Controls (generated from OSCAL)
Self-assessed, not audited. We hold no certification or authorization. Each row is one control that our OSCAL component definition reti-platform maps: controls of the NIST SP 800-53 Rev 5 HIGH baseline plus IA-9 (mapped but outside HIGH). The status is per component and is our own assessment. “Planned” means not built. Lab nodes use a software TPM, and nothing is a FIPS 140-validated module.
39 implemented requirements across 29 controls: 7 planned, 29 partial, 3 implemented.
| Control | Status per component |
|---|---|
| AC-03 Access Enforcement | OpenBao SPIFFE JWT auth and policies (canary): partial |
| AC-06 Least Privilege | Evidence reader (read-only RBAC): implemented OpenBao SPIFFE JWT auth and policies (canary): partial |
| AC-06(05) Privileged Accounts | OpenBao SPIFFE JWT auth and policies (canary): partial |
| AC-17 Remote Access | Cloudflare Tunnel and WARP access: partial |
| AC-17(01) Monitoring and Control | Cloudflare Tunnel and WARP access: planned |
| AC-17(02) Protection of Confidentiality and Integrity Using Encryption | Cloudflare Tunnel and WARP access: partial |
| AU-10 Non-repudiation | Signed agent task records: partial |
| CM-02 Baseline Configuration | Flux GitOps: implemented |
| CM-03 Configuration Change Control | Flux GitOps: partial |
| CM-06 Configuration Settings | Flux GitOps: partial |
| CM-07 Least Functionality | Talos node: partial |
| CM-08 System Component Inventory | SPIRE agent workload identity (canary): partial |
| IA-02 Identification and Authentication (Organizational Users) | Keycloak customer sign-in (canary): partial |
| IA-02(01) Multi-factor Authentication to Privileged Accounts | Keycloak customer sign-in (canary): planned |
| IA-02(02) Multi-factor Authentication to Non-privileged Accounts | Keycloak customer sign-in (canary): planned |
| IA-02(12) Acceptance of PIV Credentials | Keycloak customer sign-in (canary): planned |
| IA-05 Authenticator Management | OpenBao SPIFFE JWT auth and policies (canary): partial |
| IA-05(02) Public Key-based Authentication | sops/age YubiKey root secrets store: partial Keycloak customer sign-in (canary): planned |
| IA-09 Service Identification and Authentication | SPIRE (canary): partial OpenBao SPIFFE JWT auth and policies (canary): partial SPIRE agent workload identity (canary): partial |
| SC-07 Boundary Protection | Talos node: partial Cloudflare Tunnel and WARP access: partial |
| SC-07(05) Deny by Default — Allow by Exception | Cloudflare Tunnel and WARP access: partial |
| SC-08 Transmission Confidentiality and Integrity | Talos node: partial Lab artifact cache and boot image distribution: planned |
| SC-08(01) Cryptographic Protection | Talos node: partial |
| SC-12 Cryptographic Key Establishment and Management | OpenBao (canary): partial sops/age YubiKey root secrets store: partial |
| SC-13 Cryptographic Protection | sops/age YubiKey root secrets store: partial |
| SC-28 Protection of Information at Rest | sops/age YubiKey root secrets store: partial Talos node: implemented |
| SC-28(01) Cryptographic Protection | Talos node: partial |
| SI-07 Software, Firmware, and Information Integrity | Flux GitOps: planned Talos node: partial Signed agent task records: partial |
| SI-07(15) Code Authentication | Lab artifact cache and boot image distribution: partial |