Enterprise / Security assurance
Security claims need an evidence trail.
A transparent status of procurement, controlled-information and technical assurance work. This is a working readiness register—not a CMMC, FedRAMP, ISO 27001, SOC 2 or government-accreditation claim.
Data boundaries
What information can be accepted where
Classification is established before access or transfer—not after files arrive. Public pages and the commercial portal are not an authorized destination for government controlled material.
Published; limited scope
Public marketing and browser labs
Public pages, synthetic research demonstrations and code-backed website controls. These are not a federal contractor system or proof of company-wide compliance.
Not qualified for government controlled data
Ordinary commercial client workspace
Do not upload FCI, CUI, classified material, export-controlled technical data, unknown malware samples or customer secrets to the public forms or unapproved Cloudflare storage.
Assessment and inventory needed
FCI covered systems
A covered contractor system must be defined for each contract, including endpoints, identity, communications, storage, vendors and third-party access. All 15 FAR basic safeguards require evidence.
Not approved or represented
CUI and classified programs
A separate, contract-approved boundary, flow-down review, system security plan and assessment evidence are required for applicable CUI. No cleared facility, classified processing or government accreditation is claimed.
Federal baseline
FAR 52.204-21 / 15 basic safeguards
These are the safeguards in the federal clause, paraphrased for planning. Organization-wide and system-specific control implementation has not been independently assessed. This list is not a score.
| ID | Requirement to assess | Current evidence status |
|---|---|---|
| 01 | Restrict system access to authorized users, processes and devices. | Not assessed |
| 02 | Restrict user actions and permitted functions by role. | Not assessed |
| 03 | Verify and control connections to external information systems. | Not assessed |
| 04 | Control data placed on publicly accessible systems. | Not assessed |
| 05 | Identify system users, processes and devices. | Not assessed |
| 06 | Authenticate users, processes and devices prior to access. | Not assessed |
| 07 | Sanitize or destroy FCI-bearing media before reuse or disposal. | Not assessed |
| 08 | Restrict physical access to systems and facilities. | Not assessed |
| 09 | Escort and monitor visitors; maintain physical access controls and records. | Not assessed |
| 10 | Protect communications at external and critical internal boundaries. | Not assessed |
| 11 | Separate publicly accessible components from internal networks. | Not assessed |
| 12 | Identify, report and remediate system flaws in a timely manner. | Not assessed |
| 13 | Deploy malicious-code protections at appropriate system locations. | Not assessed |
| 14 | Keep malicious-code protection mechanisms updated. | Not assessed |
| 15 | Scan systems periodically and inspect incoming files as appropriate. | Not assessed |
Primary source: FAR 52.204-21. The controls must be evaluated against systems actually processing Federal Contract Information.
Readiness register
Verified status versus remaining work
Entries stay explicitly unverified until relevant business records, evidence owners, personnel and contract requirements are supplied.
Evidence pending
Legal contracting entity / DBA
Identify legal contracting party and validate current DBA filing.
Next evidence: Confirm current county registration, W-9 identity, signatory authority and any planned corporate transition.
Not established
SAM.gov UEI and CAGE
Complete a verified All Awards registration when pursuing direct federal awards.
Next evidence: Use official SAM.gov registration; record identifiers only after confirmation.
Not established
FAR 52.204-21 FCI controls
Assess all 15 basic safeguarding items for each covered contractor system.
Next evidence: Define FCI boundary and collect implementation evidence for every applicable requirement.
Not established
NIST SP 800-171 / CUI
Assess contract-selected requirements against the actual CUI system boundary.
Next evidence: Produce inventory, system security plan, implementation evidence, assessment record and remediation plan.
Not established
CMMC requirement assessment
Review live program requirements, solicitation clauses and current CMMC phase status.
Next evidence: Confirm contract-specific applicability; no certification or self-assessment score claimed.
Policy drafted
Malware sample and forensic data handling
Document safe intake, analysis isolation, chain-of-custody and purge procedures.
Next evidence: Test controls in an actual approved environment before accepting raw samples.
Not established
Export controls and sanctions
Classify services/data and screen jurisdiction, end user and license requirements.
Next evidence: Obtain qualified export review and required authorizations before any controlled international work.
Evidence pending
Personnel, facility and specialist capacity
Verify actual staffing, ability to access sites, qualifications and clearance requirements.
Next evidence: Assemble named specialist resumes and approved capacity/availability evidence.
Evidence pending
Insurance and enterprise contracting
Provide current policy evidence and approved customer terms.
Next evidence: Verify coverage/limits with broker and have NDA/MSA/SOW/DPA templates reviewed.
Not established
Government past performance
Provide independently verifiable contracting outcomes and references when they exist.
Next evidence: Begin bounded subcontract tasks, retain acceptance evidence and request reference permission.
Controlled work
A five-step authorization path
GATE 01
Intake & classification
Record only non-sensitive project requirements. Identify FCI, CUI, classified, ITAR/EAR or customer-regulated material; stop if undefined.
GATE 02
Authorization & procurement
Verify legal contracting entity, end user, written scope, access authorization, export screening and mandatory flow-down clauses.
GATE 03
Approved environment & people
Select authorized tools, storage, physical location, access controls and vetted personnel for the exact data classification.
GATE 04
Scoped engineering delivery
Produce traceable changes/findings, evidence timestamps, review decisions, versioned handoffs and remediation verification.
GATE 05
Acceptance & disposal
Confirm delivery acceptance, retention, transfer, incident reporting, deletion and closeout requirements.
Regulatory references
Check the contract clause and its revision.
Requirements vary by agency, solicitation, contract language, classification, delivery location and subcontract flow-downs.
- NIST SP 800-171 Rev. 3 / CUI protection — applicable version is defined by contract and current rules.
- Official CMMC program information — the July 2026 Phase II suspension does not erase Phase I or underlying contractual obligations; recheck before a bid.
- U.S. State Department / DDTC — foreign defense services and controlled technical data may require registration or prior approval.
This public page deliberately excludes internal network diagrams, secrets, specific security settings, incident artifacts, control-test results and regulated or export-controlled data. Request restricted evidence through a verified buyer contact and appropriately protected channel.
Start an assurance or procurement inquiry