Compliance documents

Arivaran Twin security and compliance documentation. These documents map our controls to the NIST 800-53 High baseline in support of FedRAMP, CMMC, and ITAR programs. Control mappings reflect configured controls, not an independent assessment, authorization, or certification.

Governance policies

Information Security Policy

Organization-wide security controls, risk management, and governance framework.

NIST: AC, AT, AU, CA, CM, CP, IA, IR, MA, MP, PE, PL, PS, RA, SA, SC, SIUpdated 2026-03-15

Encryption Policy

FIPS 140-2 cryptographic modules (CMVP module/OE validation evidence pending), TLS 1.3, AES-256-GCM at rest.

NIST: SC-8, SC-12, SC-13, SC-28Updated 2026-03-15

Access Control Policy

RBAC, least privilege, MFA enforcement, session management.

NIST: AC-2, AC-3, AC-6, AC-7, AC-11, AC-17Updated 2026-03-15

Incident Response Policy

Detection, analysis, containment, eradication, recovery, and notification procedures.

NIST: IR-1 through IR-8Updated 2026-03-15

Data Retention Policy

Retention schedules, disposal methods, and legal hold procedures.

NIST: SI-12, MP-6, AU-11Updated 2026-03-15

Business Continuity Policy

Disaster recovery, failover procedures, RPO/RTO targets.

NIST: CP-1 through CP-10Updated 2026-03-15

Change Management Policy

Change control board, approval workflow, rollback procedures.

NIST: CM-1 through CM-9Updated 2026-03-15

Vendor Management Policy

Third-party risk assessment, supply chain security, continuous monitoring.

NIST: SA-9, SA-12, SR-1 through SR-6Updated 2026-03-15

Risk Management Policy

Risk identification, assessment, treatment, and monitoring framework.

NIST: RA-1 through RA-5Updated 2026-03-15

Human Resources Security Policy

Personnel screening, training, termination procedures.

NIST: PS-1 through PS-8Updated 2026-03-15

Technical architecture

FedRAMP High Deployment Guide

Architecture overview, NIST 800-53 High control mapping, air-gap procedures.

NIST: Full NIST 800-53 High baselineUpdated 2026-03-22

Satellite PKI Trust Chain

Certificate hierarchy, step-ca configuration, contract-limited cert lifetimes.

NIST: IA-5, SC-12, SC-17Updated 2026-03-22

Satellite Air-Gap Deployment

Air-gap procedures, ECR image mirroring, offline certificate authority.

NIST: SC-7, CA-3, CM-7Updated 2026-03-22

Satellite Database Architecture

PostgreSQL CNPG, Citus sharding, per-tenant isolation, backup strategy.

NIST: SC-28, CP-9, AC-3Updated 2026-03-22

Satellite Storage Tiers

3-tier ABC storage, dedup, S3 presigned URLs, data lifecycle.

NIST: MP-4, SC-28, SI-12Updated 2026-03-22

Harbor Image Governance

Container image scanning, signing, proxy registries, Kyverno enforcement.

NIST: CM-7, SA-10, SI-7Updated 2026-03-22

PKI Root Rotation

Root CA rotation procedures, intermediate re-issuance, trust chain.

NIST: SC-12, SC-17, IA-5Updated 2026-03-22

Contractual & legal

Data Processing Agreement

Data processing terms, sub-processors, cross-border transfers.

NIST: N/A (contractual)Updated 2026-03-15

Data collection, processing, and individual rights.

NIST: N/A (regulatory)Updated 2026-03-15

Need a specific document format (PDF, DOCX) or have questions? Contact compliance@arivaran.ai