{"version":"1.0.0-2026.07.05","updated":"2026-07-22T18:00:00Z","doctrine":"Show, cite, comply — every framework control maps to honest posture, evidence artifact, and proof route. NOT_HELD and DESIGN_INTENT are first-class; no silent overclaim.","legend":{"HELD":"Third-party certificate or government authorization held today.","ALIGNED":"Implementation conforms to published spec; self-assessed mapping on file.","IN_PROGRESS":"Control mapping or evidence collection underway — gap visible.","DESIGN_INTENT":"Architecture targets this control; not yet attested or assessed.","NOT_HELD":"Authority not held; listed so auditors see the gap on the record."},"surfaces":{"hub":"/compliance-hub","vendorSecurity":"/vendor-security","governance":"/governance","standards":"/standards","contracting":"/contracting","atoPath":"/contracting/ato-path","redTeam":"/evaluate/red-team","evaluateReviewer":"/evaluate/reviewer"},"apis":{"registry":"/api/compliance/registry","status":"/api/compliance/status","auditExport":"/api/compliance/audit-export","authorities":"/api/platform/authorities","companyIdentity":"/api/company/identity","standards":"/api/standards","compliancePack":"/api/security/compliance-pack/v1","hitlAudit":"/api/governance/hitl-audit","hitlAttest":"/api/governance/hitl/attest","systemOfRecord":"/api/governance/system-of-record","redTeamReadiness":"/api/governance/red-team-readiness"},"auditScript":"npm run compliance:audit","frameworks":[{"id":"nist-csf-2","label":"NIST Cybersecurity Framework 2.0","source":"https://www.nist.gov/cyberframework","posture":"ALIGNED","honestNote":"Self-assessed control mapping; no third-party CSF certification.","controls":[{"id":"csf-gv-oc-01","family":"Govern","title":"Organizational cybersecurity risk management strategy","posture":"ALIGNED","implementation":"server/governance-engine.ts","evidence":["server/templates/governance.html","data/compliance-framework-registry.json"],"proofRoutes":["/api/governance/policy","/governance"]},{"id":"csf-id-am-01","family":"Identify","title":"Asset inventory and system-of-record posture","posture":"ALIGNED","implementation":"server/governance-hitl-store.ts","evidence":["scripts/ensure-governance-hitl-audit.sql"],"proofRoutes":["/api/governance/system-of-record","/api/governance/hitl-audit"]},{"id":"csf-pr-ds-01","family":"Protect","title":"Data security — tenant isolation per portal","posture":"ALIGNED","implementation":"server/portal-engine.ts","evidence":["server/portals/governance.json","server/portals/compliance.json"],"proofRoutes":["/api/governance/export-manifest?portal=corporate"]},{"id":"csf-de-cm-01","family":"Detect","title":"Continuous monitoring — immunology antigen sensing","posture":"ALIGNED","implementation":"server/security/immunology-engine.ts","evidence":["docs/infra/defense-daas-demo.md"],"proofRoutes":["/api/security/vendor-dashboard","/vendor-security"]},{"id":"csf-rs-ma-01","family":"Respond","title":"Incident response — cyber response engine + COA chain","posture":"ALIGNED","implementation":"server/cyber-response-engine.ts","evidence":["server/cop-alert-intelligence.ts"],"proofRoutes":["/api/cop/alerts-intel","/api/prove/touch?behavior=1"]}]},{"id":"nist-ai-rmf","label":"NIST AI Risk Management Framework 1.0","source":"https://www.nist.gov/itl/ai-risk-management-framework","posture":"ALIGNED","honestNote":"HITL required for critical insights; no NIST AI RMF third-party audit.","controls":[{"id":"ai-rmf-govern-1","family":"Govern","title":"Human-in-the-loop for AI-generated critical insights","posture":"ALIGNED","implementation":"server/governance-engine.ts","evidence":["docs/canonical/06_responsible_ai_governance_wedge.md"],"proofRoutes":["/api/governance/hitl-audit","POST /api/governance/hitl/attest"]},{"id":"ai-rmf-map-1","family":"Map","title":"AI provider orchestration transparency and failover","posture":"ALIGNED","implementation":"server/ai-provider-orchestrator.ts","evidence":["server/templates/governance.html"],"proofRoutes":["/api/ai-orchestrator/health","/api/governance/red-team-readiness"]},{"id":"ai-rmf-measure-1","family":"Measure","title":"Evaluator prove chain — behavioral AI touch verification","posture":"ALIGNED","implementation":"server/prove-touch-routes.ts","evidence":["docs/evidence/evaluator-pre-present-*.md"],"proofRoutes":["/api/prove/touch?behavior=1","/api/evaluate/cohesion-status"]}]},{"id":"fedramp","label":"FedRAMP Authorization","source":"https://www.fedramp.gov/","posture":"NOT_HELD","honestNote":"Platform is not FedRAMP-authorized. ATO path memo documents honest phase plan.","controls":[{"id":"fedramp-ssp","family":"RMF","title":"System Security Plan (SSP) draft artifacts","posture":"IN_PROGRESS","implementation":"data/compliance-framework-registry.json","evidence":["server/templates/contracting-ato-path.html","docs/canonical/20_full_stack_validation_blueprint.md"],"proofRoutes":["/contracting/ato-path","/api/compliance/audit-export"]},{"id":"fedramp-conmon","family":"RMF","title":"Continuous monitoring hooks","posture":"DESIGN_INTENT","implementation":"server/prove-touch-routes.ts","evidence":["scripts/compliance-audit.mjs"],"proofRoutes":["/api/health/live","npm run compliance:audit"]}]},{"id":"cmmc-l2","label":"CMMC 2.0 Level 2","source":"https://dodcio.defense.gov/CMMC/","posture":"DESIGN_INTENT","honestNote":"Practices referenced in internal mapping; no C3PAO assessment held.","controls":[{"id":"cmmc-ac-l2","family":"Access Control","title":"RBAC event bus + site access gate","posture":"ALIGNED","implementation":"server/site-access-gate.ts","evidence":["docs/infra/site-access-setup.md"],"proofRoutes":["/access","/api/health/live"]},{"id":"cmmc-au-l2","family":"Audit","title":"HITL audit dual-write to Postgres","posture":"ALIGNED","implementation":"server/governance-hitl-store.ts","evidence":["scripts/ensure-governance-hitl-audit.sql"],"proofRoutes":["/api/governance/system-of-record","POST /api/governance/hitl/attest"]},{"id":"cmmc-sc-l2","family":"System Communications Protection","title":"PQC hybrid key exchange (FIPS 203/204)","posture":"ALIGNED","implementation":"server/security/pqc-bridge.ts","evidence":["docs/infra/defense-daas-demo.md"],"proofRoutes":["/api/security/pqc/v1","/vendor-security"]}]},{"id":"soc2-type2","label":"SOC 2 Type II","source":"https://www.aicpa.org/soc","posture":"NOT_HELD","honestNote":"No SOC 2 report issued. Full CC1-CC9 + Availability + Confidentiality control set mapped; continuous PQC-signed evidence monitor live; independent CPA examination required before any claim.","controls":[{"id":"soc2-cc1","family":"Control Environment","title":"Governance, integrity, oversight, accountability","posture":"IN_PROGRESS","implementation":"docs/compliance/soc2/01_Information_Security_Management_System_Policy.md","evidence":["docs/compliance/soc2/01_Information_Security_Management_System_Policy.md"],"proofRoutes":["/api/compliance/vanta/tests"]},{"id":"soc2-cc2","family":"Communication","title":"Internal/external security communication","posture":"ALIGNED","implementation":"server/templates/security.html","evidence":["server/templates/trust-center.html"],"proofRoutes":["/security","/trust-center"]},{"id":"soc2-cc3","family":"Risk Assessment","title":"Risk identification, fraud, change","posture":"IN_PROGRESS","implementation":"docs/compliance/soc2/00_SOC2_Readiness_Assessment.md","evidence":["docs/compliance/soc2/05_SOC2_Evidence_Register.md"],"proofRoutes":["/api/compliance/vanta/dashboard"]},{"id":"soc2-cc4","family":"Monitoring Activities","title":"Continuous control monitoring","posture":"ALIGNED","implementation":"server/soc2-continuous-monitor.ts","evidence":["data/soc2-evidence/*.jsonl"],"proofRoutes":["/api/compliance/soc2/monitor/status","/api/compliance/soc2/monitor/verify"]},{"id":"soc2-cc5","family":"Control Activities","title":"Technical + policy control activities","posture":"ALIGNED","implementation":"server/lane-firewall.ts","evidence":["docs/compliance/soc2/04_SOC2_Control_Matrix.md"],"proofRoutes":["/api/lane-firewall/status"]},{"id":"soc2-cc6","family":"Logical & Physical Access","title":"RBAC, MFA, least privilege, boundary","posture":"IN_PROGRESS","implementation":"server/site-access-gate.ts","evidence":["docs/compliance/soc2/01_Information_Security_Management_System_Policy.md"],"proofRoutes":["/api/lane-firewall/status","/api/company/identity"]},{"id":"soc2-cc7","family":"System Operations","title":"Monitoring, vuln mgmt, incident response","posture":"IN_PROGRESS","implementation":"server/agos-writer.ts","evidence":["docs/compliance/soc2/02_Incident_Response_Plan.md"],"proofRoutes":["/api/compliance/soc2/monitor/verify"]},{"id":"soc2-cc8","family":"Change Management","title":"Version-controlled change with gates","posture":"ALIGNED","implementation":"package.json:gate:push","evidence":["deploy stamps","commit history"],"proofRoutes":["/api/compliance/vanta/tests"]},{"id":"soc2-cc9","family":"Risk Mitigation","title":"Vendor risk + business disruption","posture":"IN_PROGRESS","implementation":"docs/compliance/soc2/03_Business_Continuity_DR_Plan.md","evidence":["docs/compliance/soc2/03_Business_Continuity_DR_Plan.md"],"proofRoutes":["/api/compliance/vanta/dashboard"]},{"id":"soc2-a1","family":"Availability","title":"Capacity, backup, disaster recovery","posture":"IN_PROGRESS","implementation":"docs/compliance/soc2/03_Business_Continuity_DR_Plan.md","evidence":["docs/compliance/soc2/03_Business_Continuity_DR_Plan.md"],"proofRoutes":["/api/health/live"]},{"id":"soc2-c1","family":"Confidentiality","title":"Data classification, handling, disposal","posture":"IN_PROGRESS","implementation":"docs/compliance/soc2/01_Information_Security_Management_System_Policy.md","evidence":["docs/compliance/soc2/01_Information_Security_Management_System_Policy.md"],"proofRoutes":["/api/compliance/vanta/tests"]}]},{"id":"cjis","label":"FBI CJIS Security Policy","source":"https://www.fbi.gov/services/cjis/cjis-security-policy","posture":"NOT_HELD","honestNote":"No CJIS-compliant hosting or policy attestation. Listed for law-enforcement pursuit honesty.","controls":[{"id":"cjis-ia","family":"Identification & Authentication","title":"Advanced authentication for CJIS systems","posture":"NOT_HELD","implementation":null,"evidence":["server/company-identity.ts"],"proofRoutes":["/api/platform/authorities"]}]},{"id":"iso-27001","label":"ISO/IEC 27001","source":"https://www.iso.org/standard/54534.html","posture":"NOT_HELD","honestNote":"No ISO 27001 certification. ISMS mapping derived from NIST CSF alignment.","controls":[{"id":"iso-a5","family":"Organizational","title":"Information security policies","posture":"ALIGNED","implementation":"server/templates/governance.html","evidence":["docs/canonical/06_responsible_ai_governance_wedge.md"],"proofRoutes":["/governance","/api/governance/policy"]}]},{"id":"fips-pqc","label":"NIST FIPS 203 / 204 Post-Quantum Cryptography","source":"https://csrc.nist.gov/projects/post-quantum-cryptography","posture":"ALIGNED","honestNote":"ML-KEM / ML-DSA implementation with transparency log; not a FIPS 140-3 validated module.","controls":[{"id":"fips-203-mlkem","family":"Cryptography","title":"ML-KEM hybrid key encapsulation","posture":"ALIGNED","implementation":"server/security/pqc-bridge.ts","evidence":["server/pqc-crypto.ts"],"proofRoutes":["/api/security/pqc/v1","/api/security/pqc/v1/transparency-log"]},{"id":"fips-140-module","family":"Cryptography","title":"FIPS 140-2/140-3 validated cryptographic module","posture":"NOT_HELD","implementation":null,"evidence":["server/company-identity.ts"],"proofRoutes":["/api/platform/authorities"]}]},{"id":"iron-rule-9","label":"IRON RULE 9 — Capability Alignment Matrix","source":"docs/alignment/capability-matrix.md","posture":"IN_PROGRESS","honestNote":"Matrix exists; UNVERIFIED rows visible in dev audit; strict CI mode fails until citations filled.","controls":[{"id":"ir9-matrix","family":"Traceability","title":"RFP + user citation per advertised capability","posture":"IN_PROGRESS","implementation":"docs/alignment/capability-matrix.md","evidence":["scripts/alignment-matrix-audit.mjs"],"proofRoutes":["node scripts/alignment-matrix-audit.mjs","node scripts/alignment-matrix-audit.mjs --json"]},{"id":"ir9-claims","family":"Congruence","title":"Frontend claim → backend endpoint resolver","posture":"ALIGNED","implementation":"scripts/capability-claim-audit.mjs","evidence":["scripts/capability-claim-audit.mjs"],"proofRoutes":["node scripts/capability-claim-audit.mjs"]}]}],"module":"Compliance Readiness"}