{ "metadata": { "responsibleOfficial": { "name": "Jaskaran Singh Kandola", "title": "Co-Founder and Chief Information Officer", "email": "jkandola@platformoneinc.com", "phone": "703-347-1223" }, "version": "1.0.0", "lastUpdated": "2026-10-07T00:00:00Z", "updateSource": "Jaskaran Singh Kandola, Co-Founder, Chief Information Officer and Information System Security Officer; scripts/platformone-package/build.ts", "stateDescribed": "Current state: ComplianceONE production in Microsoft Azure Government (US Gov Virginia) with the October 2026 gap-closure set." }, "serviceIdentification": { "fedRampPackageId": "FR2700754082", "ueiNumber": "DR83PCJ11966", "providerName": "PlatformOne Group Inc", "serviceName": "ComplianceONE", "serviceAcronym": "C1", "serviceDescription": "ComplianceONE is a multi-tenant governance, risk and compliance (GRC) platform that federal agencies, their contractors and commercial organizations use to manage FedRAMP, NIST SP 800-53, NIST SP 800-171/CMMC, GovRAMP, DoD Impact Level, TX-RAMP, ITAR and AS9100 programs. It holds control implementation records, policies, procedures, evidence files, POA&Ms, risks, incidents and assessment results; generates certification documents; reads security posture from customer-authorized integrations; and offers AI drafting assistance whose output a person reviews.", "certificationType": "20x", "website": "https://www.complianceone.ai", "logo": "https://www.complianceone.ai/assets/images/logo/logo-purple.png" }, "serviceProperties": { "serviceType": [ "SaaS" ], "deploymentModel": "Public Cloud", "businessCategory": [ "Governance, Risk, and Compliance (GRC)", "Cybersecurity & Risk Management", "Artificial Intelligence (AI)" ], "trustCenter": { "repositoryType": [ "Trust Center" ], "url": "https://www.complianceone.ai/trust", "repositoryDescription": "PlatformOne's FedRAMP-compatible trust center for ComplianceONE (CDS-CSO-UTC): public certification data, the Certification Package for agencies, Ongoing Certification Reports, significant change notifications and the status page.", "authenticationRequired": false, "accessRequestInstructions": "Public information is open. Agencies request access to the full Certification Package at https://www.complianceone.ai/trust or by email to security@platformoneinc.com; requests are decided within 1 business day (CDS-UTC-AGA)." }, "secureConfigurationGuidance": { "repositoryType": [ "Secure Configuration Guide" ], "url": "https://www.complianceone.ai/trust/secure-configuration-guide", "repositoryDescription": "Secure Configuration Guide (SCG-CSO-RSC). Machine-readable version: https://www.complianceone.ai/trust/secure-configuration-guide.json.", "authenticationRequired": false, "accessRequestInstructions": "Public; no request needed (SCG-CSO-PUB)." }, "additionalRepositories": [ { "repositoryType": [ "Certification Package" ], "url": "https://www.complianceone.ai/trust/package", "repositoryDescription": "The FedRAMP Certification Package: this overview, the Security Decision Record, Ongoing Certification Reports and their snapshots (CDS-CSO-HAD), and the rule artifacts. Human-readable and JSON.", "authenticationRequired": true, "accessRequestInstructions": "Agencies and FedRAMP request access through the Trust Center or at security@platformoneinc.com. No NDA is required. Requests are decided within 1 business day; a denial is reported to FedRAMP within 5 business days (CDS-UTC-AAD)." }, { "repositoryType": [ "Policies and Procedures" ], "url": "https://www.complianceone.ai/trust/policies", "repositoryDescription": "Every policy and procedure, with a human- and machine-readable index giving name, file, summary, word count, version, date and related FedRAMP practices (CDS-CSO-IRP).", "authenticationRequired": true, "accessRequestInstructions": "As for the Certification Package." }, { "repositoryType": [ "Significant Change Notifications" ], "url": "https://www.complianceone.ai/trust/changes", "repositoryDescription": "Twelve months of Significant Change Notifications and evaluation records, human-readable and JSON (SCN-CSO-HIS, SCN-CSO-HRM).", "authenticationRequired": false, "accessRequestInstructions": "Public summary; full notifications and impact analyses are in the Certification Package." }, { "repositoryType": [ "Vulnerability Reports" ], "url": "https://www.complianceone.ai/trust/ver", "repositoryDescription": "Monthly human-readable vulnerability detection and response reports and the machine-readable history, updated at least every 14 days (VER-TFR-MHR, VER-TFR-MRH).", "authenticationRequired": true, "accessRequestInstructions": "As for the Certification Package." }, { "repositoryType": [ "Status Page" ], "url": "https://www.complianceone.ai/trust/status", "repositoryDescription": "Current and 90-day historical availability of core services, including availability incidents, human- and machine-readable (CDS-CSO-AVR). Hosted apart from the production service, so it stays available when ComplianceONE is down.", "authenticationRequired": false, "accessRequestInstructions": "Public." }, { "repositoryType": [ "Programmatic Access" ], "url": "https://www.complianceone.ai/trust/programmatic-access", "repositoryDescription": "Documentation of every programmatic endpoint for the certification data: the public JSON addresses, their formats and caching, and the token-based agency endpoints (CDS-TRC-PAC).", "authenticationRequired": false, "accessRequestInstructions": "Public." } ] }, "contactInformation": [ { "contactType": "Package", "contactName": "Jaskaran Singh Kandola, Co-Founder, Chief Information Officer and Information System Security Officer", "contactEmail": "jkandola@platformoneinc.com", "contactPhone": "703-347-1223" }, { "contactType": "Security", "contactName": "PlatformOne Security", "contactEmail": "security@platformoneinc.com", "contactPhone": "703-347-1223" }, { "contactType": "Sales", "contactName": "PlatformOne Solutions", "contactEmail": "solutions@platformoneinc.com", "contactPhone": "703-239-4854" } ], "assessor": { "name": "DataLock Consulting Group", "assessorID": "200883" }, "certifiedServices": [ { "serviceName": "Frameworks and controls", "serviceDescription": "Framework catalogs (FedRAMP 20x and Rev5, NIST SP 800-53, NIST SP 800-171/CMMC, GovRAMP, DoD Impact Levels, TX-RAMP, ITAR, AS9100), control implementation records, assignments, tailoring and common-control propagation.", "dateAvailable": "2026-10-07" }, { "serviceName": "Policies and procedures", "serviceDescription": "Policy and procedure authoring, templates, review cycles and approvals.", "dateAvailable": "2026-10-07" }, { "serviceName": "Evidence", "serviceDescription": "Evidence files and references linked to controls, KSIs and requirements, stored in Azure Blob Storage.", "dateAvailable": "2026-10-07" }, { "serviceName": "POA&M and risk", "serviceDescription": "Risk register, findings, POA&Ms, deviations and vulnerability detection and response records (PAIN, KEV, accepted vulnerabilities).", "dateAvailable": "2026-10-07" }, { "serviceName": "Assessments and reports", "serviceDescription": "Gap and self-assessments, SSP and OSCAL exports, and the FedRAMP 20x package builders (CPO, SDR, OCR, SCN, incident and VER reports).", "dateAvailable": "2026-10-07" }, { "serviceName": "Integrations (read-only)", "serviceDescription": "Read-only connections to customer-authorized security and IT tools that supply configuration and posture as evidence.", "dateAvailable": "2026-10-07" }, { "serviceName": "Trust Center", "serviceDescription": "Customer-operated trust center and status page for publishing certification data.", "dateAvailable": "2026-10-07" }, { "serviceName": "Monitoring: incidents, vulnerabilities and CVE Hunter", "serviceDescription": "Incident records and FedRAMP incident reports, significant changes, compliance calendar, CVE hunter.", "dateAvailable": "2026-10-07" }, { "serviceName": "AI drafting assistant (CORA)", "serviceDescription": "Drafts of statements, narratives and reports grounded in the tenant's own records, using Azure OpenAI Service in Azure Government; a person reviews each draft.", "dateAvailable": "2026-10-07" } ], "thirdPartyInformationResources": { "certified": [ { "fedRampCertifiedThirdPartyInformationResource": "F1603087869", "useCase": "Microsoft Azure Government (FedRAMP High): all compute, storage, database, networking, key management, Azure OpenAI, email (Azure Communication Services), security monitoring and backup for ComplianceONE." }, { "fedRampCertifiedThirdPartyInformationResource": "FR1824057433", "useCase": "Microsoft 365 GCC High: administrator identity lifecycle and the FedRAMP Security Inbox (security@platformoneinc.com). Holds no federal customer data." }, { "fedRampCertifiedThirdPartyInformationResource": "FR1812058188", "useCase": "GitHub Enterprise Cloud (FedRAMP Certified at Class B, Low; agency path): source code, code review, secret-scanning push protection and Dependabot. Holds no federal customer data." } ], "nonCertified": [ { "name": "Azure DevOps Services", "provider": "Microsoft", "website": "https://azure.microsoft.com/products/devops", "useCase": "Build, test, scan, sign and deploy pipelines; deploys only from the protected main branch. Holds no federal customer data. FedRAMP status: not listed in Microsoft's FedRAMP High audit scope for Azure or Azure Government (list updated September 2026); treated as a third party without a FedRAMP authorization." }, { "name": "Stripe", "provider": "Stripe, Inc.", "website": "https://stripe.com", "useCase": "Subscription billing only: billing contacts and payment tokens. Receives no federal customer data; listed for transparency." } ] } }