AEGIS-LOG audit readiness

Compares System Security Plan claims with executable checks against available repository evidence.

Infrastructure

Current infrastructure Remediated infrastructure

Assessment readiness

Not ready

Repository evidence contradicts one or more testable SSP claims.

Failed: 11
Needs evidence: 2
Passed: 2

Evaluated: 2026-07-16
Evidence source: docs/infrastructure.yaml
Source timestamp: 2026-07-16 21:14 UTC
SSP version: 2.3 · reviewed 2024-08-12

Control results

Sorted by failed controls, evidence gaps, then passing controls.

15 controls evaluated

Status Control Control name Checks Details

Failed AU-2 Event Logging Passed: 1 Failed: 2 Needs evidence: 0

SSP statement

The system logs the following event types: authentication attempts (success and failure), privilege escalations, configuration changes, data access events for records marked CUI, and system errors. Logs are retained for one year online and three years archived.

Check results

Findings, evidence, and cited source for checks under AU-2
Result	Check	Finding and evidence
Passed	Logs retained three years archived (>= 1095 days) `archive-retention-3yr`	logging.retention_archive_days = 1095 `docs/infrastructure.yaml:66` logging.retention_archive_days 65 retention_online_days: 180 66 retention_archive_days: 1095 67 event_types_logged:
Failed	Logs retained one year online (>= 365 days) `online-retention-1yr`	logging.retention_online_days = 180 `docs/infrastructure.yaml:65` logging.retention_online_days 64 - s3-archive 65 retention_online_days: 180 66 retention_archive_days: 1095
Failed	Auth success/failure, privilege escalation, config changes, CUI access, and system errors are logged `required-event-types`	missing event types: privilege_escalation `docs/infrastructure.yaml:67` logging.event_types_logged 66 retention_archive_days: 1095 67 event_types_logged: 68 - auth_success 69 - auth_failure 70 - config_change 71 - cui_data_access 72 - system_error 73 tamper_protection: object_lock_governance

Policy source policy/controls/au2.rego

 1# AU-2 - Event Logging
 2# "The system logs the following event types: authentication attempts
 3# (success and failure), privilege escalations, configuration changes, data
 4# access events for records marked CUI, and system errors. Logs are retained
 5# for one year online and three years archived."
 6
 7package ssp.compliance
 8
 9required_event_types := {
10	"auth_success",
11	"auth_failure",
12	"privilege_escalation",
13	"config_change",
14	"cui_data_access",
15	"system_error",
16}
17
18missing_event_types := required_event_types - logged_event_types
19
20default retention_online_ok := false
21
22retention_online_ok if input.logging.retention_online_days >= 365
23
24default retention_archive_ok := false
25
26retention_archive_ok if input.logging.retention_archive_days >= 1095
27
28checks contains {
29	"control": "AU-2", "id": "required-event-types",
30	"requirement": "Auth success/failure, privilege escalation, config changes, CUI access, and system errors are logged",
31	"status": verdict(count(missing_event_types) == 0),
32	"evidence": sprintf("missing event types: %s", [csv(sort(missing_event_types))]),
33	"paths": ["logging.event_types_logged"],
34}
35
36checks contains {
37	"control": "AU-2", "id": "online-retention-1yr",
38	"requirement": "Logs retained one year online (>= 365 days)",
39	"status": verdict(retention_online_ok),
40	"evidence": sprintf("logging.retention_online_days = %v", [object.get(input, ["logging", "retention_online_days"], "unset")]),
41	"paths": ["logging.retention_online_days"],
42}
43
44checks contains {
45	"control": "AU-2", "id": "archive-retention-3yr",
46	"requirement": "Logs retained three years archived (>= 1095 days)",
47	"status": verdict(retention_archive_ok),
48	"evidence": sprintf("logging.retention_archive_days = %v", [object.get(input, ["logging", "retention_archive_days"], "unset")]),
49	"paths": ["logging.retention_archive_days"],
50}

Failed AU-9 Protection of Audit Information Passed: 1 Failed: 2 Needs evidence: 0

SSP statement

Audit logs are written to a tamper-evident store. Access to logs is restricted to the ISSO and SOC personnel. Logs are encrypted at rest.

Check results

Findings, evidence, and cited source for checks under AU-9
Result	Check	Finding and evidence
Failed	Log access restricted to the ISSO and SOC personnel `log-access-restricted`	reader roles outside ISSO/SOC: platform-engineer `docs/infrastructure.yaml:78` logging.access_controls.readers.2.role 77 - role: soc-analyst 78 - role: platform-engineer # added 2025-08 for debugging
Passed	Logs encrypted at rest (s3-archive destination is object storage) `log-encryption-at-rest`	storage.object_storage.encryption_at_rest = true `docs/infrastructure.yaml:89` storage.object_storage.encryption_at_rest 88 object_storage: 89 encryption_at_rest: true 90 encryption_algorithm: AES256
Failed	Audit logs written to a tamper-evident store (Object Lock compliance mode; governance mode is bypassable by privileged users) `tamper-evident-storage`	logging.tamper_protection = object_lock_governance `docs/infrastructure.yaml:73` logging.tamper_protection 72 - system_error 73 tamper_protection: object_lock_governance 74 access_controls:

Policy source policy/controls/au9.rego

 1# AU-9 - Protection of Audit Information
 2# "Audit logs are written to a tamper-evident store. Access to logs is
 3# restricted to the ISSO and SOC personnel. Logs are encrypted at rest."
 4#
 5# Object Lock governance mode can be bypassed by privileged principals; only
 6# compliance mode is tamper-evident against all users.
 7
 8package ssp.compliance
 9
10default tamper_protection_ok := false
11
12tamper_protection_ok if input.logging.tamper_protection == "object_lock_compliance"
13
14log_reader_allowed(role) if role == "isso"
15
16log_reader_allowed(role) if startswith(role, "soc")
17
18unauthorized_log_readers := [r.role |
19	some r in log_readers
20	not log_reader_allowed(r.role)
21]
22
23unauthorized_log_reader_paths := [sprintf("logging.access_controls.readers.%d.role", [idx]) |
24	some idx, r in log_readers
25	not log_reader_allowed(r.role)
26]
27
28# "Logs are encrypted at rest." Nearest schema evidence: the s3-archive log
29# destination is object storage, which must be encrypted.
30default log_encryption_ok := false
31
32log_encryption_ok if input.storage.object_storage.encryption_at_rest == true
33
34checks contains {
35	"control": "AU-9", "id": "tamper-evident-storage",
36	"requirement": "Audit logs written to a tamper-evident store (Object Lock compliance mode; governance mode is bypassable by privileged users)",
37	"status": verdict(tamper_protection_ok),
38	"evidence": sprintf("logging.tamper_protection = %v", [object.get(input, ["logging", "tamper_protection"], "unset")]),
39	"paths": ["logging.tamper_protection"],
40}
41
42checks contains {
43	"control": "AU-9", "id": "log-access-restricted",
44	"requirement": "Log access restricted to the ISSO and SOC personnel",
45	"status": verdict(count(unauthorized_log_readers) == 0),
46	"evidence": sprintf("reader roles outside ISSO/SOC: %s", [csv(unauthorized_log_readers)]),
47	"paths": paths_or(unauthorized_log_reader_paths, ["logging.access_controls.readers"]),
48}
49
50checks contains {
51	"control": "AU-9", "id": "log-encryption-at-rest",
52	"requirement": "Logs encrypted at rest (s3-archive destination is object storage)",
53	"status": verdict(log_encryption_ok),
54	"evidence": sprintf("storage.object_storage.encryption_at_rest = %v", [object.get(input, ["storage", "object_storage", "encryption_at_rest"], "unset")]),
55	"paths": ["storage.object_storage.encryption_at_rest"],
56}

Failed CM-2 Baseline Configuration Passed: 3 Failed: 1 Needs evidence: 0

SSP statement

The system maintains a documented baseline configuration in version control. All infrastructure is declared as code. Drift from baseline is reviewed weekly by the engineering lead.

Check results

Findings, evidence, and cited source for checks under CM-2
Result	Check	Finding and evidence
Passed	Documented baseline configuration maintained in version control `baseline-documented`	config_management.baseline_doc_ref = ssp.md `docs/infrastructure.yaml:119` config_management.baseline_doc_ref 118 last_run: 2026-05-30 119 baseline_doc_ref: ssp.md
Passed	Drift detection enabled at weekly cadence or better `drift-detection-weekly`	drift_detection: enabled=true cadence=weekly `docs/infrastructure.yaml:116` config_management.drift_detection.enabled 115 drift_detection: 116 enabled: true 117 cadence: weekly `docs/infrastructure.yaml:117` config_management.drift_detection.cadence 116 enabled: true 117 cadence: weekly 118 last_run: 2026-05-30
Failed	Drift reviewed weekly: last run within 7 days of evaluation date `drift-review-current`	drift_detection.last_run = 2026-05-30 `docs/infrastructure.yaml:118` config_management.drift_detection.last_run 117 cadence: weekly 118 last_run: 2026-05-30 119 baseline_doc_ref: ssp.md
Passed	All infrastructure declared as code in version control `infrastructure-as-code`	config_management: tool=terraform repo=github.com/aegis-log/infra `docs/infrastructure.yaml:113` config_management.iac_tool 112config_management: 113 iac_tool: terraform 114 iac_repo: github.com/aegis-log/infra `docs/infrastructure.yaml:114` config_management.iac_repo 113 iac_tool: terraform 114 iac_repo: github.com/aegis-log/infra 115 drift_detection:

Policy source policy/controls/cm2.rego

 1# CM-2 - Baseline Configuration
 2# "The system maintains a documented baseline configuration in version
 3# control. All infrastructure is declared as code. Drift from baseline is
 4# reviewed weekly by the engineering lead."
 5
 6package ssp.compliance
 7
 8default iac_ok := false
 9
10iac_ok if {
11	input.config_management.iac_tool
12	count(input.config_management.iac_repo) > 0
13}
14
15default baseline_doc_ok := false
16
17baseline_doc_ok if count(input.config_management.baseline_doc_ref) > 0
18
19default drift_detection_ok := false
20
21drift_detection_ok if {
22	dd := input.config_management.drift_detection
23	dd.enabled == true
24	dd.cadence in {"hourly", "daily", "weekly"}
25}
26
27default drift_run_current_ok := false
28
29drift_run_current_ok if days_since(input.config_management.drift_detection.last_run) <= 7
30
31checks contains {
32	"control": "CM-2", "id": "infrastructure-as-code",
33	"requirement": "All infrastructure declared as code in version control",
34	"status": verdict(iac_ok),
35	"evidence": sprintf("config_management: tool=%v repo=%v", [object.get(input, ["config_management", "iac_tool"], "unset"), object.get(input, ["config_management", "iac_repo"], "unset")]),
36	"paths": ["config_management.iac_tool", "config_management.iac_repo"],
37}
38
39checks contains {
40	"control": "CM-2", "id": "baseline-documented",
41	"requirement": "Documented baseline configuration maintained in version control",
42	"status": verdict(baseline_doc_ok),
43	"evidence": sprintf("config_management.baseline_doc_ref = %v", [object.get(input, ["config_management", "baseline_doc_ref"], "unset")]),
44	"paths": ["config_management.baseline_doc_ref"],
45}
46
47checks contains {
48	"control": "CM-2", "id": "drift-detection-weekly",
49	"requirement": "Drift detection enabled at weekly cadence or better",
50	"status": verdict(drift_detection_ok),
51	"evidence": sprintf("drift_detection: enabled=%v cadence=%v", [object.get(input, ["config_management", "drift_detection", "enabled"], "unset"), object.get(input, ["config_management", "drift_detection", "cadence"], "unset")]),
52	"paths": ["config_management.drift_detection.enabled", "config_management.drift_detection.cadence"],
53}
54
55checks contains {
56	"control": "CM-2", "id": "drift-review-current",
57	"requirement": "Drift reviewed weekly: last run within 7 days of evaluation date",
58	"status": verdict(drift_run_current_ok),
59	"evidence": sprintf("drift_detection.last_run = %v", [object.get(input, ["config_management", "drift_detection", "last_run"], "unset")]),
60	"paths": ["config_management.drift_detection.last_run"],
61}

Failed CM-6 Configuration Settings Passed: 2 Failed: 1 Needs evidence: 1

SSP statement

All EC2 instances are hardened per the DISA STIG for Red Hat Enterprise Linux 8. All Kubernetes clusters are configured per the Kubernetes STIG. Container images are scanned against the DoD Iron Bank baseline before deployment.

Check results

Findings, evidence, and cited source for checks under CM-6
Result	Check	Finding and evidence
Needs evidence	Container images scanned against the DoD Iron Bank baseline before deployment `iron-bank-image-scanning`	Image scanning is not represented in the infrastructure schema No repository field can prove this claim.
Passed	Kubernetes clusters configured per the Kubernetes STIG `kubernetes-stig-hardening`	compute.kubernetes.stig_hardened = true `docs/infrastructure.yaml:52` compute.kubernetes.stig_hardened 51 version: "1.28.4" 52 stig_hardened: true 53 cis_benchmark_score: 87
Failed	No open high-severity scan findings on STIG-hardened nodes `no-open-high-findings`	compute.nodes.open_findings_high = 2 (last_scan 2026-05-22) `docs/infrastructure.yaml:58` compute.nodes.open_findings_high 57 last_scan: 2026-05-22 58 open_findings_high: 2 59 open_findings_medium: 14
Passed	EC2 instances hardened per DISA STIG for RHEL 8 `node-stig-hardening`	compute.nodes: os=rhel-8 stig_hardened=true `docs/infrastructure.yaml:56` compute.nodes.stig_hardened 55 os: rhel-8 56 stig_hardened: true 57 last_scan: 2026-05-22

Policy source policy/controls/cm6.rego

 1# CM-6 - Configuration Settings
 2# "All EC2 instances are hardened per the DISA STIG for Red Hat Enterprise
 3# Linux 8. All Kubernetes clusters are configured per the Kubernetes STIG.
 4# Container images are scanned against the DoD Iron Bank baseline before
 5# deployment."
 6
 7package ssp.compliance
 8
 9default nodes_stig_ok := false
10
11nodes_stig_ok if input.compute.nodes.stig_hardened == true
12
13default k8s_stig_ok := false
14
15k8s_stig_ok if input.compute.kubernetes.stig_hardened == true
16
17# A system hardened per STIG should carry no open high-severity findings.
18default no_high_findings_ok := false
19
20no_high_findings_ok if input.compute.nodes.open_findings_high == 0
21
22checks contains {
23	"control": "CM-6", "id": "node-stig-hardening",
24	"requirement": "EC2 instances hardened per DISA STIG for RHEL 8",
25	"status": verdict(nodes_stig_ok),
26	"evidence": sprintf("compute.nodes: os=%v stig_hardened=%v", [object.get(input, ["compute", "nodes", "os"], "unset"), object.get(input, ["compute", "nodes", "stig_hardened"], "unset")]),
27	"paths": ["compute.nodes.stig_hardened"],
28}
29
30checks contains {
31	"control": "CM-6", "id": "kubernetes-stig-hardening",
32	"requirement": "Kubernetes clusters configured per the Kubernetes STIG",
33	"status": verdict(k8s_stig_ok),
34	"evidence": sprintf("compute.kubernetes.stig_hardened = %v", [object.get(input, ["compute", "kubernetes", "stig_hardened"], "unset")]),
35	"paths": ["compute.kubernetes.stig_hardened"],
36}
37
38checks contains {
39	"control": "CM-6", "id": "no-open-high-findings",
40	"requirement": "No open high-severity scan findings on STIG-hardened nodes",
41	"status": verdict(no_high_findings_ok),
42	"evidence": sprintf("compute.nodes.open_findings_high = %v (last_scan %v)", [object.get(input, ["compute", "nodes", "open_findings_high"], "unset"), object.get(input, ["compute", "nodes", "last_scan"], "unset")]),
43	"paths": ["compute.nodes.open_findings_high"],
44}
45
46checks contains {
47	"control": "CM-6", "id": "iron-bank-image-scanning",
48	"requirement": "Container images scanned against the DoD Iron Bank baseline before deployment",
49	"status": "manual",
50	"evidence": "Image scanning is not represented in the infrastructure schema",
51	"paths": [],
52}

Failed CP-9 System Backup Passed: 2 Failed: 1 Needs evidence: 1

SSP statement

User data and system configuration are backed up daily. Backups are encrypted and stored in a geographically separate AWS region. Backup restoration is tested quarterly.

Check results

Findings, evidence, and cited source for checks under CP-9
Result	Check	Finding and evidence
Needs evidence	Backups are encrypted `backup-encryption`	No backup-encryption field in the schema; source volumes are covered under SC-28 No repository field can prove this claim.
Passed	User data and system configuration backed up daily `daily-backups`	storage.database.backup_cadence = daily `docs/infrastructure.yaml:85` storage.database.backup_cadence 84 kms_key_rotation: enabled 85 backup_cadence: daily 86 backup_region: us-gov-east-1
Passed	Backups stored in a geographically separate AWS region `geographically-separate-backups`	system.region = us-gov-west-1, backup_region = us-gov-east-1 `docs/infrastructure.yaml:86` storage.database.backup_region 85 backup_cadence: daily 86 backup_region: us-gov-east-1 87 last_restore_test: 2025-09-14 `docs/infrastructure.yaml:5` system.region 4 environment: production 5 region: us-gov-west-1
Failed	Backup restoration tested quarterly: last test within 92 days of evaluation date `quarterly-restore-test`	storage.database.last_restore_test = 2025-09-14 `docs/infrastructure.yaml:87` storage.database.last_restore_test 86 backup_region: us-gov-east-1 87 last_restore_test: 2025-09-14 88 object_storage:

Policy source policy/controls/cp9.rego

 1# CP-9 - System Backup
 2# "User data and system configuration are backed up daily. Backups are
 3# encrypted and stored in a geographically separate AWS region. Backup
 4# restoration is tested quarterly."
 5
 6package ssp.compliance
 7
 8default backup_cadence_ok := false
 9
10backup_cadence_ok if input.storage.database.backup_cadence in {"hourly", "daily"}
11
12default backup_region_ok := false
13
14backup_region_ok if {
15	br := input.storage.database.backup_region
16	br != input.system.region
17}
18
19default restore_test_ok := false
20
21restore_test_ok if days_since(input.storage.database.last_restore_test) <= 92
22
23checks contains {
24	"control": "CP-9", "id": "daily-backups",
25	"requirement": "User data and system configuration backed up daily",
26	"status": verdict(backup_cadence_ok),
27	"evidence": sprintf("storage.database.backup_cadence = %v", [object.get(input, ["storage", "database", "backup_cadence"], "unset")]),
28	"paths": ["storage.database.backup_cadence"],
29}
30
31checks contains {
32	"control": "CP-9", "id": "geographically-separate-backups",
33	"requirement": "Backups stored in a geographically separate AWS region",
34	"status": verdict(backup_region_ok),
35	"evidence": sprintf("system.region = %v, backup_region = %v", [object.get(input, ["system", "region"], "unset"), object.get(input, ["storage", "database", "backup_region"], "unset")]),
36	"paths": ["storage.database.backup_region", "system.region"],
37}
38
39checks contains {
40	"control": "CP-9", "id": "quarterly-restore-test",
41	"requirement": "Backup restoration tested quarterly: last test within 92 days of evaluation date",
42	"status": verdict(restore_test_ok),
43	"evidence": sprintf("storage.database.last_restore_test = %v", [object.get(input, ["storage", "database", "last_restore_test"], "unset")]),
44	"paths": ["storage.database.last_restore_test"],
45}
46
47checks contains {
48	"control": "CP-9", "id": "backup-encryption",
49	"requirement": "Backups are encrypted",
50	"status": "manual",
51	"evidence": "No backup-encryption field in the schema; source volumes are covered under SC-28",
52	"paths": [],
53}

Failed IA-2 Identification and Authentication Passed: 3 Failed: 1 Needs evidence: 0

SSP statement

All human users authenticate via CAC/PIV. Multi-factor authentication is required for all administrative actions. Service-to-service authentication uses short-lived tokens issued by the platform identity broker.

Check results

Findings, evidence, and cited source for checks under IA-2
Result	Check	Finding and evidence
Passed	All human users authenticate via CAC/PIV `cac-piv-authentication`	identity.human_auth: method=oidc cac_piv_integration=true `docs/infrastructure.yaml:12` identity.human_auth.cac_piv_integration 11 mfa_required: true 12 cac_piv_integration: true 13 service_auth:
Passed	Multi-factor authentication required for administrative actions `mfa-required`	identity.human_auth.mfa_required = true `docs/infrastructure.yaml:11` identity.human_auth.mfa_required 10 provider: okta-fed 11 mfa_required: true 12 cac_piv_integration: true
Failed	No long-lived service credentials (contradicts short-lived broker-issued tokens) `no-long-lived-service-credentials`	long-lived access keys: deploy-bot, legacy-etl `docs/infrastructure.yaml:21` identity.iam_users.0.type 20 last_rotated: 2024-11-15 21 type: long_lived_access_key 22 - name: legacy-etl `docs/infrastructure.yaml:25` identity.iam_users.1.type 24 last_rotated: 2023-01-08 25 type: long_lived_access_key
Passed	Service-to-service auth uses short-lived tokens (TTL <= 3600s, not api_key) `short-lived-service-tokens`	identity.service_auth: method=spiffe token_ttl=3600 `docs/infrastructure.yaml:14` identity.service_auth.method 13 service_auth: 14 method: spiffe 15 token_ttl: 3600 `docs/infrastructure.yaml:15` identity.service_auth.token_ttl 14 method: spiffe 15 token_ttl: 3600 16 account_review_cadence_days: 90

Policy source policy/controls/ia2.rego

 1# IA-2 - Identification and Authentication
 2# "All human users authenticate via CAC/PIV. Multi-factor authentication is
 3# required for all administrative actions. Service-to-service authentication
 4# uses short-lived tokens issued by the platform identity broker."
 5
 6package ssp.compliance
 7
 8default cac_piv_ok := false
 9
10cac_piv_ok if input.identity.human_auth.cac_piv_integration == true
11
12default mfa_ok := false
13
14mfa_ok if input.identity.human_auth.mfa_required == true
15
16default service_tokens_ok := false
17
18service_tokens_ok if {
19	sa := input.identity.service_auth
20	sa.method != "api_key"
21	sa.token_ttl <= 3600 # "short-lived": at most one hour
22}
23
24checks contains {
25	"control": "IA-2", "id": "cac-piv-authentication",
26	"requirement": "All human users authenticate via CAC/PIV",
27	"status": verdict(cac_piv_ok),
28	"evidence": sprintf("identity.human_auth: method=%v cac_piv_integration=%v", [object.get(input, ["identity", "human_auth", "method"], "unset"), object.get(input, ["identity", "human_auth", "cac_piv_integration"], "unset")]),
29	"paths": ["identity.human_auth.cac_piv_integration"],
30}
31
32checks contains {
33	"control": "IA-2", "id": "mfa-required",
34	"requirement": "Multi-factor authentication required for administrative actions",
35	"status": verdict(mfa_ok),
36	"evidence": sprintf("identity.human_auth.mfa_required = %v", [object.get(input, ["identity", "human_auth", "mfa_required"], "unset")]),
37	"paths": ["identity.human_auth.mfa_required"],
38}
39
40checks contains {
41	"control": "IA-2", "id": "short-lived-service-tokens",
42	"requirement": "Service-to-service auth uses short-lived tokens (TTL <= 3600s, not api_key)",
43	"status": verdict(service_tokens_ok),
44	"evidence": sprintf("identity.service_auth: method=%v token_ttl=%v", [object.get(input, ["identity", "service_auth", "method"], "unset"), object.get(input, ["identity", "service_auth", "token_ttl"], "unset")]),
45	"paths": ["identity.service_auth.method", "identity.service_auth.token_ttl"],
46}
47
48checks contains {
49	"control": "IA-2", "id": "no-long-lived-service-credentials",
50	"requirement": "No long-lived service credentials (contradicts short-lived broker-issued tokens)",
51	"status": verdict(count(long_lived_service_creds) == 0),
52	"evidence": sprintf("long-lived access keys: %s", [csv(long_lived_service_creds)]),
53	"paths": paths_or(long_lived_service_cred_paths, ["identity.iam_users"]),
54}

Failed IA-5 Authenticator Management Passed: 0 Failed: 1 Needs evidence: 1

SSP statement

Passwords, where used for break-glass access, conform to DoD password complexity requirements: minimum 15 characters, complexity requirements per DoD policy, rotation every 60 days.

Check results

Findings, evidence, and cited source for checks under IA-5
Result	Check	Finding and evidence
Failed	Authenticators rotated every 60 days (applied to long-lived IAM access keys) `authenticator-rotation-60d`	keys rotated more than 60 days before evaluation date: deploy-bot, legacy-etl `docs/infrastructure.yaml:20` identity.iam_users.0.last_rotated 19 created: 2022-04-01 20 last_rotated: 2024-11-15 21 type: long_lived_access_key `docs/infrastructure.yaml:24` identity.iam_users.1.last_rotated 23 created: 2022-09-12 24 last_rotated: 2023-01-08 25 type: long_lived_access_key
Needs evidence	Break-glass passwords: minimum 15 characters, DoD complexity, 60-day rotation `password-complexity`	Password policy is not represented in the infrastructure schema No repository field can prove this claim.

Policy source policy/controls/ia5.rego

 1# IA-5 - Authenticator Management
 2# "Passwords, where used for break-glass access, conform to DoD password
 3# complexity requirements: minimum 15 characters, complexity requirements per
 4# DoD policy, rotation every 60 days."
 5#
 6# The 60-day rotation requirement is applied to the only rotatable
 7# authenticators in the schema: long-lived IAM access keys.
 8
 9package ssp.compliance
10
11authenticator_stale(u) if not u.last_rotated
12
13authenticator_stale(u) if days_since(u.last_rotated) > 60
14
15stale_authenticators := [u.name |
16	some u in iam_users
17	u.type == "long_lived_access_key"
18	authenticator_stale(u)
19]
20
21stale_authenticator_paths := [sprintf("identity.iam_users.%d.last_rotated", [idx]) |
22	some idx, u in iam_users
23	u.type == "long_lived_access_key"
24	authenticator_stale(u)
25]
26
27checks contains {
28	"control": "IA-5", "id": "authenticator-rotation-60d",
29	"requirement": "Authenticators rotated every 60 days (applied to long-lived IAM access keys)",
30	"status": verdict(count(stale_authenticators) == 0),
31	"evidence": sprintf("keys rotated more than 60 days before evaluation date: %s", [csv(stale_authenticators)]),
32	"paths": paths_or(stale_authenticator_paths, ["identity.iam_users"]),
33}
34
35checks contains {
36	"control": "IA-5", "id": "password-complexity",
37	"requirement": "Break-glass passwords: minimum 15 characters, DoD complexity, 60-day rotation",
38	"status": "manual",
39	"evidence": "Password policy is not represented in the infrastructure schema",
40	"paths": [],
41}

Failed SC-13 Cryptographic Protection Passed: 1 Failed: 1 Needs evidence: 0

SSP statement

All cryptographic modules in use are FIPS 140-2 validated. The system does not use any cryptographic primitive that has not been validated.

Check results

Findings, evidence, and cited source for checks under SC-13
Result	Check	Finding and evidence
Passed	FIPS 140-2 validated cryptographic modules (FIPS mode enabled) `fips-mode-enabled`	crypto.fips_mode = enabled `docs/infrastructure.yaml:95` crypto.fips_mode 94 tls_library: openssl-3.0 95 fips_mode: enabled 96 modules_in_use:
Failed	No non-validated cryptographic primitive in use (non-validated modules need an unexpired waiver) `fips-validated-modules-only`	non-validated modules without a current waiver: legacy-etl (uses openssl-1.1.1) `docs/infrastructure.yaml:100` crypto.legacy_exceptions.0 99 legacy_exceptions: 100 - service: legacy-etl 101 uses: openssl-1.1.1 102 fips_validated: false 103 waiver_expires: 2025-12-31 # expired

Policy source policy/controls/sc13.rego

 1# SC-13 - Cryptographic Protection
 2# "All cryptographic modules in use are FIPS 140-2 validated. The system does
 3# not use any cryptographic primitive that has not been validated."
 4#
 5# A non-validated module is tolerated only under an unexpired waiver.
 6
 7package ssp.compliance
 8
 9default fips_mode_ok := false
10
11fips_mode_ok if input.crypto.fips_mode == "enabled"
12
13crypto_exception_ok(e) if e.fips_validated == true
14
15crypto_exception_ok(e) if days_since(e.waiver_expires) < 0
16
17invalid_crypto_exceptions := [sprintf("%s (uses %s)", [e.service, e.uses]) |
18	some e in legacy_exceptions
19	not crypto_exception_ok(e)
20]
21
22invalid_crypto_exception_paths := [sprintf("crypto.legacy_exceptions.%d", [idx]) |
23	some idx, e in legacy_exceptions
24	not crypto_exception_ok(e)
25]
26
27checks contains {
28	"control": "SC-13", "id": "fips-mode-enabled",
29	"requirement": "FIPS 140-2 validated cryptographic modules (FIPS mode enabled)",
30	"status": verdict(fips_mode_ok),
31	"evidence": sprintf("crypto.fips_mode = %v", [object.get(input, ["crypto", "fips_mode"], "unset")]),
32	"paths": ["crypto.fips_mode"],
33}
34
35checks contains {
36	"control": "SC-13", "id": "fips-validated-modules-only",
37	"requirement": "No non-validated cryptographic primitive in use (non-validated modules need an unexpired waiver)",
38	"status": verdict(count(invalid_crypto_exceptions) == 0),
39	"evidence": sprintf("non-validated modules without a current waiver: %s", [csv(invalid_crypto_exceptions)]),
40	"paths": paths_or(invalid_crypto_exception_paths, ["crypto.legacy_exceptions"]),
41}

Failed SC-7 Boundary Protection Passed: 1 Failed: 1 Needs evidence: 0

SSP statement

The system enforces boundary protection through AWS security groups, a managed WAF, and network ACLs. All ingress traffic is inspected. Egress is restricted to an allowlist of approved external endpoints.

Check results

Findings, evidence, and cited source for checks under SC-7
Result	Check	Finding and evidence
Passed	Egress restricted to an allowlist of approved endpoints `egress-allowlist`	network.egress: mode=allowlist endpoints=4 `docs/infrastructure.yaml:38` network.egress.mode 37 egress: 38 mode: allowlist 39 allowed_endpoints: `docs/infrastructure.yaml:39` network.egress.allowed_endpoints 38 mode: allowlist 39 allowed_endpoints: 40 - ".amazonaws.com" 41 - "iron-bank.dso.mil" 42 - "api.partner-system.mil" 43 - ".github.com" # added 2025-03 for CI artifact pulls 44 vpn:
Failed	All ingress traffic inspected by the managed WAF `waf-on-all-ingress`	ingress without WAF: nlb `docs/infrastructure.yaml:35` network.ingress.1.waf_attached 34 tls_version_min: "1.0" # legacy partner integration 35 waf_attached: false 36 public: false

Policy source policy/controls/sc7.rego

 1# SC-7 - Boundary Protection
 2# "The system enforces boundary protection through AWS security groups, a
 3# managed WAF, and network ACLs. All ingress traffic is inspected. Egress is
 4# restricted to an allowlist of approved external endpoints."
 5
 6package ssp.compliance
 7
 8ingress_without_waf := [i.type |
 9	some i in ingress
10	object.get(i, "waf_attached", false) != true
11]
12
13ingress_without_waf_paths := [sprintf("network.ingress.%d.waf_attached", [idx]) |
14	some idx, i in ingress
15	object.get(i, "waf_attached", false) != true
16]
17
18default egress_allowlist_ok := false
19
20egress_allowlist_ok if {
21	input.network.egress.mode == "allowlist"
22	count(input.network.egress.allowed_endpoints) > 0
23}
24
25checks contains {
26	"control": "SC-7", "id": "waf-on-all-ingress",
27	"requirement": "All ingress traffic inspected by the managed WAF",
28	"status": verdict(count(ingress_without_waf) == 0),
29	"evidence": sprintf("ingress without WAF: %s", [csv(ingress_without_waf)]),
30	"paths": paths_or(ingress_without_waf_paths, ["network.ingress"]),
31}
32
33checks contains {
34	"control": "SC-7", "id": "egress-allowlist",
35	"requirement": "Egress restricted to an allowlist of approved endpoints",
36	"status": verdict(egress_allowlist_ok),
37	"evidence": sprintf("network.egress: mode=%v endpoints=%v", [object.get(input, ["network", "egress", "mode"], "unset"), count(object.get(input, ["network", "egress", "allowed_endpoints"], []))]),
38	"paths": ["network.egress.mode", "network.egress.allowed_endpoints"],
39}

Failed SC-8 Transmission Confidentiality and Integrity Passed: 1 Failed: 1 Needs evidence: 0

SSP statement

All data in transit is protected using TLS 1.2 or higher. Mutual TLS is used for service-to-service communication within the cluster.

Check results

Findings, evidence, and cited source for checks under SC-8
Result	Check	Finding and evidence
Passed	Mutual TLS for service-to-service communication (mtls or spiffe) `mutual-tls-service-auth`	identity.service_auth.method = spiffe `docs/infrastructure.yaml:14` identity.service_auth.method 13 service_auth: 14 method: spiffe 15 token_ttl: 3600
Failed	All data in transit protected with TLS 1.2 or higher `tls-1.2-minimum`	ingress below TLS 1.2: nlb (1.0) `docs/infrastructure.yaml:34` network.ingress.1.tls_version_min 33 - type: nlb 34 tls_version_min: "1.0" # legacy partner integration 35 waf_attached: false

Policy source policy/controls/sc8.rego

 1# SC-8 - Transmission Confidentiality and Integrity
 2# "All data in transit is protected using TLS 1.2 or higher. Mutual TLS is
 3# used for service-to-service communication within the cluster."
 4
 5package ssp.compliance
 6
 7weak_tls_ingress := [sprintf("%s (%s)", [i.type, object.get(i, "tls_version_min", "unset")]) |
 8	some i in ingress
 9	not object.get(i, "tls_version_min", "unset") in {"1.2", "1.3"}
10]
11
12weak_tls_ingress_paths := [sprintf("network.ingress.%d.tls_version_min", [idx]) |
13	some idx, i in ingress
14	not object.get(i, "tls_version_min", "unset") in {"1.2", "1.3"}
15]
16
17default mtls_ok := false
18
19# SPIFFE identities are delivered over mTLS; both satisfy the SSP claim.
20mtls_ok if input.identity.service_auth.method in {"mtls", "spiffe"}
21
22checks contains {
23	"control": "SC-8", "id": "tls-1.2-minimum",
24	"requirement": "All data in transit protected with TLS 1.2 or higher",
25	"status": verdict(count(weak_tls_ingress) == 0),
26	"evidence": sprintf("ingress below TLS 1.2: %s", [csv(weak_tls_ingress)]),
27	"paths": paths_or(weak_tls_ingress_paths, ["network.ingress"]),
28}
29
30checks contains {
31	"control": "SC-8", "id": "mutual-tls-service-auth",
32	"requirement": "Mutual TLS for service-to-service communication (mtls or spiffe)",
33	"status": verdict(mtls_ok),
34	"evidence": sprintf("identity.service_auth.method = %v", [object.get(input, ["identity", "service_auth", "method"], "unset")]),
35	"paths": ["identity.service_auth.method"],
36}

Failed SI-4 System Monitoring Passed: 3 Failed: 1 Needs evidence: 0

SSP statement

The system is monitored continuously for indicators of compromise. Alerts are forwarded to the program SOC. Anomalous behavior triggers an automated incident response workflow.`

Check results

Findings, evidence, and cited source for checks under SI-4
Result	Check	Finding and evidence
Failed	Anomalous behavior triggers an automated incident response workflow `automated-incident-response`	monitoring.automated_response = partial `docs/infrastructure.yaml:109` monitoring.automated_response 108 ioc_feeds: enabled 109 automated_response: partial 110 soc_integration: true
Passed	Continuous monitoring for indicators of compromise (SIEM and EDR deployed) `continuous-monitoring`	monitoring: siem=splunk-cloud-gov edr=crowdstrike-falcon-gov `docs/infrastructure.yaml:106` monitoring.siem 105monitoring: 106 siem: splunk-cloud-gov 107 edr: crowdstrike-falcon-gov `docs/infrastructure.yaml:107` monitoring.edr 106 siem: splunk-cloud-gov 107 edr: crowdstrike-falcon-gov 108 ioc_feeds: enabled
Passed	Indicator-of-compromise feeds enabled `ioc-feeds`	monitoring.ioc_feeds = enabled `docs/infrastructure.yaml:108` monitoring.ioc_feeds 107 edr: crowdstrike-falcon-gov 108 ioc_feeds: enabled 109 automated_response: partial
Passed	Alerts forwarded to the program SOC `soc-integration`	monitoring.soc_integration = true `docs/infrastructure.yaml:110` monitoring.soc_integration 109 automated_response: partial 110 soc_integration: true

Policy source policy/controls/si4.rego

 1# SI-4 - System Monitoring
 2# "The system is monitored continuously for indicators of compromise. Alerts
 3# are forwarded to the program SOC. Anomalous behavior triggers an automated
 4# incident response workflow."
 5
 6package ssp.compliance
 7
 8default continuous_monitoring_ok := false
 9
10continuous_monitoring_ok if {
11	count(object.get(input, ["monitoring", "siem"], "")) > 0
12	count(object.get(input, ["monitoring", "edr"], "")) > 0
13}
14
15default ioc_feeds_ok := false
16
17ioc_feeds_ok if input.monitoring.ioc_feeds == "enabled"
18
19default soc_integration_ok := false
20
21soc_integration_ok if input.monitoring.soc_integration == true
22
23default automated_response_ok := false
24
25automated_response_ok if input.monitoring.automated_response == "full"
26
27checks contains {
28	"control": "SI-4", "id": "continuous-monitoring",
29	"requirement": "Continuous monitoring for indicators of compromise (SIEM and EDR deployed)",
30	"status": verdict(continuous_monitoring_ok),
31	"evidence": sprintf("monitoring: siem=%v edr=%v", [object.get(input, ["monitoring", "siem"], "unset"), object.get(input, ["monitoring", "edr"], "unset")]),
32	"paths": ["monitoring.siem", "monitoring.edr"],
33}
34
35checks contains {
36	"control": "SI-4", "id": "ioc-feeds",
37	"requirement": "Indicator-of-compromise feeds enabled",
38	"status": verdict(ioc_feeds_ok),
39	"evidence": sprintf("monitoring.ioc_feeds = %v", [object.get(input, ["monitoring", "ioc_feeds"], "unset")]),
40	"paths": ["monitoring.ioc_feeds"],
41}
42
43checks contains {
44	"control": "SI-4", "id": "soc-integration",
45	"requirement": "Alerts forwarded to the program SOC",
46	"status": verdict(soc_integration_ok),
47	"evidence": sprintf("monitoring.soc_integration = %v", [object.get(input, ["monitoring", "soc_integration"], "unset")]),
48	"paths": ["monitoring.soc_integration"],
49}
50
51checks contains {
52	"control": "SI-4", "id": "automated-incident-response",
53	"requirement": "Anomalous behavior triggers an automated incident response workflow",
54	"status": verdict(automated_response_ok),
55	"evidence": sprintf("monitoring.automated_response = %v", [object.get(input, ["monitoring", "automated_response"], "unset")]),
56	"paths": ["monitoring.automated_response"],
57}

Needs evidence AC-2 Account Management Passed: 1 Failed: 0 Needs evidence: 1

SSP statement

The AEGIS-LOG system uses centralized identity management via the DoD CAC/PIV infrastructure for all human users. Service accounts are managed through AWS IAM with quarterly access reviews. All accounts are reviewed by the ISSO within 30 days of personnel changes.

Check results

Findings, evidence, and cited source for checks under AC-2
Result	Check	Finding and evidence
Passed	Service accounts reviewed at least quarterly (<= 90 days) `account-review-cadence`	identity.account_review_cadence_days = 90 `docs/infrastructure.yaml:16` identity.account_review_cadence_days 15 token_ttl: 3600 16 account_review_cadence_days: 90 17 iam_users:
Needs evidence	Accounts reviewed by the ISSO within 30 days of personnel changes `personnel-change-review`	Process control; not represented in the infrastructure schema No repository field can prove this claim.

Policy source policy/controls/ac2.rego

 1# AC-2 - Account Management
 2# "Service accounts are managed through AWS IAM with quarterly access
 3# reviews. All accounts are reviewed by the ISSO within 30 days of personnel
 4# changes."
 5
 6package ssp.compliance
 7
 8default account_review_cadence_ok := false
 9
10account_review_cadence_ok if input.identity.account_review_cadence_days <= 90
11
12checks contains {
13	"control": "AC-2", "id": "account-review-cadence",
14	"requirement": "Service accounts reviewed at least quarterly (<= 90 days)",
15	"status": verdict(account_review_cadence_ok),
16	"evidence": sprintf("identity.account_review_cadence_days = %v", [object.get(input, ["identity", "account_review_cadence_days"], "unset")]),
17	"paths": ["identity.account_review_cadence_days"],
18}
19
20checks contains {
21	"control": "AC-2", "id": "personnel-change-review",
22	"requirement": "Accounts reviewed by the ISSO within 30 days of personnel changes",
23	"status": "manual",
24	"evidence": "Process control; not represented in the infrastructure schema",
25	"paths": [],
26}

Needs evidence AC-3 Access Enforcement Passed: 0 Failed: 0 Needs evidence: 1

SSP statement

Role-based access control is enforced at the application layer. Three roles are defined: read-only viewer, operator, and administrator. All access decisions are logged.

Check results

Findings, evidence, and cited source for checks under AC-3
Result	Check	Finding and evidence
Needs evidence	Three application-layer roles (viewer, operator, administrator) with logged access decisions `application-rbac`	Application-layer RBAC is not represented in the infrastructure schema No repository field can prove this claim.

Policy source policy/controls/ac3.rego

 1# AC-3 - Access Enforcement
 2# "Role-based access control is enforced at the application layer. Three
 3# roles are defined ... All access decisions are logged."
 4
 5package ssp.compliance
 6
 7checks contains {
 8	"control": "AC-3", "id": "application-rbac",
 9	"requirement": "Three application-layer roles (viewer, operator, administrator) with logged access decisions",
10	"status": "manual",
11	"evidence": "Application-layer RBAC is not represented in the infrastructure schema",
12	"paths": [],
13}

Passed AC-17 Remote Access Passed: 2 Failed: 0 Needs evidence: 0

SSP statement

All remote access to AEGIS-LOG occurs over the DoDIN via approved VPN endpoints. Direct internet exposure of any system component is prohibited. Administrative access requires jump host traversal.

Check results

Findings, evidence, and cited source for checks under AC-17
Result	Check	Finding and evidence
Passed	Administrative access requires VPN (jump host traversal over DoDIN) `admin-vpn-required`	network.vpn.required_for_admin = true `docs/infrastructure.yaml:45` network.vpn.required_for_admin 44 vpn: 45 required_for_admin: true 46 provider: dod-cap
Passed	Direct internet exposure of any component is prohibited `no-public-ingress`	public ingress endpoints: none `docs/infrastructure.yaml:28` network.ingress 27network: 28 ingress: 29 - type: alb 30 tls_version_min: "1.2" 31 waf_attached: true 32 public: false 33 - type: nlb 34 tls_version_min: "1.0" # legacy partner integration 35 waf_attached: false 36 public: false 37 egress:

Policy source policy/controls/ac17.rego

 1# AC-17 - Remote Access
 2# "All remote access to AEGIS-LOG occurs over the DoDIN via approved VPN
 3# endpoints. Direct internet exposure of any system component is prohibited.
 4# Administrative access requires jump host traversal."
 5
 6package ssp.compliance
 7
 8public_ingress := [i.type |
 9	some i in ingress
10	object.get(i, "public", true) == true
11]
12
13public_ingress_paths := [sprintf("network.ingress.%d.public", [idx]) |
14	some idx, i in ingress
15	object.get(i, "public", true) == true
16]
17
18default admin_vpn_ok := false
19
20admin_vpn_ok if input.network.vpn.required_for_admin == true
21
22checks contains {
23	"control": "AC-17", "id": "no-public-ingress",
24	"requirement": "Direct internet exposure of any component is prohibited",
25	"status": verdict(count(public_ingress) == 0),
26	"evidence": sprintf("public ingress endpoints: %s", [csv(public_ingress)]),
27	"paths": paths_or(public_ingress_paths, ["network.ingress"]),
28}
29
30checks contains {
31	"control": "AC-17", "id": "admin-vpn-required",
32	"requirement": "Administrative access requires VPN (jump host traversal over DoDIN)",
33	"status": verdict(admin_vpn_ok),
34	"evidence": sprintf("network.vpn.required_for_admin = %v", [object.get(input, ["network", "vpn", "required_for_admin"], "unset")]),
35	"paths": ["network.vpn.required_for_admin"],
36}

Passed SC-28 Protection of Information at Rest Passed: 3 Failed: 0 Needs evidence: 0

SSP statement

All data at rest is encrypted using AES-256. Encryption keys are managed in AWS KMS with automatic annual rotation. Database storage volumes, object storage, and backup volumes are all encrypted.

Check results

Findings, evidence, and cited source for checks under SC-28
Result	Check	Finding and evidence
Passed	Database storage volumes encrypted at rest `database-encryption`	storage.database.encryption_at_rest = true `docs/infrastructure.yaml:83` storage.database.encryption_at_rest 82 engine: aurora-postgres 83 encryption_at_rest: true 84 kms_key_rotation: enabled
Passed	Encryption keys managed in AWS KMS with automatic rotation `kms-key-rotation`	storage.database.kms_key_rotation = enabled `docs/infrastructure.yaml:84` storage.database.kms_key_rotation 83 encryption_at_rest: true 84 kms_key_rotation: enabled 85 backup_cadence: daily
Passed	Object storage encrypted at rest with AES-256 `object-storage-encryption`	storage.object_storage: encryption_at_rest=true algorithm=AES256 `docs/infrastructure.yaml:89` storage.object_storage.encryption_at_rest 88 object_storage: 89 encryption_at_rest: true 90 encryption_algorithm: AES256 `docs/infrastructure.yaml:90` storage.object_storage.encryption_algorithm 89 encryption_at_rest: true 90 encryption_algorithm: AES256 91 versioning: enabled

Policy source policy/controls/sc28.rego

 1# SC-28 - Protection of Information at Rest
 2# "All data at rest is encrypted using AES-256. Encryption keys are managed
 3# in AWS KMS with automatic annual rotation. Database storage volumes, object
 4# storage, and backup volumes are all encrypted."
 5
 6package ssp.compliance
 7
 8default db_encryption_ok := false
 9
10db_encryption_ok if input.storage.database.encryption_at_rest == true
11
12default object_encryption_ok := false
13
14object_encryption_ok if input.storage.object_storage.encryption_at_rest == true
15
16default kms_rotation_ok := false
17
18kms_rotation_ok if input.storage.database.kms_key_rotation == "enabled"
19
20checks contains {
21	"control": "SC-28", "id": "database-encryption",
22	"requirement": "Database storage volumes encrypted at rest",
23	"status": verdict(db_encryption_ok),
24	"evidence": sprintf("storage.database.encryption_at_rest = %v", [object.get(input, ["storage", "database", "encryption_at_rest"], "unset")]),
25	"paths": ["storage.database.encryption_at_rest"],
26}
27
28checks contains {
29	"control": "SC-28", "id": "object-storage-encryption",
30	"requirement": "Object storage encrypted at rest with AES-256",
31	"status": verdict(object_encryption_ok),
32	"evidence": sprintf("storage.object_storage: encryption_at_rest=%v algorithm=%v", [object.get(input, ["storage", "object_storage", "encryption_at_rest"], "unset"), object.get(input, ["storage", "object_storage", "encryption_algorithm"], "unset")]),
33	"paths": ["storage.object_storage.encryption_at_rest", "storage.object_storage.encryption_algorithm"],
34}
35
36checks contains {
37	"control": "SC-28", "id": "kms-key-rotation",
38	"requirement": "Encryption keys managed in AWS KMS with automatic rotation",
39	"status": verdict(kms_rotation_ok),
40	"evidence": sprintf("storage.database.kms_key_rotation = %v", [object.get(input, ["storage", "database", "kms_key_rotation"], "unset")]),
41	"paths": ["storage.database.kms_key_rotation"],
42}