Agency and FedRAMP access
What this repository holds
- A monthly human-readable vulnerability detection and response report: a high-level overview of every detection and response activity in the period, each vulnerability with its detection source and potential agency impact rating, and the accepted vulnerabilities with their justification
- The machine-readable history (history.json), updated at least every 14 days
- Detail records for individual vulnerabilities where an agency needs them for a risk decision
Reports never disclose detail that would likely lead to exploitation. Vulnerabilities found through the public disclosure program are included with the source recorded as vulnerability disclosure.
How to request access
Email security@platformoneinc.com from an official address, naming the agency, the purpose (for example an authorization decision or a continuous-monitoring review) and the people or systems that need access. PlatformOne decides within 1 business day. Access is granted to any U.S. federal agency, or its authorized contractor acting for it, that uses or is evaluating ComplianceONE. FedRAMP is always granted. No non-disclosure agreement is required.
Access is delivered as a link to the ComplianceONE Trust Center carrying a 256-bit random token. The link gives continuing access to everything the grant covers until it is revoked or expires; nobody approves each visit. Every access is logged, and each agency can fetch its own access history. A denial records its reason and is reported to FedRAMP within 5 business days.
What is public without a request
The Certification Package Overview, the public certification data, the service list, the change history, the status page and the Secure Configuration Guide are on the Trust Center for everyone, as pages and as JSON.
Trust Center · Services · Changes · Status · Secure Configuration Guide · Programmatic access · Security