implemented", "description": "Control implemented and evidenced in the SSP.", "target": { "type": "objective-id", "target-id": "ac-20_obj", "status": { "state": "satisfied", "reason": "pass", "remarks": "Implemented \u2014 Control implemented and evidenced in the SSP." } }, "related-observations": [ { "observation-uuid": "5927ee34-cba7-5571-baeb-c21fdb6c5d84" } ] }, { "uuid": "71321a42-8142-58c5-bfc6-d20989f5f8a0", "title": "AU-2 \u2014 Implemented", "description": "Control implemented and evidenced in the SSP.", "target": { "type": "objective-id", "target-id": "au-2_obj", "status": { "state": "satisfied", "reason": "pass", "remarks": "Implemented \u2014 Control implemented and evidenced in the SSP." } }, "related-observations": [ { "observation-uuid": "01cb94cd-cc0c-5872-98c7-f1dd33dbb894" } ] }, { "uuid": "7137c316-df6f-59d8-bcab-a1c4b3f17403", "title": "AU-3 \u2014 Implemented", "description": "Control implemented and evidenced in the SSP.", "target": { "type": "objective-id", "target-id": "au-3_obj", "status": { "state": "satisfied", "reason": "pass", "remarks": "Implemented \u2014 Control implemented and evidenced in the SSP." } }, "related-observations": [ { "observation-uuid": "7214b2d3-ddd6-5b59-8397-3dccb2a0a913" } ] }, { "uuid": "2c781a02-c4f7-5d37-857a-9ea66ac209ce", "title": "AU-6 \u2014 Implemented", "description": "Control implemented and evidenced in the SSP.", "target": { "type": "objective-id", "target-id": "au-6_obj", "status": { "state": "satisfied", "reason": "pass", "remarks": "Implemented \u2014 Control implemented and evidenced in the SSP." } }, "related-observations": [ { "observation-uuid": "53c8e8bb-80d2-52e3-8218-d3e45a8a107c" } ] }, { "uuid": "04e3de75-61e1-5d61-8934-9620d025821c", "title": "AU-9 \u2014 Implemented", "description": "Control implemented and evidenced in the SSP.", "target": { "type": "objective-id", "target-id": "au-9_obj", "status": { "state": "satisfied", "reason": "pass", "remarks": "Implemented \u2014 Control implemented and evidenced in the SSP." } }, "related-observations": [ { "observation-uuid": "4a6697ff-58e8-58cb-82b1-85f44cfe27e5" } ] }, { "uuid": "01f59761-db48-5472-a75b-afd3f2543074", "title": "AU-11 \u2014 Implemented", "description": "Control implemented and evidenced in the SSP.", "target": { "type": "objective-id", "target-id": "au-11_obj", "status": { "state": "satisfied", "reason": "pass", "remarks": "Implemented \u2014 Control implemented and evidenced in the SSP." } }, "related-observations": [ { "observation-uuid": "905be1ee-988d-5c71-8eb4-9f672a05b429" } ] }, { "uuid": "cc99357f-5ac0-553d-a44b-61405b27bc50", "title": "AU-12 \u2014 Implemented", "description": "Control implemented and evidenced in the SSP.", "target": { "type": "objective-id", "target-id": "au-12_obj", "status": { "state": "satisfied", "reason": "pass", "remarks": "Implemented \u2014 Control implemented and evidenced in the SSP." } }, "related-observations": [ { "observation-uuid": "f5b23012-d597-5461-9e2a-67b0a46a4b28" } ] }, { "uuid": "43d8255b-a69d-5de3-a9e2-48e83f04cdb6", "title": "CA-2 \u2014 Implemented", "description": "Control implemented and evidenced in the SSP.", "target": { "type": "objective-id", "target-id": "ca-2_obj", "status": { "state": "satisfied", "reason": "pass", "remarks": "Implemented \u2014 Control implemented and evidenced in the SSP." } }, "related-observations": [ { "observation-uuid": "7e646445-75c6-5dae-a747-d3d07677a05c" } ] }, { "uuid": "7a3791fe-ceee-5641-93f9-4b2175300aef", "title": "CA-7 \u2014 Implemented", "description": "Control implemented and evidenced in the SSP.", "target": { "type": "objective-id", "target-id": "ca-7_obj", "status": { "state": "satisfied", "reason": "pass", "remarks": "Implemented \u2014 Control implemented and evidenced in the SSP." } }, "related-observations": [ { "observation-uuid": "d11d6494-cb52-527f-8d6f-f24c0f02428e" } ] }, { "uuid": "c0cf86b9-72f1-5fdc-945a-cbcb676cfbc4", "title": "CA-9 \u2014 Inherited", "description": "Control inherited from the platform provider (DuploCloud / AWS Security Hub).", "target": { "type": "objective-id", "target-id": "ca-9_obj", "status": { "state": "satisfied", "reason": "pass", "remarks": "Inherited \u2014 Control inherited from the platform provider (DuploCloud / AWS Security Hub)." } }, "related-observations": [ { "observation-uuid": "f80c101a-0000-5d79-a656-679967e0f73b" } ] }, { "uuid": "a458a077-c2d2-5fec-a451-0163920b044d", "title": "CM-2 \u2014 Implemented", "description": "Control implemented and evidenced in the SSP.", "target": { "type": "objective-id", "target-id": "cm-2_obj", "status": { "state": "satisfied", "reason": "pass", "remarks": "Implemented \u2014 Control implemented and evidenced in the SSP." } }, "related-observations": [ { "observation-uuid": "29dfa840-f406-5fb6-9612-1281c3338931" } ] }, { "uuid": "9dd02c70-ce4b-5647-9f09-4fb523370d91", "title": "CM-3 \u2014 Implemented", "description": "Control implemented and evidenced in the SSP.", "target": { "type": "objective-id", "target-id": "cm-3_obj", "status": { "state": "satisfied", "reason": "pass", "remarks": "Implemented \u2014 Control implemented and evidenced in the SSP." } }, "related-observations": [ { "observation-uuid": "8bbe2395-f2c3-51bd-bf2f-9a0e2053e1b8" } ] }, { "uuid": "51a57cbe-41c9-59ba-ba6f-589973063f46", "title": "CM-8 \u2014 Implemented", "description": "Control implemented and evidenced in the SSP.", "target": { "type": "objective-id", "target-id": "cm-8_obj", "status": { "state": "satisfied", "reason": "pass", "remarks": "Implemented \u2014 Control implemented and evidenced in the SSP." } }, "related-observations": [ { "observation-uuid": "af685649-8828-534a-8789-4dff87347399" } ] }, { "uuid": "1a8ed07a-4d37-5e10-ab16-717ffd245a24", "title": "CP-2 \u2014 Implemented", "description": "Control implemented and evidenced in the SSP.", "target": { "type": "objective-id", "target-id": "cp-2_obj", "status": { "state": "satisfied", "reason": "pass", "remarks": "Implemented \u2014 Control implemented and evidenced in the SSP." } }, "related-observations": [ { "observation-uuid": "c7ba00da-4867-5a4b-a968-d06f81ec32a6" } ] }, { "uuid": "963b34d9-e93c-5a7d-adc4-2d060d5742ad", "title": "CP-9 \u2014 Implemented", "description": "Control implemented and evidenced in the SSP.", "target": { "type": "objective-id", "target-id": "cp-9_obj", "status": { "state": "satisfied", "reason": "pass", "remarks": "Implemented \u2014 Control implemented and evidenced in the SSP." } }, "related-observations": [ { "observation-uuid": "5d9b1983-58b0-5c1f-a7eb-e34d33aaca78" } ] }, { "uuid": "1b627529-f861-51a9-bd61-ed6f3cba3743", "title": "CP-10 \u2014 Implemented", "description": "Control implemented and evidenced in the SSP.", "target": { "type": "objective-id", "target-id": "cp-10_obj", "status": { "state": "satisfied", "reason": "pass", "remarks": "Implemented \u2014 Control implemented and evidenced in the SSP." } }, "related-observations": [ { "observation-uuid": "c3f6faef-3268-5e84-be07-19618a636f3a" } ] }, { "uuid": "809d2431-306c-5feb-ac7c-e89e25da180b", "title": "IA-2 \u2014 Implemented", "description": "Control implemented and evidenced in the SSP.", "target": { "type": "objective-id", "target-id": "ia-2_obj", "status": { "state": "satisfied", "reason": "pass", "remarks": "Implemented \u2014 Control implemented and evidenced in the SSP." } }, "related-observations": [ { "observation-uuid": "d9bb1a7a-d433-5070-8a5f-1c6fe35afe7d" } ] }, { "uuid": "77485157-7ece-518b-aaa8-2796baea795a", "title": "IA-5 \u2014 Implemented", "description": "Control implemented and evidenced in the SSP.", "target": { "type": "objective-id", "target-id": "ia-5_obj", "status": { "state": "satisfied", "reason": "pass", "remarks": "Implemented \u2014 Control implemented and evidenced in the SSP." } }, "related-observations": [ { "observation-uuid": "79e1bedb-9c46-5c92-972f-f5c03e58d00b" } ] }, { "uuid": "0927f19a-3b02-5c8b-9a40-32b81eb7ed4d", "title": "IA-8 \u2014 Partial", "description": "Control partially implemented; residual tracked in the gap assessment.", "target": { "type": "objective-id", "target-id": "ia-8_obj", "status": { "state": "not-satisfied", "reason": "fail", "remarks": "Partial \u2014 Control partially implemented; residual tracked in the gap assessment." } }, "related-observations": [ { "observation-uuid": "9746cb06-2272-5c9b-9b76-07a831e445a6" } ] }, { "uuid": "ec1a7416-24b9-56ce-9b4f-b5d25a8d62ea", "title": "IR-4 \u2014 Implemented", "description": "Control implemented and evidenced in the SSP.", "target": { "type": "objective-id", "target-id": "ir-4_obj", "status": { "state": "satisfied", "reason": "pass", "remarks": "Implemented \u2014 Control implemented and evidenced in the SSP." } }, "related-observations": [ { "observation-uuid": "7a98cfa8-491e-5186-a9d4-e8110771146a" } ] }, { "uuid": "885e6fe9-024a-5686-a412-1e1ab1c1146c", "title": "IR-6 \u2014 Implemented", "description": "Control implemented and evidenced in the SSP.", "target": { "type": "objective-id", "target-id": "ir-6_obj", "status": { "state": "satisfied", "reason": "pass", "remarks": "Implemented \u2014 Control implemented and evidenced in the SSP." } }, "related-observations": [ { "observation-uuid": "cc744c91-3063-569a-b63b-6218c02312a2" } ] }, { "uuid": "b3220f95-a84d-5d16-91aa-040757afbdbb", "title": "IR-8 \u2014 Implemented", "description": "Control implemented and evidenced in the SSP.", "target": { "type": "objective-id", "target-id": "ir-8_obj", "status": { "state": "satisfied", "reason": "pass", "remarks": "Implemented \u2014 Control implemented and evidenced in the SSP." } }, "related-observations": [ { "observation-uuid": "64293aad-54e1-5e6a-871b-824d6dc6bf03" } ] }, { "uuid": "2ce44f88-0036-5566-8254-27bab5eb1dc9", "title": "MP-4 \u2014 Implemented", "description": "Control implemented and evidenced in the SSP.", "target": { "type": "objective-id", "target-id": "mp-4_obj", "status": { "state": "satisfied", "reason": "pass", "remarks": "Implemented \u2014 Control implemented and evidenced in the SSP." } }, "related-observations": [ { "observation-uuid": "b41cf51e-219b-5398-aa6c-defb124902f9" } ] }, { "uuid": "44159238-7033-5b8d-9537-c12a0e752eed", "title": "MP-6 \u2014 Inherited", "description": "Control inherited from the platform provider (DuploCloud / AWS Security Hub).", "target": { "type": "objective-id", "target-id": "mp-6_obj", "status": { "state": "satisfied", "reason": "pass", "remarks": "Inherited \u2014 Control inherited from the platform provider (DuploCloud / AWS Security Hub)." } }, "related-observations": [ { "observation-uuid": "e613c547-3613-57f8-a3d1-e24e29bdab29" } ] }, { "uuid": "3e2e8ec8-a51e-5b5d-b62b-62760eb8ebe2", "title": "PL-2 \u2014 Implemented", "description": "Control implemented and evidenced in the SSP.", "target": { "type": "objective-id", "target-id": "pl-2_obj", "status": { "state": "satisfied", "reason": "pass", "remarks": "Implemented \u2014 Control implemented and evidenced in the SSP." } }, "related-observations": [ { "observation-uuid": "23978aa4-65df-5671-bb39-21698e51ae9f" } ] }, { "uuid": "581978f8-1fe5-5e51-ad8b-8fafb2c8e0d9", "title": "PL-8 \u2014 Implemented", "description": "Control implemented and evidenced in the SSP.", "target": { "type": "objective-id", "target-id": "pl-8_obj", "status": { "state": "satisfied", "reason": "pass", "remarks": "Implemented \u2014 Control implemented and evidenced in the SSP." } }, "related-observations": [ { "observation-uuid": "969e46e8-af73-59b3-8e69-83a273411454" } ] }, { "uuid": "109e2120-3d1c-59d7-88b2-da30727e99ee", "title": "PM-14 \u2014 Implemented", "description": "Control implemented and evidenced in the SSP.", "target": { "type": "objective-id", "target-id": "pm-14_obj", "status": { "state": "satisfied", "reason": "pass", "remarks": "Implemented \u2014 Control implemented and evidenced in the SSP." } }, "related-observations": [ { "observation-uuid": "2d505bb4-c48a-5b04-8f1c-75284e723fc8" } ] }, { "uuid": "e7a12eee-acfe-563b-8784-93c6df2b08ab", "title": "PS-3 \u2014 Outside Scope", "description": "Status derived from the gap assessment.", "target": { "type": "objective-id", "target-id": "ps-3_obj", "status": { "state": "not-satisfied", "reason": "fail", "remarks": "Outside Scope \u2014 Status derived from the gap assessment." } }, "related-observations": [ { "observation-uuid": "e3448e7e-fbd0-55fb-942d-4b8086cc88ea" } ] }, { "uuid": "1f9b930b-21e3-58b6-bbf3-bce00b87dea1", "title": "RA-3 \u2014 Partial", "description": "Control partially implemented; residual tracked in the gap assessment.", "target": { "type": "objective-id", "target-id": "ra-3_obj", "status": { "state": "not-satisfied", "reason": "fail", "remarks": "Partial \u2014 Control partially implemented; residual tracked in the gap assessment." } }, "related-observations": [ { "observation-uuid": "7077c4cc-f883-5d5b-a47c-66675ee9328f" } ] }, { "uuid": "3aa8e1a3-52ea-5a6f-b5c6-7f9c16000741", "title": "RA-5 \u2014 Implemented", "description": "Control implemented and evidenced in the SSP.", "target": { "type": "objective-id", "target-id": "ra-5_obj", "status": { "state": "satisfied", "reason": "pass", "remarks": "Implemented \u2014 Control implemented and evidenced in the SSP." } }, "related-observations": [ { "observation-uuid": "cb327aa6-b447-5200-92ae-2fb1d0d41c14" } ] }, { "uuid": "6f9b070b-288f-59a6-b1c3-3ef804fc6612", "title": "SA-8 \u2014 Implemented", "description": "Control implemented and evidenced in the SSP.", "target": { "type": "objective-id", "target-id": "sa-8_obj", "status": { "state": "satisfied", "reason": "pass", "remarks": "Implemented \u2014 Control implemented and evidenced in the SSP." } }, "related-observations": [ { "observation-uuid": "6ef7b3d7-ef9b-5f76-9b36-e7ea49408ac8" } ] }, { "uuid": "cc76f988-1bcf-52d7-af25-4396e95f0a5b", "title": "SA-10 \u2014 Implemented", "description": "Control implemented and evidenced in the SSP.", "target": { "type": "objective-id", "target-id": "sa-10_obj", "status": { "state": "satisfied", "reason": "pass", "remarks": "Implemented \u2014 Control implemented and evidenced in the SSP." } }, "related-observations": [ { "observation-uuid": "26407ec6-0435-5a1d-b6fb-9db0e498d5f2" } ] }, { "uuid": "9c991bd9-d3dd-5762-bb7b-2693b10ce95c", "title": "SA-11 \u2014 Implemented", "description": "Control implemented and evidenced in the SSP.", "target": { "type": "objective-id", "target-id": "sa-11_obj", "status": { "state": "satisfied", "reason": "pass", "remarks": "Implemented \u2014 Control implemented and evidenced in the SSP." } }, "related-observations": [ { "observation-uuid": "36fdb18c-95c9-5196-8220-7188e6b80ca2" } ] }, { "uuid": "0422facc-88e4-5860-9c19-2752f2879b2b", "title": "SA-22 \u2014 Partial", "description": "Control partially implemented; residual tracked in the gap assessment.", "target": { "type": "objective-id", "target-id": "sa-22_obj", "status": { "state": "not-satisfied", "reason": "fail", "remarks": "Partial \u2014 Control partially implemented; residual tracked in the gap assessment." } }, "related-observations": [ { "observation-uuid": "2a61de36-b500-5bc5-b45b-8b578c9a3ff9" } ] }, { "uuid": "8a230123-61cc-51c9-8279-21bb7608be3a", "title": "SC-7 \u2014 Inherited", "description": "Control inherited from the platform provider (DuploCloud / AWS Security Hub).", "target": { "type": "objective-id", "target-id": "sc-7_obj", "status": { "state": "satisfied", "reason": "pass", "remarks": "Inherited \u2014 Control inherited from the platform provider (DuploCloud / AWS Security Hub)." } }, "related-observations": [ { "observation-uuid": "dabaea82-63b4-5524-ac94-d8155c9a1acc" } ] }, { "uuid": "52d78fd5-b0f1-5ee0-a2fc-cb37fc7c3bae", "title": "SC-8 \u2014 Implemented", "description": "Control implemented and evidenced in the SSP.", "target": { "type": "objective-id", "target-id": "sc-8_obj", "status": { "state": "satisfied", "reason": "pass", "remarks": "Implemented \u2014 Control implemented and evidenced in the SSP." } }, "related-observations": [ { "observation-uuid": "7e29c455-772e-5d20-9866-e16983b6b3d9" } ] }, { "uuid": "c0bdebf8-60e8-5a6d-b857-fb3ad534a195", "title": "SC-12 \u2014 Implemented", "description": "Control implemented and evidenced in the SSP.", "target": { "type": "objective-id", "target-id": "sc-12_obj", "status": { "state": "satisfied", "reason": "pass", "remarks": "Implemented \u2014 Control implemented and evidenced in the SSP." } }, "related-observations": [ { "observation-uuid": "e991334e-3f05-5193-a6fc-3187273ccb0e" } ] }, { "uuid": "9e360db8-3b60-5cb5-939b-b440ee3c40c3", "title": "SC-13 \u2014 Implemented", "description": "Control implemented and evidenced in the SSP.", "target": { "type": "objective-id", "target-id": "sc-13_obj", "status": { "state": "satisfied", "reason": "pass", "remarks": "Implemented \u2014 Control implemented and evidenced in the SSP." } }, "related-observations": [ { "observation-uuid": "5cccc144-34dc-54e7-97fb-aa97ab1c74c1" } ] }, { "uuid": "69e042ff-9aae-5092-bb65-c00405659836", "title": "SC-28 \u2014 Implemented", "description": "Control implemented and evidenced in the SSP.", "target": { "type": "objective-id", "target-id": "sc-28_obj", "status": { "state": "satisfied", "reason": "pass", "remarks": "Implemented \u2014 Control implemented and evidenced in the SSP." } }, "related-observations": [ { "observation-uuid": "7708530f-4e93-5fee-8d37-3fe0c7b3d945" } ] }, { "uuid": "a6332bd6-2dca-5cbe-998b-98bf58a61b01", "title": "SC-32 \u2014 Implemented", "description": "Control implemented and evidenced in the SSP.", "target": { "type": "objective-id", "target-id": "sc-32_obj", "status": { "state": "satisfied", "reason": "pass", "remarks": "Implemented \u2014 Control implemented and evidenced in the SSP." } }, "related-observations": [ { "observation-uuid": "1c4f788d-8d96-5f14-b829-68311dafc363" } ] }, { "uuid": "0949ff74-8683-5653-8adc-7794e17b779f", "title": "SI-2 \u2014 Implemented", "description": "Control implemented and evidenced in the SSP.", "target": { "type": "objective-id", "target-id": "si-2_obj", "status": { "state": "satisfied", "reason": "pass", "remarks": "Implemented \u2014 Control implemented and evidenced in the SSP." } }, "related-observations": [ { "observation-uuid": "5f28d7f6-db4c-57f5-81d3-982f2c575f60" } ] }, { "uuid": "4ced20ab-2525-5e69-983e-9eb4ed9f769b", "title": "SI-4 \u2014 Partial", "description": "Control partially implemented; residual tracked in the gap assessment.", "target": { "type": "objective-id", "target-id": "si-4_obj", "status": { "state": "not-satisfied", "reason": "fail", "remarks": "Partial \u2014 Control partially implemented; residual tracked in the gap assessment." } }, "related-observations": [ { "observation-uuid": "155d56e5-9cf6-51ec-a181-052c629235c2" } ] }, { "uuid": "0d85a166-8730-55eb-abb3-2cb2db84a12d", "title": "SI-7 \u2014 Implemented", "description": "Control implemented and evidenced in the SSP.", "target": { "type": "objective-id", "target-id": "si-7_obj", "status": { "state": "satisfied", "reason": "pass", "remarks": "Implemented \u2014 Control implemented and evidenced in the SSP." } }, "related-observations": [ { "observation-uuid": "16cea5a3-b6f6-5bef-90a2-1f9e9b2e7aac" } ] }, { "uuid": "f187978d-e851-5bfb-bfcc-1e52a73a00da", "title": "SR-3 \u2014 Implemented", "description": "Control implemented and evidenced in the SSP.", "target": { "type": "objective-id", "target-id": "sr-3_obj", "status": { "state": "satisfied", "reason": "pass", "remarks": "Implemented \u2014 Control implemented and evidenced in the SSP." } }, "related-observations": [ { "observation-uuid": "680a7f9f-a8d7-559f-beda-f56c51b3a710" } ] }, { "uuid": "264b3b36-d5cb-5176-8262-78c738e79f15", "title": "SR-4 \u2014 Implemented", "description": "Control implemented and evidenced in the SSP.", "target": { "type": "objective-id", "target-id": "sr-4_obj", "status": { "state": "satisfied", "reason": "pass", "remarks": "Implemented \u2014 Control implemented and evidenced in the SSP." } }, "related-observations": [ { "observation-uuid": "0edb0208-5915-5e3b-a2c2-fd01d2cf2684" } ] }, { "uuid": "95e97444-e5ed-5291-9b08-74cb688aded5", "title": "SR-10 \u2014 Partial", "description": "Control partially implemented; residual tracked in the gap assessment.", "target": { "type": "objective-id", "target-id": "sr-10_obj", "status": { "state": "not-satisfied", "reason": "fail", "remarks": "Partial \u2014 Control partially implemented; residual tracked in the gap assessment." } }, "related-observations": [ { "observation-uuid": "4d11bbf9-4db8-5f9a-9f78-92c9502dd40f" } ] }, { "uuid": "cd92bba4-9f97-5d64-bf3b-867f6978ce42", "title": "SR-11 \u2014 Partial", "description": "Control partially implemented; residual tracked in the gap assessment.", "target": { "type": "objective-id", "target-id": "sr-11_obj", "status": { "state": "not-satisfied", "reason": "fail", "remarks": "Partial \u2014 Control partially implemented; residual tracked in the gap assessment." } }, "related-observations": [ { "observation-uuid": "e7cae450-5e37-5157-b632-00f76078fbbd" } ] } ] } ] } }