For federal evaluators who read the controls before they read the marketing.
STRATUS AccessGov is built against the FedRAMP Moderate baseline and NIST 800-53 Rev. 5 controls — not as a retrofit, but as a design constraint from the first commit. Cryptographic operations are designed to use FIPS-enabled AWS KMS endpoints or customer-provided HSMs where required by the deployment boundary. Provider validation certificates and operational modes are documented in the Federal Evaluation Packet. Outbound-only connectivity. Immutable evidence chain. FedRAMP-aligned today; pursuing Authorization with our first federal Founding Partner.
We say FedRAMP-aligned, not FedRAMP-authorized — because words matter when the contracting officer reads them. Here's the precise distinction and the timeline.
Translation: the architecture is designed against the technical baseline controls. We do not yet hold an Authorization to Operate. If FedRAMP Moderate ATO is a year-one purchase requirement for your agency, that's an honest signal we should look at structuring you as a Founding Partner where the ATO pursuit completes during your deployment.
Excerpts from the STRATUS control mapping document. Full mapping available under NDA during evaluation.
All cryptographic operations — AES-256 at rest, TLS 1.3 in transit, mTLS for HCG, SHA-256 evidence hashing — are architected to run inside FIPS 140-3 boundaries via AWS KMS (FIPS endpoints) or customer-provided HSM. The cryptographic boundary documentation, including provider validation certificates and operational modes, is part of the Federal Evaluation Packet shared under NDA during procurement.
The Hybrid Connector Gateway dials out from inside the agency's accreditation boundary. No listener exposed to the public internet. Drastically reduces the SC-7 control surface that has to be re-evaluated.
Every access decision becomes an Evidence Pack: SHA-256 hash, prev_hash chain link, KMS signature, S3 Object Lock in compliance mode. AU-9(3) and AU-10 alignment is supported by design, not only by policy.
We are pursuing GSA Schedule placement and FedRAMP Moderate ATO with our first federal Founding Partner — typically a state agency with federal data flows or a small federal civilian shop. If that fits, the pricing and the path both work in your favor.
NIST 800-53 Control Alignment PDF
Technical alignment only. Not certification. Final control satisfaction depends on customer configuration, operating procedures, and shared responsibility.