Cleared for the hardest environment first: DoD IL5.
Legation is engineered to the DoD IL5 bar—CNSA 2.0 cryptography, an L6-hardened runtime, PIV/CAC identity, and metadata-only evidence, deployed active-active in AWS GovCloud. Everything a commercial framework asks for is a subset of what that bar already requires.
CNSA 2.0 algorithms, in a FIPS-oriented module.
Clear the top of the ladder, inherit everything below it.
DoD IL5 and CNSSP-12 sit at the top of the assurance ladder: CNSA 2.0 cryptography, phishing-resistant identity, immutable audit, network isolation, and a hardened runtime. A system built to satisfy that ceiling does not have to be re-architected for FedRAMP High, CMMC Level 2, HIPAA, PCI DSS, or SOC 2—those are subsets of the same control families.
CNSA 2.0 algorithms in an L6-hardened runtime.
- SHA-384 hashing throughout; Ed25519 signatures classical, with a hybrid post-quantum (ML-DSA) seal at the Sovereign tier
- L6 container: static-musl, built FROM scratch, non-root, no shell, RELRO/NX, mapped to DISA STIG V-222600 / V-222680 / V-222681
- Sovereign HSM path: the hub's TLS private key is held in a CloudHSM PKCS#11 module and signs the handshake inside the HSM—the key never touches disk
- All hashing and signing route through a single provider seam, so a FIPS build swaps the backend without changing any signature or hash contract
How the control families are implemented.
| Family | Representative controls | Legation implementation |
|---|---|---|
| AC — Access Control | AC-3, AC-4, AC-17 | Outbound-only connectivity, zero inbound ports, PrivateLink dial-in, NACLs, VPC endpoint policies, and a customer-local policy gate on every action |
| AU — Audit & Accountability | AU-2/3/5/8/9 | Structured JSON tracing, metadata-only hash-linked audit, SIEM events (OCSF/CEF), VPC flow logs, and KMS-encrypted log delivery with retention |
| IA — Identification & Auth | IA-2(1)(2)(6) | PIV/CAC SAML federation, phishing-resistant MFA (M-22-09), non-human workload identity, and per-call proof of possession |
| SC — System & Comms Protection | SC-5/7/12/13/28 | WAF and optional Shield, network segmentation, KMS key custody, CNSA 2.0 SHA-384, HSM-held TLS key, encryption in transit and at rest |
| SI — System & Info Integrity | SI-4 | Continuous monitoring, behavioral-anomaly sensors, seal-integrity checks, and active defense with immune-response self-sever |
| CM — Configuration Management | CM-3, CM-6 | Sealed accreditation record, immutable from-scratch images, and infrastructure expressed entirely as reviewed Terraform |
| IR — Incident Response | IR-6 | KMS-encrypted SNS ops alerting on health and audit-persist failure, plus a dual, customer-held recall |
Phishing-resistant by default at IL5.
Privileged access at High/IL5 cannot rely on a phishable factor. The GovCloud and Sovereign profiles federate the operator and auditor portals to a PIV/CAC SAML identity provider and make it the only authentication path—no local TOTP fallback (IA-2(1)/(2), OMB M-22-09).
- PIV/CAC federation, federated-only for privileged roles
- Non-human and workload identity with signature verification
- Per-call proof of possession and replay protection
- Separated operator and auditor identity boundaries
Continuously monitored, metadata-only, tamper-evident.
Every enforcement decision is recorded as hash-linked, metadata-only evidence—never customer data. The monitoring lane reports embassy liveness, seal integrity, treaty adherence, and behavioral anomalies, and exports to a customer SOC as OCSF or CEF.
- Hash-linked, signed audit chain (AU-9); no payloads by construction
- SIEM export in OCSF and CEF with tenant, session, and mandate correlation
- VPC flow logs and WAF telemetry to KMS-encrypted log groups
- CloudWatch alarms to a KMS-encrypted SNS ops topic (IR-6)
- Configurable audit retention (default three years) and an auditor-facing read-only portal
The IL5 deployment shape.
The FedRAMP High / IL5 profile runs active-active across us-gov-west-1 and us-gov-east-1 with FIPS endpoints enabled, private-by-default egress, and KMS encryption end to end.
Network
- Two-region active/active GovCloud
- PrivateLink dial-in; zero inbound customer ports
- NACL defense-in-depth and scoped endpoint egress
- WAFv2 and optional Shield Advanced
Data & keys
- FIPS endpoints; CloudHSM-held TLS key option
- KMS-encrypted logs, secrets, and audit
- VPC endpoint policies to limit exfiltration paths
- Customer data and enforcement remain in the customer boundary
Every commercial framework is a subset of the IL5 bar.
| Framework | Position vs. IL5 | Controls inherited from the same substrate |
|---|---|---|
| DoD IL5 · CNSSP-12 | The ceiling | Full stack: CNSA 2.0, L6/STIG runtime, PIV/CAC, isolation, immutable audit |
| FedRAMP High · NIST 800-53 | Subset | SC, AU, IA, AC families with control-aligned SSP inputs |
| CMMC L2 · NIST 800-171 | Subset | AC/AU/IA/SC/SI support across the 110-control assessment, with SPRS-oriented evidence |
| HIPAA | Subset | Customer-local PHI processing, projection, and metadata-only audit |
| PCI DSS v4 | Subset | Network segmentation, no inbound access, scoped data-handling boundaries |
| SOC 2 · GDPR · EU AI Act | Subset | Access control, audit evidence, residency, and change/identity governance |
We ship our own POA&M—open items included.
Legation deploys with an advisory Plan of Action & Milestones so a sponsoring agency and 3PAO see exactly what is closed and what remains. It is a working POA&M, not an authorized Security Assessment Report.
| Item | Controls | Severity | Status |
|---|---|---|---|
| POAM-001 — FIPS module CMVP validation in the shipped build | SC-13, SC-12 | High | Code-ready; awaiting validated-toolchain build and recorded CMVP certificate |
| POAM-002 — Phishing-resistant MFA IdP binding | IA-2(1)(2) | High | Code-ready; operator supplies the PIV/CAC SAML metadata |
| POAM-003 — Mandatory audit timestamp and NTP sync | AU-8, AU-8(1) | Moderate | Open; scheduled next release |
Designed for IL5. Authorization is earned per deployment.
This page describes controls aligned to, and a deployment path for, DoD IL5 and FedRAMP High. An Authorization to Operate is granted by a sponsoring agency and a 3PAO against a specific, deployed system—not by a vendor claim. Legation provides the hardened substrate, the control implementations, the evidence, and the POA&M; the authorization is completed with the customer.
Bring your accreditation boundary. We'll map the controls.
Get the control matrix, the deployment profile, and the POA&M for your target authorization.