AEGIS-LOG audit readiness

Compares System Security Plan claims with executable checks against available repository evidence.

Infrastructure

Current infrastructure Remediated infrastructure

Assessment readiness

Evidence incomplete

No checks fail, but one or more SSP claims remain unproven.

Failed: 0
Needs evidence: 5
Passed: 10

Evaluated: 2026-07-17
Evidence source: docs/infrastructure.remediated.yaml
Source timestamp: 2026-07-16 21:14 UTC
SSP version: 2.3 · reviewed 2024-08-12

Control results

Sorted by failed controls, evidence gaps, then passing controls.

15 controls evaluated

Status Control Control name Checks Details

Needs evidence AC-2 Account Management Passed: 1 Failed: 0 Needs evidence: 1

SSP statement

The AEGIS-LOG system uses centralized identity management via the DoD CAC/PIV infrastructure for all human users. Service accounts are managed through AWS IAM with quarterly access reviews. All accounts are reviewed by the ISSO within 30 days of personnel changes.

Check results

Findings, evidence, and cited source for checks under AC-2
Result	Check	Finding and evidence
Passed	Service accounts reviewed at least quarterly (<= 90 days) `account-review-cadence`	identity.account_review_cadence_days = 90 `docs/infrastructure.remediated.yaml:23` identity.account_review_cadence_days 22 token_ttl: 3600 23 account_review_cadence_days: 90 24 iam_users:
Needs evidence	Accounts reviewed by the ISSO within 30 days of personnel changes `personnel-change-review`	Process control; not represented in the infrastructure schema No repository field can prove this claim.

Policy source policy/controls/ac2.rego

 1# AC-2 - Account Management
 2# "Service accounts are managed through AWS IAM with quarterly access
 3# reviews. All accounts are reviewed by the ISSO within 30 days of personnel
 4# changes."
 5
 6package ssp.compliance
 7
 8default account_review_cadence_ok := false
 9
10account_review_cadence_ok if input.identity.account_review_cadence_days <= 90
11
12checks contains {
13	"control": "AC-2", "id": "account-review-cadence",
14	"requirement": "Service accounts reviewed at least quarterly (<= 90 days)",
15	"status": verdict(account_review_cadence_ok),
16	"evidence": sprintf("identity.account_review_cadence_days = %v", [object.get(input, ["identity", "account_review_cadence_days"], "unset")]),
17	"paths": ["identity.account_review_cadence_days"],
18}
19
20checks contains {
21	"control": "AC-2", "id": "personnel-change-review",
22	"requirement": "Accounts reviewed by the ISSO within 30 days of personnel changes",
23	"status": "manual",
24	"evidence": "Process control; not represented in the infrastructure schema",
25	"paths": [],
26}

Needs evidence AC-3 Access Enforcement Passed: 0 Failed: 0 Needs evidence: 1

SSP statement

Role-based access control is enforced at the application layer. Three roles are defined: read-only viewer, operator, and administrator. All access decisions are logged.

Check results

Findings, evidence, and cited source for checks under AC-3
Result	Check	Finding and evidence
Needs evidence	Three application-layer roles (viewer, operator, administrator) with logged access decisions `application-rbac`	Application-layer RBAC is not represented in the infrastructure schema No repository field can prove this claim.

Policy source policy/controls/ac3.rego

 1# AC-3 - Access Enforcement
 2# "Role-based access control is enforced at the application layer. Three
 3# roles are defined ... All access decisions are logged."
 4
 5package ssp.compliance
 6
 7checks contains {
 8	"control": "AC-3", "id": "application-rbac",
 9	"requirement": "Three application-layer roles (viewer, operator, administrator) with logged access decisions",
10	"status": "manual",
11	"evidence": "Application-layer RBAC is not represented in the infrastructure schema",
12	"paths": [],
13}

Needs evidence CM-6 Configuration Settings Passed: 3 Failed: 0 Needs evidence: 1

SSP statement

All EC2 instances are hardened per the DISA STIG for Red Hat Enterprise Linux 8. All Kubernetes clusters are configured per the Kubernetes STIG. Container images are scanned against the DoD Iron Bank baseline before deployment.

Check results

Findings, evidence, and cited source for checks under CM-6
Result	Check	Finding and evidence
Needs evidence	Container images scanned against the DoD Iron Bank baseline before deployment `iron-bank-image-scanning`	Image scanning is not represented in the infrastructure schema No repository field can prove this claim.
Passed	Kubernetes clusters configured per the Kubernetes STIG `kubernetes-stig-hardening`	compute.kubernetes.stig_hardened = true `docs/infrastructure.remediated.yaml:59` compute.kubernetes.stig_hardened 58 version: "1.28.4" 59 stig_hardened: true 60 cis_benchmark_score: 87
Passed	No open high-severity scan findings on STIG-hardened nodes `no-open-high-findings`	compute.nodes.open_findings_high = 0 (last_scan 2026-07-10) `docs/infrastructure.remediated.yaml:65` compute.nodes.open_findings_high 64 last_scan: 2026-07-10 65 open_findings_high: 0 # remediated findings from the 2026-05-22 scan 66 open_findings_medium: 14
Passed	EC2 instances hardened per DISA STIG for RHEL 8 `node-stig-hardening`	compute.nodes: os=rhel-8 stig_hardened=true `docs/infrastructure.remediated.yaml:63` compute.nodes.stig_hardened 62 os: rhel-8 63 stig_hardened: true 64 last_scan: 2026-07-10

Policy source policy/controls/cm6.rego

 1# CM-6 - Configuration Settings
 2# "All EC2 instances are hardened per the DISA STIG for Red Hat Enterprise
 3# Linux 8. All Kubernetes clusters are configured per the Kubernetes STIG.
 4# Container images are scanned against the DoD Iron Bank baseline before
 5# deployment."
 6
 7package ssp.compliance
 8
 9default nodes_stig_ok := false
10
11nodes_stig_ok if input.compute.nodes.stig_hardened == true
12
13default k8s_stig_ok := false
14
15k8s_stig_ok if input.compute.kubernetes.stig_hardened == true
16
17# A system hardened per STIG should carry no open high-severity findings.
18default no_high_findings_ok := false
19
20no_high_findings_ok if input.compute.nodes.open_findings_high == 0
21
22checks contains {
23	"control": "CM-6", "id": "node-stig-hardening",
24	"requirement": "EC2 instances hardened per DISA STIG for RHEL 8",
25	"status": verdict(nodes_stig_ok),
26	"evidence": sprintf("compute.nodes: os=%v stig_hardened=%v", [object.get(input, ["compute", "nodes", "os"], "unset"), object.get(input, ["compute", "nodes", "stig_hardened"], "unset")]),
27	"paths": ["compute.nodes.stig_hardened"],
28}
29
30checks contains {
31	"control": "CM-6", "id": "kubernetes-stig-hardening",
32	"requirement": "Kubernetes clusters configured per the Kubernetes STIG",
33	"status": verdict(k8s_stig_ok),
34	"evidence": sprintf("compute.kubernetes.stig_hardened = %v", [object.get(input, ["compute", "kubernetes", "stig_hardened"], "unset")]),
35	"paths": ["compute.kubernetes.stig_hardened"],
36}
37
38checks contains {
39	"control": "CM-6", "id": "no-open-high-findings",
40	"requirement": "No open high-severity scan findings on STIG-hardened nodes",
41	"status": verdict(no_high_findings_ok),
42	"evidence": sprintf("compute.nodes.open_findings_high = %v (last_scan %v)", [object.get(input, ["compute", "nodes", "open_findings_high"], "unset"), object.get(input, ["compute", "nodes", "last_scan"], "unset")]),
43	"paths": ["compute.nodes.open_findings_high"],
44}
45
46checks contains {
47	"control": "CM-6", "id": "iron-bank-image-scanning",
48	"requirement": "Container images scanned against the DoD Iron Bank baseline before deployment",
49	"status": "manual",
50	"evidence": "Image scanning is not represented in the infrastructure schema",
51	"paths": [],
52}

Needs evidence CP-9 System Backup Passed: 3 Failed: 0 Needs evidence: 1

SSP statement

User data and system configuration are backed up daily. Backups are encrypted and stored in a geographically separate AWS region. Backup restoration is tested quarterly.

Check results

Findings, evidence, and cited source for checks under CP-9
Result	Check	Finding and evidence
Needs evidence	Backups are encrypted `backup-encryption`	No backup-encryption field in the schema; source volumes are covered under SC-28 No repository field can prove this claim.
Passed	User data and system configuration backed up daily `daily-backups`	storage.database.backup_cadence = daily `docs/infrastructure.remediated.yaml:93` storage.database.backup_cadence 92 kms_key_rotation: enabled 93 backup_cadence: daily 94 backup_region: us-gov-east-1
Passed	Backups stored in a geographically separate AWS region `geographically-separate-backups`	system.region = us-gov-west-1, backup_region = us-gov-east-1 `docs/infrastructure.remediated.yaml:94` storage.database.backup_region 93 backup_cadence: daily 94 backup_region: us-gov-east-1 95 last_restore_test: 2026-06-15 `docs/infrastructure.remediated.yaml:12` system.region 11 environment: production 12 region: us-gov-west-1
Passed	Backup restoration tested quarterly: last test within 92 days of evaluation date `quarterly-restore-test`	storage.database.last_restore_test = 2026-06-15 `docs/infrastructure.remediated.yaml:95` storage.database.last_restore_test 94 backup_region: us-gov-east-1 95 last_restore_test: 2026-06-15 96 object_storage:

Policy source policy/controls/cp9.rego

 1# CP-9 - System Backup
 2# "User data and system configuration are backed up daily. Backups are
 3# encrypted and stored in a geographically separate AWS region. Backup
 4# restoration is tested quarterly."
 5
 6package ssp.compliance
 7
 8default backup_cadence_ok := false
 9
10backup_cadence_ok if input.storage.database.backup_cadence in {"hourly", "daily"}
11
12default backup_region_ok := false
13
14backup_region_ok if {
15	br := input.storage.database.backup_region
16	br != input.system.region
17}
18
19default restore_test_ok := false
20
21restore_test_ok if days_since(input.storage.database.last_restore_test) <= 92
22
23checks contains {
24	"control": "CP-9", "id": "daily-backups",
25	"requirement": "User data and system configuration backed up daily",
26	"status": verdict(backup_cadence_ok),
27	"evidence": sprintf("storage.database.backup_cadence = %v", [object.get(input, ["storage", "database", "backup_cadence"], "unset")]),
28	"paths": ["storage.database.backup_cadence"],
29}
30
31checks contains {
32	"control": "CP-9", "id": "geographically-separate-backups",
33	"requirement": "Backups stored in a geographically separate AWS region",
34	"status": verdict(backup_region_ok),
35	"evidence": sprintf("system.region = %v, backup_region = %v", [object.get(input, ["system", "region"], "unset"), object.get(input, ["storage", "database", "backup_region"], "unset")]),
36	"paths": ["storage.database.backup_region", "system.region"],
37}
38
39checks contains {
40	"control": "CP-9", "id": "quarterly-restore-test",
41	"requirement": "Backup restoration tested quarterly: last test within 92 days of evaluation date",
42	"status": verdict(restore_test_ok),
43	"evidence": sprintf("storage.database.last_restore_test = %v", [object.get(input, ["storage", "database", "last_restore_test"], "unset")]),
44	"paths": ["storage.database.last_restore_test"],
45}
46
47checks contains {
48	"control": "CP-9", "id": "backup-encryption",
49	"requirement": "Backups are encrypted",
50	"status": "manual",
51	"evidence": "No backup-encryption field in the schema; source volumes are covered under SC-28",
52	"paths": [],
53}

Needs evidence IA-5 Authenticator Management Passed: 1 Failed: 0 Needs evidence: 1

SSP statement

Passwords, where used for break-glass access, conform to DoD password complexity requirements: minimum 15 characters, complexity requirements per DoD policy, rotation every 60 days.

Check results

Findings, evidence, and cited source for checks under IA-5
Result	Check	Finding and evidence
Passed	Authenticators rotated every 60 days (applied to long-lived IAM access keys) `authenticator-rotation-60d`	keys rotated more than 60 days before evaluation date: none `docs/infrastructure.remediated.yaml:24` identity.iam_users 23 account_review_cadence_days: 90 24 iam_users: 25 - name: deploy-bot 26 created: 2022-04-01 27 last_rotated: 2026-07-01 28 type: short_lived_credential # migrated off the static key to broker-issued creds 29 - name: legacy-etl 30 created: 2022-09-12 31 last_rotated: 2026-07-01 32 type: short_lived_credential # migrated off the static key to broker-issued creds
Needs evidence	Break-glass passwords: minimum 15 characters, DoD complexity, 60-day rotation `password-complexity`	Password policy is not represented in the infrastructure schema No repository field can prove this claim.

Policy source policy/controls/ia5.rego

 1# IA-5 - Authenticator Management
 2# "Passwords, where used for break-glass access, conform to DoD password
 3# complexity requirements: minimum 15 characters, complexity requirements per
 4# DoD policy, rotation every 60 days."
 5#
 6# The 60-day rotation requirement is applied to the only rotatable
 7# authenticators in the schema: long-lived IAM access keys.
 8
 9package ssp.compliance
10
11authenticator_stale(u) if not u.last_rotated
12
13authenticator_stale(u) if days_since(u.last_rotated) > 60
14
15stale_authenticators := [u.name |
16	some u in iam_users
17	u.type == "long_lived_access_key"
18	authenticator_stale(u)
19]
20
21stale_authenticator_paths := [sprintf("identity.iam_users.%d.last_rotated", [idx]) |
22	some idx, u in iam_users
23	u.type == "long_lived_access_key"
24	authenticator_stale(u)
25]
26
27checks contains {
28	"control": "IA-5", "id": "authenticator-rotation-60d",
29	"requirement": "Authenticators rotated every 60 days (applied to long-lived IAM access keys)",
30	"status": verdict(count(stale_authenticators) == 0),
31	"evidence": sprintf("keys rotated more than 60 days before evaluation date: %s", [csv(stale_authenticators)]),
32	"paths": paths_or(stale_authenticator_paths, ["identity.iam_users"]),
33}
34
35checks contains {
36	"control": "IA-5", "id": "password-complexity",
37	"requirement": "Break-glass passwords: minimum 15 characters, DoD complexity, 60-day rotation",
38	"status": "manual",
39	"evidence": "Password policy is not represented in the infrastructure schema",
40	"paths": [],
41}

Passed AC-17 Remote Access Passed: 2 Failed: 0 Needs evidence: 0

SSP statement

All remote access to AEGIS-LOG occurs over the DoDIN via approved VPN endpoints. Direct internet exposure of any system component is prohibited. Administrative access requires jump host traversal.

Check results

Findings, evidence, and cited source for checks under AC-17
Result	Check	Finding and evidence
Passed	Administrative access requires VPN (jump host traversal over DoDIN) `admin-vpn-required`	network.vpn.required_for_admin = true `docs/infrastructure.remediated.yaml:52` network.vpn.required_for_admin 51 vpn: 52 required_for_admin: true 53 provider: dod-cap
Passed	Direct internet exposure of any component is prohibited `no-public-ingress`	public ingress endpoints: none `docs/infrastructure.remediated.yaml:35` network.ingress 34network: 35 ingress: 36 - type: alb 37 tls_version_min: "1.2" 38 waf_attached: true 39 public: false 40 - type: nlb 41 tls_version_min: "1.2" # legacy partner integration upgraded off TLS 1.0 42 waf_attached: true # WAF attached to close the boundary-protection gap 43 public: false 44 egress:

Policy source policy/controls/ac17.rego

 1# AC-17 - Remote Access
 2# "All remote access to AEGIS-LOG occurs over the DoDIN via approved VPN
 3# endpoints. Direct internet exposure of any system component is prohibited.
 4# Administrative access requires jump host traversal."
 5
 6package ssp.compliance
 7
 8public_ingress := [i.type |
 9	some i in ingress
10	object.get(i, "public", true) == true
11]
12
13public_ingress_paths := [sprintf("network.ingress.%d.public", [idx]) |
14	some idx, i in ingress
15	object.get(i, "public", true) == true
16]
17
18default admin_vpn_ok := false
19
20admin_vpn_ok if input.network.vpn.required_for_admin == true
21
22checks contains {
23	"control": "AC-17", "id": "no-public-ingress",
24	"requirement": "Direct internet exposure of any component is prohibited",
25	"status": verdict(count(public_ingress) == 0),
26	"evidence": sprintf("public ingress endpoints: %s", [csv(public_ingress)]),
27	"paths": paths_or(public_ingress_paths, ["network.ingress"]),
28}
29
30checks contains {
31	"control": "AC-17", "id": "admin-vpn-required",
32	"requirement": "Administrative access requires VPN (jump host traversal over DoDIN)",
33	"status": verdict(admin_vpn_ok),
34	"evidence": sprintf("network.vpn.required_for_admin = %v", [object.get(input, ["network", "vpn", "required_for_admin"], "unset")]),
35	"paths": ["network.vpn.required_for_admin"],
36}

Passed AU-2 Event Logging Passed: 3 Failed: 0 Needs evidence: 0

SSP statement

The system logs the following event types: authentication attempts (success and failure), privilege escalations, configuration changes, data access events for records marked CUI, and system errors. Logs are retained for one year online and three years archived.

Check results

Findings, evidence, and cited source for checks under AU-2
Result	Check	Finding and evidence
Passed	Logs retained three years archived (>= 1095 days) `archive-retention-3yr`	logging.retention_archive_days = 1095 `docs/infrastructure.remediated.yaml:73` logging.retention_archive_days 72 retention_online_days: 365 73 retention_archive_days: 1095 74 event_types_logged:
Passed	Logs retained one year online (>= 365 days) `online-retention-1yr`	logging.retention_online_days = 365 `docs/infrastructure.remediated.yaml:72` logging.retention_online_days 71 - s3-archive 72 retention_online_days: 365 73 retention_archive_days: 1095
Passed	Auth success/failure, privilege escalation, config changes, CUI access, and system errors are logged `required-event-types`	missing event types: none `docs/infrastructure.remediated.yaml:74` logging.event_types_logged 73 retention_archive_days: 1095 74 event_types_logged: 75 - auth_success 76 - auth_failure 77 - privilege_escalation 78 - config_change 79 - cui_data_access 80 - system_error 81 tamper_protection: object_lock_compliance

Policy source policy/controls/au2.rego

 1# AU-2 - Event Logging
 2# "The system logs the following event types: authentication attempts
 3# (success and failure), privilege escalations, configuration changes, data
 4# access events for records marked CUI, and system errors. Logs are retained
 5# for one year online and three years archived."
 6
 7package ssp.compliance
 8
 9required_event_types := {
10	"auth_success",
11	"auth_failure",
12	"privilege_escalation",
13	"config_change",
14	"cui_data_access",
15	"system_error",
16}
17
18missing_event_types := required_event_types - logged_event_types
19
20default retention_online_ok := false
21
22retention_online_ok if input.logging.retention_online_days >= 365
23
24default retention_archive_ok := false
25
26retention_archive_ok if input.logging.retention_archive_days >= 1095
27
28checks contains {
29	"control": "AU-2", "id": "required-event-types",
30	"requirement": "Auth success/failure, privilege escalation, config changes, CUI access, and system errors are logged",
31	"status": verdict(count(missing_event_types) == 0),
32	"evidence": sprintf("missing event types: %s", [csv(sort(missing_event_types))]),
33	"paths": ["logging.event_types_logged"],
34}
35
36checks contains {
37	"control": "AU-2", "id": "online-retention-1yr",
38	"requirement": "Logs retained one year online (>= 365 days)",
39	"status": verdict(retention_online_ok),
40	"evidence": sprintf("logging.retention_online_days = %v", [object.get(input, ["logging", "retention_online_days"], "unset")]),
41	"paths": ["logging.retention_online_days"],
42}
43
44checks contains {
45	"control": "AU-2", "id": "archive-retention-3yr",
46	"requirement": "Logs retained three years archived (>= 1095 days)",
47	"status": verdict(retention_archive_ok),
48	"evidence": sprintf("logging.retention_archive_days = %v", [object.get(input, ["logging", "retention_archive_days"], "unset")]),
49	"paths": ["logging.retention_archive_days"],
50}

Passed AU-9 Protection of Audit Information Passed: 3 Failed: 0 Needs evidence: 0

SSP statement

Audit logs are written to a tamper-evident store. Access to logs is restricted to the ISSO and SOC personnel. Logs are encrypted at rest.

Check results

Findings, evidence, and cited source for checks under AU-9
Result	Check	Finding and evidence
Passed	Log access restricted to the ISSO and SOC personnel `log-access-restricted`	reader roles outside ISSO/SOC: none `docs/infrastructure.remediated.yaml:83` logging.access_controls.readers 82 access_controls: 83 readers: 84 - role: isso 85 - role: soc-analyst 86 # platform-engineer debug access (added 2025-08) revoked; use break-glass instead
Passed	Logs encrypted at rest (s3-archive destination is object storage) `log-encryption-at-rest`	storage.object_storage.encryption_at_rest = true `docs/infrastructure.remediated.yaml:97` storage.object_storage.encryption_at_rest 96 object_storage: 97 encryption_at_rest: true 98 encryption_algorithm: AES256
Passed	Audit logs written to a tamper-evident store (Object Lock compliance mode; governance mode is bypassable by privileged users) `tamper-evident-storage`	logging.tamper_protection = object_lock_compliance `docs/infrastructure.remediated.yaml:81` logging.tamper_protection 80 - system_error 81 tamper_protection: object_lock_compliance 82 access_controls:

Policy source policy/controls/au9.rego

 1# AU-9 - Protection of Audit Information
 2# "Audit logs are written to a tamper-evident store. Access to logs is
 3# restricted to the ISSO and SOC personnel. Logs are encrypted at rest."
 4#
 5# Object Lock governance mode can be bypassed by privileged principals; only
 6# compliance mode is tamper-evident against all users.
 7
 8package ssp.compliance
 9
10default tamper_protection_ok := false
11
12tamper_protection_ok if input.logging.tamper_protection == "object_lock_compliance"
13
14log_reader_allowed(role) if role == "isso"
15
16log_reader_allowed(role) if startswith(role, "soc")
17
18unauthorized_log_readers := [r.role |
19	some r in log_readers
20	not log_reader_allowed(r.role)
21]
22
23unauthorized_log_reader_paths := [sprintf("logging.access_controls.readers.%d.role", [idx]) |
24	some idx, r in log_readers
25	not log_reader_allowed(r.role)
26]
27
28# "Logs are encrypted at rest." Nearest schema evidence: the s3-archive log
29# destination is object storage, which must be encrypted.
30default log_encryption_ok := false
31
32log_encryption_ok if input.storage.object_storage.encryption_at_rest == true
33
34checks contains {
35	"control": "AU-9", "id": "tamper-evident-storage",
36	"requirement": "Audit logs written to a tamper-evident store (Object Lock compliance mode; governance mode is bypassable by privileged users)",
37	"status": verdict(tamper_protection_ok),
38	"evidence": sprintf("logging.tamper_protection = %v", [object.get(input, ["logging", "tamper_protection"], "unset")]),
39	"paths": ["logging.tamper_protection"],
40}
41
42checks contains {
43	"control": "AU-9", "id": "log-access-restricted",
44	"requirement": "Log access restricted to the ISSO and SOC personnel",
45	"status": verdict(count(unauthorized_log_readers) == 0),
46	"evidence": sprintf("reader roles outside ISSO/SOC: %s", [csv(unauthorized_log_readers)]),
47	"paths": paths_or(unauthorized_log_reader_paths, ["logging.access_controls.readers"]),
48}
49
50checks contains {
51	"control": "AU-9", "id": "log-encryption-at-rest",
52	"requirement": "Logs encrypted at rest (s3-archive destination is object storage)",
53	"status": verdict(log_encryption_ok),
54	"evidence": sprintf("storage.object_storage.encryption_at_rest = %v", [object.get(input, ["storage", "object_storage", "encryption_at_rest"], "unset")]),
55	"paths": ["storage.object_storage.encryption_at_rest"],
56}

Passed CM-2 Baseline Configuration Passed: 4 Failed: 0 Needs evidence: 0

SSP statement

The system maintains a documented baseline configuration in version control. All infrastructure is declared as code. Drift from baseline is reviewed weekly by the engineering lead.

Check results

Findings, evidence, and cited source for checks under CM-2
Result	Check	Finding and evidence
Passed	Documented baseline configuration maintained in version control `baseline-documented`	config_management.baseline_doc_ref = ssp.md `docs/infrastructure.remediated.yaml:125` config_management.baseline_doc_ref 124 last_run: 2026-07-12 125 baseline_doc_ref: ssp.md
Passed	Drift detection enabled at weekly cadence or better `drift-detection-weekly`	drift_detection: enabled=true cadence=weekly `docs/infrastructure.remediated.yaml:122` config_management.drift_detection.enabled 121 drift_detection: 122 enabled: true 123 cadence: weekly `docs/infrastructure.remediated.yaml:123` config_management.drift_detection.cadence 122 enabled: true 123 cadence: weekly 124 last_run: 2026-07-12
Passed	Drift reviewed weekly: last run within 7 days of evaluation date `drift-review-current`	drift_detection.last_run = 2026-07-12 `docs/infrastructure.remediated.yaml:124` config_management.drift_detection.last_run 123 cadence: weekly 124 last_run: 2026-07-12 125 baseline_doc_ref: ssp.md
Passed	All infrastructure declared as code in version control `infrastructure-as-code`	config_management: tool=terraform repo=github.com/aegis-log/infra `docs/infrastructure.remediated.yaml:119` config_management.iac_tool 118config_management: 119 iac_tool: terraform 120 iac_repo: github.com/aegis-log/infra `docs/infrastructure.remediated.yaml:120` config_management.iac_repo 119 iac_tool: terraform 120 iac_repo: github.com/aegis-log/infra 121 drift_detection:

Policy source policy/controls/cm2.rego

 1# CM-2 - Baseline Configuration
 2# "The system maintains a documented baseline configuration in version
 3# control. All infrastructure is declared as code. Drift from baseline is
 4# reviewed weekly by the engineering lead."
 5
 6package ssp.compliance
 7
 8default iac_ok := false
 9
10iac_ok if {
11	input.config_management.iac_tool
12	count(input.config_management.iac_repo) > 0
13}
14
15default baseline_doc_ok := false
16
17baseline_doc_ok if count(input.config_management.baseline_doc_ref) > 0
18
19default drift_detection_ok := false
20
21drift_detection_ok if {
22	dd := input.config_management.drift_detection
23	dd.enabled == true
24	dd.cadence in {"hourly", "daily", "weekly"}
25}
26
27default drift_run_current_ok := false
28
29drift_run_current_ok if days_since(input.config_management.drift_detection.last_run) <= 7
30
31checks contains {
32	"control": "CM-2", "id": "infrastructure-as-code",
33	"requirement": "All infrastructure declared as code in version control",
34	"status": verdict(iac_ok),
35	"evidence": sprintf("config_management: tool=%v repo=%v", [object.get(input, ["config_management", "iac_tool"], "unset"), object.get(input, ["config_management", "iac_repo"], "unset")]),
36	"paths": ["config_management.iac_tool", "config_management.iac_repo"],
37}
38
39checks contains {
40	"control": "CM-2", "id": "baseline-documented",
41	"requirement": "Documented baseline configuration maintained in version control",
42	"status": verdict(baseline_doc_ok),
43	"evidence": sprintf("config_management.baseline_doc_ref = %v", [object.get(input, ["config_management", "baseline_doc_ref"], "unset")]),
44	"paths": ["config_management.baseline_doc_ref"],
45}
46
47checks contains {
48	"control": "CM-2", "id": "drift-detection-weekly",
49	"requirement": "Drift detection enabled at weekly cadence or better",
50	"status": verdict(drift_detection_ok),
51	"evidence": sprintf("drift_detection: enabled=%v cadence=%v", [object.get(input, ["config_management", "drift_detection", "enabled"], "unset"), object.get(input, ["config_management", "drift_detection", "cadence"], "unset")]),
52	"paths": ["config_management.drift_detection.enabled", "config_management.drift_detection.cadence"],
53}
54
55checks contains {
56	"control": "CM-2", "id": "drift-review-current",
57	"requirement": "Drift reviewed weekly: last run within 7 days of evaluation date",
58	"status": verdict(drift_run_current_ok),
59	"evidence": sprintf("drift_detection.last_run = %v", [object.get(input, ["config_management", "drift_detection", "last_run"], "unset")]),
60	"paths": ["config_management.drift_detection.last_run"],
61}

Passed IA-2 Identification and Authentication Passed: 4 Failed: 0 Needs evidence: 0

SSP statement

All human users authenticate via CAC/PIV. Multi-factor authentication is required for all administrative actions. Service-to-service authentication uses short-lived tokens issued by the platform identity broker.

Check results

Findings, evidence, and cited source for checks under IA-2
Result	Check	Finding and evidence
Passed	All human users authenticate via CAC/PIV `cac-piv-authentication`	identity.human_auth: method=oidc cac_piv_integration=true `docs/infrastructure.remediated.yaml:19` identity.human_auth.cac_piv_integration 18 mfa_required: true 19 cac_piv_integration: true 20 service_auth:
Passed	Multi-factor authentication required for administrative actions `mfa-required`	identity.human_auth.mfa_required = true `docs/infrastructure.remediated.yaml:18` identity.human_auth.mfa_required 17 provider: okta-fed 18 mfa_required: true 19 cac_piv_integration: true
Passed	No long-lived service credentials (contradicts short-lived broker-issued tokens) `no-long-lived-service-credentials`	long-lived access keys: none `docs/infrastructure.remediated.yaml:24` identity.iam_users 23 account_review_cadence_days: 90 24 iam_users: 25 - name: deploy-bot 26 created: 2022-04-01 27 last_rotated: 2026-07-01 28 type: short_lived_credential # migrated off the static key to broker-issued creds 29 - name: legacy-etl 30 created: 2022-09-12 31 last_rotated: 2026-07-01 32 type: short_lived_credential # migrated off the static key to broker-issued creds
Passed	Service-to-service auth uses short-lived tokens (TTL <= 3600s, not api_key) `short-lived-service-tokens`	identity.service_auth: method=spiffe token_ttl=3600 `docs/infrastructure.remediated.yaml:21` identity.service_auth.method 20 service_auth: 21 method: spiffe 22 token_ttl: 3600 `docs/infrastructure.remediated.yaml:22` identity.service_auth.token_ttl 21 method: spiffe 22 token_ttl: 3600 23 account_review_cadence_days: 90

Policy source policy/controls/ia2.rego

 1# IA-2 - Identification and Authentication
 2# "All human users authenticate via CAC/PIV. Multi-factor authentication is
 3# required for all administrative actions. Service-to-service authentication
 4# uses short-lived tokens issued by the platform identity broker."
 5
 6package ssp.compliance
 7
 8default cac_piv_ok := false
 9
10cac_piv_ok if input.identity.human_auth.cac_piv_integration == true
11
12default mfa_ok := false
13
14mfa_ok if input.identity.human_auth.mfa_required == true
15
16default service_tokens_ok := false
17
18service_tokens_ok if {
19	sa := input.identity.service_auth
20	sa.method != "api_key"
21	sa.token_ttl <= 3600 # "short-lived": at most one hour
22}
23
24checks contains {
25	"control": "IA-2", "id": "cac-piv-authentication",
26	"requirement": "All human users authenticate via CAC/PIV",
27	"status": verdict(cac_piv_ok),
28	"evidence": sprintf("identity.human_auth: method=%v cac_piv_integration=%v", [object.get(input, ["identity", "human_auth", "method"], "unset"), object.get(input, ["identity", "human_auth", "cac_piv_integration"], "unset")]),
29	"paths": ["identity.human_auth.cac_piv_integration"],
30}
31
32checks contains {
33	"control": "IA-2", "id": "mfa-required",
34	"requirement": "Multi-factor authentication required for administrative actions",
35	"status": verdict(mfa_ok),
36	"evidence": sprintf("identity.human_auth.mfa_required = %v", [object.get(input, ["identity", "human_auth", "mfa_required"], "unset")]),
37	"paths": ["identity.human_auth.mfa_required"],
38}
39
40checks contains {
41	"control": "IA-2", "id": "short-lived-service-tokens",
42	"requirement": "Service-to-service auth uses short-lived tokens (TTL <= 3600s, not api_key)",
43	"status": verdict(service_tokens_ok),
44	"evidence": sprintf("identity.service_auth: method=%v token_ttl=%v", [object.get(input, ["identity", "service_auth", "method"], "unset"), object.get(input, ["identity", "service_auth", "token_ttl"], "unset")]),
45	"paths": ["identity.service_auth.method", "identity.service_auth.token_ttl"],
46}
47
48checks contains {
49	"control": "IA-2", "id": "no-long-lived-service-credentials",
50	"requirement": "No long-lived service credentials (contradicts short-lived broker-issued tokens)",
51	"status": verdict(count(long_lived_service_creds) == 0),
52	"evidence": sprintf("long-lived access keys: %s", [csv(long_lived_service_creds)]),
53	"paths": paths_or(long_lived_service_cred_paths, ["identity.iam_users"]),
54}

Passed SC-13 Cryptographic Protection Passed: 2 Failed: 0 Needs evidence: 0

SSP statement

All cryptographic modules in use are FIPS 140-2 validated. The system does not use any cryptographic primitive that has not been validated.

Check results

Findings, evidence, and cited source for checks under SC-13
Result	Check	Finding and evidence
Passed	FIPS 140-2 validated cryptographic modules (FIPS mode enabled) `fips-mode-enabled`	crypto.fips_mode = enabled `docs/infrastructure.remediated.yaml:103` crypto.fips_mode 102 tls_library: openssl-3.0 103 fips_mode: enabled 104 modules_in_use:
Passed	No non-validated cryptographic primitive in use (non-validated modules need an unexpired waiver) `fips-validated-modules-only`	non-validated modules without a current waiver: none `docs/infrastructure.remediated.yaml:109` crypto.legacy_exceptions 108 # non-validated cryptographic primitives remain, so there is no exception left. 109 legacy_exceptions: []

Policy source policy/controls/sc13.rego

 1# SC-13 - Cryptographic Protection
 2# "All cryptographic modules in use are FIPS 140-2 validated. The system does
 3# not use any cryptographic primitive that has not been validated."
 4#
 5# A non-validated module is tolerated only under an unexpired waiver.
 6
 7package ssp.compliance
 8
 9default fips_mode_ok := false
10
11fips_mode_ok if input.crypto.fips_mode == "enabled"
12
13crypto_exception_ok(e) if e.fips_validated == true
14
15crypto_exception_ok(e) if days_since(e.waiver_expires) < 0
16
17invalid_crypto_exceptions := [sprintf("%s (uses %s)", [e.service, e.uses]) |
18	some e in legacy_exceptions
19	not crypto_exception_ok(e)
20]
21
22invalid_crypto_exception_paths := [sprintf("crypto.legacy_exceptions.%d", [idx]) |
23	some idx, e in legacy_exceptions
24	not crypto_exception_ok(e)
25]
26
27checks contains {
28	"control": "SC-13", "id": "fips-mode-enabled",
29	"requirement": "FIPS 140-2 validated cryptographic modules (FIPS mode enabled)",
30	"status": verdict(fips_mode_ok),
31	"evidence": sprintf("crypto.fips_mode = %v", [object.get(input, ["crypto", "fips_mode"], "unset")]),
32	"paths": ["crypto.fips_mode"],
33}
34
35checks contains {
36	"control": "SC-13", "id": "fips-validated-modules-only",
37	"requirement": "No non-validated cryptographic primitive in use (non-validated modules need an unexpired waiver)",
38	"status": verdict(count(invalid_crypto_exceptions) == 0),
39	"evidence": sprintf("non-validated modules without a current waiver: %s", [csv(invalid_crypto_exceptions)]),
40	"paths": paths_or(invalid_crypto_exception_paths, ["crypto.legacy_exceptions"]),
41}

Passed SC-28 Protection of Information at Rest Passed: 3 Failed: 0 Needs evidence: 0

SSP statement

All data at rest is encrypted using AES-256. Encryption keys are managed in AWS KMS with automatic annual rotation. Database storage volumes, object storage, and backup volumes are all encrypted.

Check results

Findings, evidence, and cited source for checks under SC-28
Result	Check	Finding and evidence
Passed	Database storage volumes encrypted at rest `database-encryption`	storage.database.encryption_at_rest = true `docs/infrastructure.remediated.yaml:91` storage.database.encryption_at_rest 90 engine: aurora-postgres 91 encryption_at_rest: true 92 kms_key_rotation: enabled
Passed	Encryption keys managed in AWS KMS with automatic rotation `kms-key-rotation`	storage.database.kms_key_rotation = enabled `docs/infrastructure.remediated.yaml:92` storage.database.kms_key_rotation 91 encryption_at_rest: true 92 kms_key_rotation: enabled 93 backup_cadence: daily
Passed	Object storage encrypted at rest with AES-256 `object-storage-encryption`	storage.object_storage: encryption_at_rest=true algorithm=AES256 `docs/infrastructure.remediated.yaml:97` storage.object_storage.encryption_at_rest 96 object_storage: 97 encryption_at_rest: true 98 encryption_algorithm: AES256 `docs/infrastructure.remediated.yaml:98` storage.object_storage.encryption_algorithm 97 encryption_at_rest: true 98 encryption_algorithm: AES256 99 versioning: enabled

Policy source policy/controls/sc28.rego

 1# SC-28 - Protection of Information at Rest
 2# "All data at rest is encrypted using AES-256. Encryption keys are managed
 3# in AWS KMS with automatic annual rotation. Database storage volumes, object
 4# storage, and backup volumes are all encrypted."
 5
 6package ssp.compliance
 7
 8default db_encryption_ok := false
 9
10db_encryption_ok if input.storage.database.encryption_at_rest == true
11
12default object_encryption_ok := false
13
14object_encryption_ok if input.storage.object_storage.encryption_at_rest == true
15
16default kms_rotation_ok := false
17
18kms_rotation_ok if input.storage.database.kms_key_rotation == "enabled"
19
20checks contains {
21	"control": "SC-28", "id": "database-encryption",
22	"requirement": "Database storage volumes encrypted at rest",
23	"status": verdict(db_encryption_ok),
24	"evidence": sprintf("storage.database.encryption_at_rest = %v", [object.get(input, ["storage", "database", "encryption_at_rest"], "unset")]),
25	"paths": ["storage.database.encryption_at_rest"],
26}
27
28checks contains {
29	"control": "SC-28", "id": "object-storage-encryption",
30	"requirement": "Object storage encrypted at rest with AES-256",
31	"status": verdict(object_encryption_ok),
32	"evidence": sprintf("storage.object_storage: encryption_at_rest=%v algorithm=%v", [object.get(input, ["storage", "object_storage", "encryption_at_rest"], "unset"), object.get(input, ["storage", "object_storage", "encryption_algorithm"], "unset")]),
33	"paths": ["storage.object_storage.encryption_at_rest", "storage.object_storage.encryption_algorithm"],
34}
35
36checks contains {
37	"control": "SC-28", "id": "kms-key-rotation",
38	"requirement": "Encryption keys managed in AWS KMS with automatic rotation",
39	"status": verdict(kms_rotation_ok),
40	"evidence": sprintf("storage.database.kms_key_rotation = %v", [object.get(input, ["storage", "database", "kms_key_rotation"], "unset")]),
41	"paths": ["storage.database.kms_key_rotation"],
42}

Passed SC-7 Boundary Protection Passed: 2 Failed: 0 Needs evidence: 0

SSP statement

The system enforces boundary protection through AWS security groups, a managed WAF, and network ACLs. All ingress traffic is inspected. Egress is restricted to an allowlist of approved external endpoints.

Check results

Result Check Finding and evidence

Passed

Egress restricted to an allowlist of approved endpoints egress-allowlist

network.egress: mode=allowlist endpoints=4

docs/infrastructure.remediated.yaml:45 network.egress.mode

44  egress:
45    mode: allowlist
46    allowed_endpoints:

docs/infrastructure.remediated.yaml:46 network.egress.allowed_endpoints

45    mode: allowlist
46    allowed_endpoints:
47      - "*.amazonaws.com"
48      - "iron-bank.dso.mil"
49      - "api.partner-system.mil"
50      - "*.github.com"          # added 2025-03 for CI artifact pulls
51  vpn:

Passed

All ingress traffic inspected by the managed WAF waf-on-all-ingress

ingress without WAF: none

docs/infrastructure.remediated.yaml:35 network.ingress

34network:
35  ingress:
36    - type: alb
37      tls_version_min: "1.2"
38      waf_attached: true
39      public: false
40    - type: nlb
41      tls_version_min: "1.2"   # legacy partner integration upgraded off TLS 1.0
42      waf_attached: true       # WAF attached to close the boundary-protection gap
43      public: false
44  egress:

Policy source policy/controls/sc7.rego

 1# SC-7 - Boundary Protection
 2# "The system enforces boundary protection through AWS security groups, a
 3# managed WAF, and network ACLs. All ingress traffic is inspected. Egress is
 4# restricted to an allowlist of approved external endpoints."
 5
 6package ssp.compliance
 7
 8ingress_without_waf := [i.type |
 9	some i in ingress
10	object.get(i, "waf_attached", false) != true
11]
12
13ingress_without_waf_paths := [sprintf("network.ingress.%d.waf_attached", [idx]) |
14	some idx, i in ingress
15	object.get(i, "waf_attached", false) != true
16]
17
18default egress_allowlist_ok := false
19
20egress_allowlist_ok if {
21	input.network.egress.mode == "allowlist"
22	count(input.network.egress.allowed_endpoints) > 0
23}
24
25checks contains {
26	"control": "SC-7", "id": "waf-on-all-ingress",
27	"requirement": "All ingress traffic inspected by the managed WAF",
28	"status": verdict(count(ingress_without_waf) == 0),
29	"evidence": sprintf("ingress without WAF: %s", [csv(ingress_without_waf)]),
30	"paths": paths_or(ingress_without_waf_paths, ["network.ingress"]),
31}
32
33checks contains {
34	"control": "SC-7", "id": "egress-allowlist",
35	"requirement": "Egress restricted to an allowlist of approved endpoints",
36	"status": verdict(egress_allowlist_ok),
37	"evidence": sprintf("network.egress: mode=%v endpoints=%v", [object.get(input, ["network", "egress", "mode"], "unset"), count(object.get(input, ["network", "egress", "allowed_endpoints"], []))]),
38	"paths": ["network.egress.mode", "network.egress.allowed_endpoints"],
39}

Passed SC-8 Transmission Confidentiality and Integrity Passed: 2 Failed: 0 Needs evidence: 0

SSP statement

All data in transit is protected using TLS 1.2 or higher. Mutual TLS is used for service-to-service communication within the cluster.

Check results

Findings, evidence, and cited source for checks under SC-8
Result	Check	Finding and evidence
Passed	Mutual TLS for service-to-service communication (mtls or spiffe) `mutual-tls-service-auth`	identity.service_auth.method = spiffe `docs/infrastructure.remediated.yaml:21` identity.service_auth.method 20 service_auth: 21 method: spiffe 22 token_ttl: 3600
Passed	All data in transit protected with TLS 1.2 or higher `tls-1.2-minimum`	ingress below TLS 1.2: none `docs/infrastructure.remediated.yaml:35` network.ingress 34network: 35 ingress: 36 - type: alb 37 tls_version_min: "1.2" 38 waf_attached: true 39 public: false 40 - type: nlb 41 tls_version_min: "1.2" # legacy partner integration upgraded off TLS 1.0 42 waf_attached: true # WAF attached to close the boundary-protection gap 43 public: false 44 egress:

Policy source policy/controls/sc8.rego

 1# SC-8 - Transmission Confidentiality and Integrity
 2# "All data in transit is protected using TLS 1.2 or higher. Mutual TLS is
 3# used for service-to-service communication within the cluster."
 4
 5package ssp.compliance
 6
 7weak_tls_ingress := [sprintf("%s (%s)", [i.type, object.get(i, "tls_version_min", "unset")]) |
 8	some i in ingress
 9	not object.get(i, "tls_version_min", "unset") in {"1.2", "1.3"}
10]
11
12weak_tls_ingress_paths := [sprintf("network.ingress.%d.tls_version_min", [idx]) |
13	some idx, i in ingress
14	not object.get(i, "tls_version_min", "unset") in {"1.2", "1.3"}
15]
16
17default mtls_ok := false
18
19# SPIFFE identities are delivered over mTLS; both satisfy the SSP claim.
20mtls_ok if input.identity.service_auth.method in {"mtls", "spiffe"}
21
22checks contains {
23	"control": "SC-8", "id": "tls-1.2-minimum",
24	"requirement": "All data in transit protected with TLS 1.2 or higher",
25	"status": verdict(count(weak_tls_ingress) == 0),
26	"evidence": sprintf("ingress below TLS 1.2: %s", [csv(weak_tls_ingress)]),
27	"paths": paths_or(weak_tls_ingress_paths, ["network.ingress"]),
28}
29
30checks contains {
31	"control": "SC-8", "id": "mutual-tls-service-auth",
32	"requirement": "Mutual TLS for service-to-service communication (mtls or spiffe)",
33	"status": verdict(mtls_ok),
34	"evidence": sprintf("identity.service_auth.method = %v", [object.get(input, ["identity", "service_auth", "method"], "unset")]),
35	"paths": ["identity.service_auth.method"],
36}

Passed SI-4 System Monitoring Passed: 4 Failed: 0 Needs evidence: 0

SSP statement

The system is monitored continuously for indicators of compromise. Alerts are forwarded to the program SOC. Anomalous behavior triggers an automated incident response workflow.`

Check results

Findings, evidence, and cited source for checks under SI-4
Result	Check	Finding and evidence
Passed	Anomalous behavior triggers an automated incident response workflow `automated-incident-response`	monitoring.automated_response = full `docs/infrastructure.remediated.yaml:115` monitoring.automated_response 114 ioc_feeds: enabled 115 automated_response: full 116 soc_integration: true
Passed	Continuous monitoring for indicators of compromise (SIEM and EDR deployed) `continuous-monitoring`	monitoring: siem=splunk-cloud-gov edr=crowdstrike-falcon-gov `docs/infrastructure.remediated.yaml:112` monitoring.siem 111monitoring: 112 siem: splunk-cloud-gov 113 edr: crowdstrike-falcon-gov `docs/infrastructure.remediated.yaml:113` monitoring.edr 112 siem: splunk-cloud-gov 113 edr: crowdstrike-falcon-gov 114 ioc_feeds: enabled
Passed	Indicator-of-compromise feeds enabled `ioc-feeds`	monitoring.ioc_feeds = enabled `docs/infrastructure.remediated.yaml:114` monitoring.ioc_feeds 113 edr: crowdstrike-falcon-gov 114 ioc_feeds: enabled 115 automated_response: full
Passed	Alerts forwarded to the program SOC `soc-integration`	monitoring.soc_integration = true `docs/infrastructure.remediated.yaml:116` monitoring.soc_integration 115 automated_response: full 116 soc_integration: true

Policy source policy/controls/si4.rego

 1# SI-4 - System Monitoring
 2# "The system is monitored continuously for indicators of compromise. Alerts
 3# are forwarded to the program SOC. Anomalous behavior triggers an automated
 4# incident response workflow."
 5
 6package ssp.compliance
 7
 8default continuous_monitoring_ok := false
 9
10continuous_monitoring_ok if {
11	count(object.get(input, ["monitoring", "siem"], "")) > 0
12	count(object.get(input, ["monitoring", "edr"], "")) > 0
13}
14
15default ioc_feeds_ok := false
16
17ioc_feeds_ok if input.monitoring.ioc_feeds == "enabled"
18
19default soc_integration_ok := false
20
21soc_integration_ok if input.monitoring.soc_integration == true
22
23default automated_response_ok := false
24
25automated_response_ok if input.monitoring.automated_response == "full"
26
27checks contains {
28	"control": "SI-4", "id": "continuous-monitoring",
29	"requirement": "Continuous monitoring for indicators of compromise (SIEM and EDR deployed)",
30	"status": verdict(continuous_monitoring_ok),
31	"evidence": sprintf("monitoring: siem=%v edr=%v", [object.get(input, ["monitoring", "siem"], "unset"), object.get(input, ["monitoring", "edr"], "unset")]),
32	"paths": ["monitoring.siem", "monitoring.edr"],
33}
34
35checks contains {
36	"control": "SI-4", "id": "ioc-feeds",
37	"requirement": "Indicator-of-compromise feeds enabled",
38	"status": verdict(ioc_feeds_ok),
39	"evidence": sprintf("monitoring.ioc_feeds = %v", [object.get(input, ["monitoring", "ioc_feeds"], "unset")]),
40	"paths": ["monitoring.ioc_feeds"],
41}
42
43checks contains {
44	"control": "SI-4", "id": "soc-integration",
45	"requirement": "Alerts forwarded to the program SOC",
46	"status": verdict(soc_integration_ok),
47	"evidence": sprintf("monitoring.soc_integration = %v", [object.get(input, ["monitoring", "soc_integration"], "unset")]),
48	"paths": ["monitoring.soc_integration"],
49}
50
51checks contains {
52	"control": "SI-4", "id": "automated-incident-response",
53	"requirement": "Anomalous behavior triggers an automated incident response workflow",
54	"status": verdict(automated_response_ok),
55	"evidence": sprintf("monitoring.automated_response = %v", [object.get(input, ["monitoring", "automated_response"], "unset")]),
56	"paths": ["monitoring.automated_response"],
57}