{
  "$comment": "CDS-CSO-SVC public service list, in the PublicServiceList shape the Trust Center serves at /public/trust-center/{slug}/services.json, published at https://www.complianceone.ai/trust/services.json. securityCategory uses the product's lowercase FIPS 199 values. Describes the Azure Government configuration, in production.",
  "generatedAt": "2026-10-07T00:00:00Z",
  "fedRampId": "FR2700754082",
  "serviceName": "ComplianceONE",
  "certificationPackageOverviewUri": "https://www.complianceone.ai/trust/cpo.json",
  "services": [
    {
      "serviceName": "Frameworks and controls",
      "serviceDescription": "Install FedRAMP 20x and Rev5, NIST SP 800-53, NIST SP 800-171 and CMMC, GovRAMP, DoD Impact Level, TX-RAMP, ITAR and AS9100 catalogs. Record implementation status, control statements, responsibility and tailoring, with common controls and cross-framework mapping.",
      "dateAvailable": "2026-10-07",
      "securityCategory": "moderate",
      "inScope": true
    },
    {
      "serviceName": "Policies and procedures",
      "serviceDescription": "Write, version, review and approve policies, procedures and plans from framework templates, with review workflows and an evidence trail.",
      "dateAvailable": "2026-10-07",
      "securityCategory": "moderate",
      "inScope": true
    },
    {
      "serviceName": "Evidence",
      "serviceDescription": "Upload, organize and link evidence files and records to controls. Files are stored encrypted with customer-managed keys.",
      "dateAvailable": "2026-10-07",
      "securityCategory": "moderate",
      "inScope": true
    },
    {
      "serviceName": "POA&M and risk",
      "serviceDescription": "Plans of action and milestones, risk register, findings, deviation and risk-acceptance workflows.",
      "dateAvailable": "2026-10-07",
      "securityCategory": "moderate",
      "inScope": true
    },
    {
      "serviceName": "Assessments and reports",
      "serviceDescription": "Gap and self-assessments; System Security Plan and OSCAL generation; FedRAMP 20x package builders (Certification Package Overview, Security Decision Record, Ongoing Certification Report, SCN, incident and vulnerability reports), each validated against FedRAMP's JSON schemas.",
      "dateAvailable": "2026-10-07",
      "securityCategory": "moderate",
      "inScope": true
    },
    {
      "serviceName": "Integrations (read-only)",
      "serviceDescription": "Customer-authorized, read-only connections to the customer's own security and IT tools (31 supported), used to collect posture and evidence into ComplianceONE. The connected third-party tools themselves are outside the FedRAMP scope and remain the customer's responsibility.",
      "dateAvailable": "2026-10-07",
      "securityCategory": "moderate",
      "inScope": true
    },
    {
      "serviceName": "Trust Center",
      "serviceDescription": "Publish a customer's own certification data, public status page, documents and access-controlled sharing with agencies, including access requests, access logs and snapshots.",
      "dateAvailable": "2026-10-07",
      "securityCategory": "moderate",
      "inScope": true
    },
    {
      "serviceName": "Monitoring: incidents, vulnerabilities and CVE Hunter",
      "serviceDescription": "Incident register with FedRAMP reporting clocks and reports; vulnerability tracking with internet-reachability, exploitability and PAIN ratings; CVE Hunter matching published vulnerabilities and the CISA KEV catalog to the customer's components; continuous-monitoring calendar.",
      "dateAvailable": "2026-10-07",
      "securityCategory": "moderate",
      "inScope": true
    },
    {
      "serviceName": "AI drafting assistant (CORA)",
      "serviceDescription": "Drafts control statements, policies, plans and answers using Azure OpenAI Service in Azure Government. Customer data is not used for training, and Microsoft does not store prompts or completions (abuse-monitoring exemption). A person reviews drafts before they are saved.",
      "dateAvailable": "2026-10-07",
      "securityCategory": "moderate",
      "inScope": true
    },
    {
      "serviceName": "Marketing website (complianceone.ai pages outside /trust)",
      "serviceDescription": "Public product and company information. Holds no customer data.",
      "securityCategory": "",
      "inScope": false
    },
    {
      "serviceName": "Help center",
      "serviceDescription": "Public product documentation and how-to articles. Holds no customer data.",
      "securityCategory": "",
      "inScope": false
    },
    {
      "serviceName": "Billing and subscriptions",
      "serviceDescription": "Payment and invoicing handled by a third-party payment processor (Stripe) outside the boundary. Holds billing contacts and payment tokens only, never federal customer data.",
      "securityCategory": "",
      "inScope": false
    }
  ],
  "declaresExclusions": true
}