Compliance Framework

Meeting government security standards and regulatory requirements

compliance@canopy:~$
compliance@canopy : ~ $ ./check_compliance.sh
Scanning compliance frameworks...
✓ DISA STIG v2R3: COMPLIANT
✓ NIST 800-53 Rev5: COMPLIANT
✓ FIPS 140-2 Level 3: COMPLIANT
✓ FedRAMP High: COMPLIANT
All compliance requirements satisfied.

DISA STIG Compliance

Security Technical Implementation Guide

Canopy fully implements DISA STIG requirements for secure system configuration and operation.

  • Application Security and Development STIG v5r3
  • Operating System STIG compliance
  • Database Security STIG implementation
  • Network Security STIG controls

Key STIG Requirements

Access Control ✓ Implemented
Audit & Accountability ✓ Implemented
Configuration Management ✓ Implemented
Identification & Authentication ✓ Implemented
System & Communications Protection ✓ Implemented

NIST 800-53 Controls

Access Control (AC)

  • AC-1: Policy and Procedures
  • AC-2: Account Management
  • AC-3: Access Enforcement
  • AC-6: Least Privilege
  • AC-7: Unsuccessful Login Attempts
  • AC-8: System Use Notification

Audit & Accountability (AU)

  • AU-1: Policy and Procedures
  • AU-2: Event Logging
  • AU-3: Content of Audit Records
  • AU-4: Audit Log Storage Capacity
  • AU-5: Response to Audit Failures
  • AU-6: Audit Record Review

Identification & Authentication (IA)

  • IA-1: Policy and Procedures
  • IA-2: Identification & Authentication
  • IA-3: Device Identification
  • IA-4: Identifier Management
  • IA-5: Authenticator Management
  • IA-8: Identification & Authentication

FIPS 140-2 Cryptographic Standards

Cryptographic Module Validation

Security Level Level 3
Cryptographic Module Validated
Key Management Compliant
Physical Security Tamper Evident

Approved Algorithms

  • AES-256 (Advanced Encryption Standard)
  • RSA-2048/4096 (Public Key Cryptography)
  • SHA-256/384/512 (Secure Hash Algorithm)
  • ECDSA P-256/384 (Elliptic Curve DSA)

Additional Compliance Standards

FedRAMP High

Federal Risk and Authorization Management Program for high-impact cloud services.

P-ATO Ready

CJIS Security Policy

Criminal Justice Information Services security requirements for law enforcement.

v5.9 Compliant

HIPAA

Health Insurance Portability and Accountability Act compliance for healthcare data.

BAA Available
Compliance Verified

All government security standards met and verified