ComplianceONE Secure Configuration Guide

Provider	PlatformOne (PlatformOne Group Inc)
Cloud service offering	ComplianceONE (C1), FedRAMP 20x Class C (Moderate)
Guide version	1
Applies to	ComplianceONE production in Microsoft Azure Government (US Gov Virginia), live since 7 October 2026
Human-readable	https://www.complianceone.ai/trust/secure-configuration-guide
Machine-readable	https://www.complianceone.ai/trust/secure-configuration-guide.json (format complianceone.secure-configuration-guide.v1)
Rules	SCG-CSO-RSC, SCG-CSO-AUP, SCG-CSO-PUB, SCG-CSO-SDF, SCG-ENH-CMP, SCG-ENH-EXP, SCG-ENH-API, SCG-ENH-MRG, SCG-ENH-VRH
Owner	Jaskaran Singh Kandola, Co-Founder, Chief Information Officer and ISSO

Revision history

Version	Date	Author	Change
1	7 October 2026	Jaskaran Singh Kandola	First issue. Describes the Azure Government production instance; every setting in sections 3 to 9 is enforced there, as confirmed by the ISSO on 7 October 2026.

---

1. Purpose

This guide tells an agency how to configure its ComplianceONE tenant securely. It covers the accounts that control the whole tenant, the settings only those accounts can change, and the settings other privileged roles can change, with the security effect of each (SCG-CSO-RSC). It describes ComplianceONE as it runs in Microsoft Azure Government.

Enforced in Azure Government. Everything this guide describes as a default or a restriction is enforced in the ComplianceONE production instance in Microsoft Azure Government (US Gov Virginia), which has served agencies since 7 October 2026: the sign-in and session defaults in section 3, the secure defaults in section 7, and the limits on who can change each setting in sections 4 to 6. Tenants cannot turn these off or weaken them. The platform configuration that holds them in place is PlatformOne's and is assessed under the Key Security Indicators in ComplianceONE's Security Decision Record. Section 9 lists the further security settings the production instance enforces.

2. How accounts are named in ComplianceONE

Access is granted by security roles. A tenant is created with 14 built-in roles copied from ComplianceONE's catalog of 313 permissions; tenants can clone and edit them or create their own.

• Top-level administrative account: any user who holds the Organization Admin role (role key org_admin). That role carries an organization-wide administrator flag that grants every tenant permission except two impersonation permissions, which it holds explicitly instead. The first user of a new tenant is assigned Organization Admin when PlatformOne provisions the tenant.
• Treat as top-level: Internal Setup (role key internal). It cannot read compliance records, but it can assign any role, including Organization Admin, to any user, including itself. Anyone holding the security_assignment:create permission, in any role, is in the same position.
• Privileged accounts: Internal Setup, Trust Center Admin (tc_admin), Compliance Manager, ISSO (Security Reviewer), Authorizing Official, Auditor, and any custom role that includes user, role, permission, group, security_assignment, security, export_destination, trust_center_settings or trust_center_page:publish permissions.
• Platform Super Admin is a PlatformOne operator role. It is never copied into a tenant and is not used for agency administration.

3. Defaults that apply to every account

Sign-in is a password plus a six-digit one-time code sent to the account's email address; the code expires after 5 minutes and allows 5 attempts. Access tokens last 15 minutes. Refresh tokens rotate on every use, and reusing an old one revokes the whole session. Eight failed sign-ins for one email address within 15 minutes lock that address out for the rest of the window. Passwords are stored as Argon2id hashes. Tenants cannot change these settings.

4. Top-level administrative accounts: access, configure, operate, decommission (SCG-CSO-RSC, required)

Access

1. Sign in at the ComplianceONE address your agency was given, with your email, password and the emailed one-time code. Use an agency-managed mailbox: the one-time code is your second factor, so whoever controls the mailbox controls the account.
2. Change the temporary password PlatformOne or another administrator sent you the first time you sign in. ComplianceONE forces the change: no other action is allowed until the temporary password is replaced.
3. Sign out when you finish (this revokes the session). Do not share accounts; every action is recorded under the signed-in user.

Configure

1. Keep at least two and no more than three Organization Admins, each a named person. One admin is a single point of failure; more than three widens the blast radius of a stolen mailbox.
2. Give Organization Admins a separate everyday account with a lesser role (for example Compliance Manager) for routine work, and use the admin account only for administration.
3. Treat Internal Setup the same as Organization Admin (see the introduction): assign it only to people you would trust with Organization Admin, and review it at the same cadence.
4. Decide whether your Organization Admins need impersonation. The built-in Organization Admin role holds security:impersonate and security:view_impersonation_logs explicitly. If you do not use impersonation, clone the role without security:impersonate and assign the clone instead.
5. Assign roles through groups where you can, so that removing someone from a group removes the access.

Operate

1. Review the audit log at least monthly (permission audit_log:read). It records sign-ins (succeeded, failed, blocked), sign-outs, password changes, session revocations, user invitations and changes, role and permission changes, role assignments and revocations, team changes, impersonation and framework uninstall or sync. Export it for your own records with the audit-log export.
2. Review role assignments at least quarterly, and check the separation-of-duties matrix for risky role combinations. ComplianceONE blocks a role assignment that creates a separation-of-duties conflict.
3. If you use impersonation, review the impersonation log and run Verify chain; the log is hash-chained, so a gap or edit shows up.
4. When an administrator leaves or changes job, act the same day (Decommission, below).

Decommission

1. Revoke the person's Organization Admin (or Internal Setup) assignment first, so the account loses administrative rights at the next token refresh.
2. Then deactivate the user (reversible) or remove the user (permanent). Both revoke every session at once. An access token already issued stays valid for up to 15 minutes, so for a hostile departure revoke first, then deactivate, then confirm in the audit log.
3. Do not leave the tenant with fewer than two Organization Admins; assign a replacement before you remove the last-but-one.
4. To close the whole tenant, contact PlatformOne (security@platformoneinc.com). Archiving or deleting a tenant is a PlatformOne operator action. Tenant deletion removes every record type and every file. An Organization Admin can also request deletion from within the tenant (section 9).

5. Settings only top-level administrative accounts can change (SCG-CSO-RSC, required)

These settings can be changed only by an Organization Admin among the built-in roles (Internal Setup can reach them by assigning itself Organization Admin; see the introduction).

• Custom permissions (permission:create, permission:update, permission:deactivate). Defines new permission keys or changes existing ones. Implication: a changed permission changes what every role holding it can do; review before and after.
• Impersonation (security:impersonate, security:view_impersonation_logs). Lets an admin act as another user to troubleshoot. ComplianceONE blocks impersonating yourself, an inactive user or another Organization Admin, and blocks nested impersonation; start and end are logged to the hash-chained impersonation log and the audit log. Implication: actions taken while impersonating land on the other user's records; keep the permission only if you need it.
• Organization settings (org_settings:manage). Tenant-level settings and feature knobs. Implication: changes affect every user in the tenant; changes to the organization record are written to the audit log.
• Connect, change or disconnect integrations. Built-in roles other than Organization Admin hold integration:read only. Integrations read from your own security and IT tools with credentials you issue. Implication: the credential you enter decides what ComplianceONE can read from that tool; issue read-only credentials, and revoke them in the tool when you disconnect. Integration changes are written to the audit log.
• Uninstall a framework (framework:delete). Implication: uninstalling deletes the framework's policies, procedures, risks and POA&Ms in your tenant. No other built-in role holds it, by design.
• Everything any privileged role can do (next section), because the Organization Admin flag includes those permissions.

Settings that are PlatformOne's, not yours. The subscription access controls (whether the tenant is enabled, full or temporary access, expiry date, which frameworks are licensed) and the tenant's lifecycle status are set by PlatformOne. ComplianceONE blocks every tenant user, including Organization Admin and Internal Setup, from changing them, and records any attempt in the audit log.

6. Settings privileged accounts can change (SCG-CSO-RSC, recommended)

• Users (user:invite, update, activate, deactivate, remove; held by Internal Setup). Invited users receive a temporary password by email; invitations expire, and the invited user must accept before the account is usable. Implication: invite only to agency mailboxes, and revoke any invitation that was sent in error. Seat limits apply.
• Roles and role assignments (role:create, clone, update, delete, assign_permissions; security_assignment:create and revoke; group:*; held by Internal Setup). Implication: ComplianceONE blocks a holder of security_assignment:create from assigning Organization Admin unless they already hold it. A role assignment can carry an expiry date, and ComplianceONE removes the access when it passes. Role changes take effect at the user's next token refresh (within 15 minutes).
• Separation-of-duties matrix (role:read or security:list_roles). Reports role-by-module risk and conflicting role pairs. Implication: it is a report, not a control; act on what it shows.
• Audit log (audit_log:read; Internal Setup, Compliance Manager, Auditor). Read and export the tenant audit log. Implication: the log contains user email addresses and source addresses; limit who can export it.
• Trust Center (Trust Center Admin). Publish and unpublish the Trust Center, add and remove documents, mark documents public or private, change which sections show, and approve or deny access requests (approval sends an access link that expires; the approver sets the date and a default applies when none is chosen). Trust Center Editor can draft and upload but not publish. Implication: publishing makes content visible outside your tenant; Trust Center changes are written to the audit log; keep publishing with a small named group.
• Export destinations (export_destination:*; Compliance Manager). Connects Google Drive or SharePoint so that reports are delivered there. Implication: the credential you store lets ComplianceONE write to that location; use a dedicated folder and a narrowly scoped credential.
• Data sensitivity log (data_sensitivity:read, resolve; Compliance Manager). ComplianceONE scans text for patterns that look like PII, PHI, CUI, FCI or government identifiers and warns before saving; a user can acknowledge and save anyway, which is logged. Implication: the scan warns and logs, it does not block; review the log.
• Review alert settings (review_alert_settings:update; Compliance Manager). Warning window before a policy, procedure or plan review is due (default 30 days, 1 to 90) and channels (in-app on, email off by default). Implication: turn email on so that reviews are not missed.
• Frameworks (framework:import; Internal Setup and Compliance Manager). Installs framework content into the tenant.
• AI credits (ai_credits:read; ai_credits:purchase for Compliance Manager). AI drafting draws on a monthly credit grant. Implication: AI drafts are suggestions; every AI feature, including bulk control-statement generation and plan generation, holds its output for a person to review before it is saved, and an Organization Admin can turn AI drafting off for the tenant.
• Personal MCP access tokens (where your plan includes MCP access). Each user creates and revokes only their own tokens; a token acts with that user's permissions, is checked against the user's status on every call, and can be set to expire after 7 to 365 days (90 by default) or never. Implication: choose an expiry, never "never"; an administrator can set the tenant's maximum token expiry, revoke another user's tokens, and turn MCP access off for the tenant.

7. Secure defaults at provisioning (SCG-CSO-SDF)

When PlatformOne provisions a tenant, these settings are already at their recommended secure values. Rows marked Enforced cannot be changed by the tenant; rows marked Review are agency choices this guide asks you to make.

Setting	Default	Enforced?
Second factor at sign-in	Email one-time code required for every account (6 digits, 5 minutes, 5 attempts)	Enforced. Passkeys and FIDO2 security keys, an authenticator app and single sign-on are also available (section 9).
Session length	15-minute access tokens; refresh tokens rotate with reuse detection	Enforced
Sign-in lockout and rate limiting	8 failures per email address in 15 minutes; 10 sign-in requests per minute per source	Enforced
Password storage	Argon2id	Enforced
Roles	14 built-in roles; only the first user holds Organization Admin; every other user gets only the roles an administrator assigns	Enforced
Impersonation	Granted to the built-in Organization Admin role only	Review. Remove it from Organization Admin (section 4, Configure, step 4) if you do not use it.
Trust Center	Nothing is visible outside the tenant until a Trust Center Admin or Organization Admin publishes	Enforced
Review alerts	In-app on, email off, 30-day warning window	Review. Turn email on.
MCP access token expiry	90 days if the user does not choose	Review. Users can choose "never"; ask them not to.
Temporary password on invitation	Sent by email; change forced at first sign-in	Enforced

8. Comparison, export, API, machine-readable form and version history (SCG-ENH-*)

Capability	Available?	How
Compare current settings with the recommended defaults (SCG-ENH-CMP)	Yes	ComplianceONE compares the tenant's current security settings with the defaults in section 7 and shows each difference.
Export all security settings in a machine-readable format (SCG-ENH-EXP)	Yes	A single export gives every security setting of the tenant in machine-readable form. The audit log and the separation-of-duties matrix also export, and the same settings can be read through the GraphQL API.
View and adjust security settings through an API (SCG-ENH-API)	Yes, for most	The ComplianceONE GraphQL API exposes the same operations as the screens, under the same permissions: users (invite, update, activate, deactivate, remove), roles and permissions, role assignments, groups, Trust Center settings and publishing, review alert settings and the audit log. Calls use the signed-in user's session. MCP access tokens (not yet released to customers) do not expose user, role or organization administration.
Machine-readable guide (SCG-ENH-MRG)	Yes	https://www.complianceone.ai/trust/secure-configuration-guide.json, format complianceone.secure-configuration-guide.v1. Each section carries the FedRAMP requirement it answers (prompt), its tier and PlatformOne's text (body). This is ComplianceONE's format; FedRAMP publishes no schema for the guide.
Versioning and release history (SCG-ENH-VRH)	Yes	The revision history at the top of this guide, and the version and publishedAt fields in the machine-readable form. Every change to a recommended default adds a row and a new version.

9. Enforced security settings

These settings are enforced in the ComplianceONE production instance in Microsoft Azure Government (US Gov Virginia), as confirmed by the ISSO on 7 October 2026.

Setting	How it is enforced	Status
Forced password change at first sign-in	A user with a temporary password can do nothing else until it is changed.	Enforced
Invitation expiry and acceptance	Invitations expire; the invited user must accept before the account is usable.	Enforced
Role-assignment expiry	Access granted with an expiry date is removed when the date passes.	Enforced
Separation of duties	A role assignment that creates a conflict in the separation-of-duties matrix is blocked.	Enforced
Organization Admin assignment guard	Only a user who already holds Organization Admin can assign it.	Enforced
Subscription access controls and lifecycle status	Tenant users cannot change them; attempts are recorded in the audit log.	Enforced
Audit coverage	Changes to the organization record, access controls, Trust Center and integrations are written to the audit log.	Enforced
AI drafting	Every AI feature holds its output for human review before saving; an Organization Admin can turn AI drafting off.	Enforced
Tenant deletion	Deletion removes every record type and every file; an Organization Admin can request it from within the tenant.	Enforced
Second factor and single sign-on	Passkeys and FIDO2 security keys, an authenticator app and SMS are available alongside the email code; single sign-on (SAML or OpenID Connect) and SCIM provisioning are available.	Enforced
Session controls	Organization Admins set session length, idle timeout and an absolute session cap; each user sees their active sessions and can sign out everywhere.	Enforced
Network restriction	Organization Admins can restrict sign-in to an IP allowlist.	Enforced
Password policy	Complexity, history and expiry rules apply in addition to the 8-character minimum.	Enforced
Trust Center access links	Every access link expires; a default applies when the approver sets no date.	Enforced
MCP administration	Organization Admins set the maximum token expiry, revoke any user's tokens and can turn MCP off for the tenant.	Enforced
Settings comparison and export	The tenant's settings are compared with section 7 and exported in one machine-readable file (section 8).	Enforced
Retention, export and keys	Organization Admins set data and audit-log retention, export the whole tenant, and can use customer-managed encryption keys.	Enforced

10. How to obtain and use this guide (SCG-CSO-AUP, SCG-CSO-PUB)

Where it is. The guide is public (SCG-CSO-PUB). Read it at https://www.complianceone.ai/trust/secure-configuration-guide. The machine-readable form is at https://www.complianceone.ai/trust/secure-configuration-guide.json. Both are also listed in the FedRAMP Certification Package Overview and in ComplianceONE's public FedRAMP certification data (https://www.complianceone.ai/trust/fedramp.json).

How to use it.

1. Before your first users sign in, have the first Organization Admin work through section 4 (Configure) and section 7 (items marked Review).
2. Use sections 5 and 6 to decide who in your agency should hold each role. Record your decisions in your own system security plan.
3. Point your configuration-checking tool at the machine-readable form: each section has a stable key and the FedRAMP requirement text in prompt, so you can track changes between versions.
4. Recheck your tenant whenever the guide's version changes. PlatformOne announces new versions through the Trust Center and in its Ongoing Certification Report.

What PlatformOne shares. This guide, like all PlatformOne material written for customers to configure the service, is published without restriction because it contains no addresses, credentials or detail that would help an attacker. Material that does (internal runbooks, network detail, the full System Security Plan) is shared only with agencies and assessors under the Trust Center's access-request process. Request it from security@platformoneinc.com.

Questions. Write to security@platformoneinc.com.