Agency and FedRAMP access
What this repository holds
- PlatformOne's company-wide policies, standards, procedures and forms
- The ComplianceONE program plans and policies: incident response, contingency, configuration and change management, secure development, awareness and training, supply chain, asset inventory, data retention and the information security program charter
- The filled FedRAMP 20x Class C policy and procedure set, one document per rule family
- The document index (name, scope, summary, version, date, signing status and the FedRAMP practices each document supports), as a page and as document-index.json
The vulnerability disclosure policy is public at /security.
How to request access
Email security@platformoneinc.com from an official address, naming the agency, the purpose (for example an authorization decision or a continuous-monitoring review) and the people or systems that need access. PlatformOne decides within 1 business day. Access is granted to any U.S. federal agency, or its authorized contractor acting for it, that uses or is evaluating ComplianceONE. FedRAMP is always granted. No non-disclosure agreement is required.
Access is delivered as a link to the ComplianceONE Trust Center carrying a 256-bit random token. The link gives continuing access to everything the grant covers until it is revoked or expires; nobody approves each visit. Every access is logged, and each agency can fetch its own access history. A denial records its reason and is reported to FedRAMP within 5 business days.
What is public without a request
The Certification Package Overview, the public certification data, the service list, the change history, the status page and the Secure Configuration Guide are on the Trust Center for everyone, as pages and as JSON.
Trust Center · Services · Changes · Status · Secure Configuration Guide · Programmatic access · Security