FedRAMP ID FR2700754082 · generated 2026-10-07
| Service | Description | Security category | In scope | Available |
|---|---|---|---|---|
| Frameworks and controls | Install FedRAMP 20x and Rev5, NIST SP 800-53, NIST SP 800-171 and CMMC, GovRAMP, DoD Impact Level, TX-RAMP, ITAR and AS9100 catalogs. Record implementation status, control statements, responsibility and tailoring, with common controls and cross-framework mapping. | moderate | Yes | 2026-10-07 |
| Policies and procedures | Write, version, review and approve policies, procedures and plans from framework templates, with review workflows and an evidence trail. | moderate | Yes | 2026-10-07 |
| Evidence | Upload, organize and link evidence files and records to controls. Files are stored encrypted with customer-managed keys. | moderate | Yes | 2026-10-07 |
| POA&M and risk | Plans of action and milestones, risk register, findings, deviation and risk-acceptance workflows. | moderate | Yes | 2026-10-07 |
| Assessments and reports | Gap and self-assessments; System Security Plan and OSCAL generation; FedRAMP 20x package builders (Certification Package Overview, Security Decision Record, Ongoing Certification Report, SCN, incident and vulnerability reports), each validated against FedRAMP's JSON schemas. | moderate | Yes | 2026-10-07 |
| Integrations (read-only) | Customer-authorized, read-only connections to the customer's own security and IT tools (31 supported), used to collect posture and evidence into ComplianceONE. The connected third-party tools themselves are outside the FedRAMP scope and remain the customer's responsibility. | moderate | Yes | 2026-10-07 |
| Trust Center | Publish a customer's own certification data, public status page, documents and access-controlled sharing with agencies, including access requests, access logs and snapshots. | moderate | Yes | 2026-10-07 |
| Monitoring: incidents, vulnerabilities and CVE Hunter | Incident register with FedRAMP reporting clocks and reports; vulnerability tracking with internet-reachability, exploitability and PAIN ratings; CVE Hunter matching published vulnerabilities and the CISA KEV catalog to the customer's components; continuous-monitoring calendar. | moderate | Yes | 2026-10-07 |
| AI drafting assistant (CORA) | Drafts control statements, policies, plans and answers using Azure OpenAI Service in Azure Government. Customer data is not used for training, and Microsoft does not store prompts or completions (abuse-monitoring exemption). A person reviews drafts before they are saved. | moderate | Yes | 2026-10-07 |
| Marketing website (complianceone.ai pages outside /trust) | Public product and company information. Holds no customer data. | No | N/A | |
| Help center | Public product documentation and how-to articles. Holds no customer data. | No | N/A | |
| Billing and subscriptions | Payment and invoicing handled by a third-party payment processor (Stripe) outside the boundary. Holds billing contacts and payment tokens only, never federal customer data. | No | N/A |
Machine-readable: services.json.
Trust Center · Services · Changes · Status · Secure Configuration Guide · Programmatic access · Security