CMMC Level 2 Control Guide
Who implements each CMMC Level 2 practice in a tiCrypt deployment, how tiCrypt meets it, and what the university still owns. NIST SP 800-171 Rev 3 guide
tiCrypt74Shared11University2585 of 110 practices met by tiCrypt alone or shared
One row per CMMC Level 2 practice, the 110 NIST SP 800-171 Rev 2 requirements a C3PAO assesses. Select a row to read it in full.
| Practice | Requirement | Responsibility | How tiCrypt addresses it | University action | Rev 3 requirement | Rev 2 → Rev 3 | SSP control card (800-53) | Learn more |
|---|---|---|---|---|---|---|---|---|
Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems). | tiCrypt | Every user authenticates with a unique RSA-2048 key pair plus password (signed challenge-response); there is no backdoor or shared access path. A user can open a resource only if its AES key has been re-encrypted to that user's public key. | Run the account lifecycle: approve new accounts, assign teams and permission profiles, and remove users who no longer need access. | Retained | ||||
Limit system access to the types of transactions and functions that authorized users are permitted to execute. | tiCrypt | Permission profiles limit which actions each user can perform, with per-user overrides by administrators. Access is enforced cryptographically, so the server cannot extend access on an owner's behalf. | Define permission profiles and assign them to users and teams. | Retained | ||||
Control the flow of CUI in accordance with approved authorizations. | tiCrypt | CUI moves only through tiCrypt's encrypted, audited channels (Vault transfers in encrypted chunks, managed tunnels). SFTP into the enclave is upload-only, and exports out of a project require explicit, logged authorization. | Designate who may approve exports out of a project. | Retained | ||||
Separate the duties of individuals to reduce the risk of malevolent activity without collusion. | tiCrypt | Tiered administrative roles (sub-admin, admin, super admin, infrastructure root) separate duties, and every admin tier is cryptographically excluded from reading user data. | Decide which staff hold each admin tier and document the profile assignments. | Retained | ||||
Employ the principle of least privilege, including for specific security functions and privileged accounts. | tiCrypt | Profiles grant only the actions a user needs, and data access is limited to resources whose keys were shared with the user. Users removed from all teams are automatically deactivated. | Define least-privilege profiles and review privilege assignments periodically. | Retained | ||||
Use non-privileged accounts or roles when accessing nonsecurity functions. | tiCrypt | Administrative functions require explicit role elevation. Administrators use separate non-privileged identities for ordinary user work. | Ensure admins use their non-privileged account for day-to-day research work. | Retained | ||||
Prevent non-privileged users from executing privileged functions and capture the execution of such functions in audit logs. | tiCrypt | Privileged functions are restricted to authorized admin tiers, and every privileged operation is recorded with the user's identity in the tamper-evident audit trail. | None, provided by tiCrypt | Retained | ||||
Limit unsuccessful logon attempts. | tiCrypt | Accounts lock after a configurable number of failed private-key decryption attempts (default 5) and stay locked until an administrator releases them. | Set the lockout threshold (default 5). | Retained | ||||
Provide privacy and security notices consistent with applicable CUI rules. | tiCrypt | A configurable system-use banner with privacy and security notices is displayed before login. | Provide the banner text approved by your institution. | Retained | ||||
Use session lock with pattern-hiding displays to prevent access and viewing of data after a period of inactivity. | tiCrypt | Idle sessions lock after a configurable interval (default 15 minutes), hide the display, and purge keys client-side; the user must re-authenticate. | Set the idle-lock interval (default 15 minutes). | Retained | ||||
Terminate (automatically) a user session after a defined condition. | tiCrypt | Command sessions end automatically after inactivity, graphical sessions lock and require re-authentication, and keys are purged on logout. | Set session-termination thresholds. | Retained | ||||
Monitor and control remote access sessions. | tiCrypt | All remote access goes through the Connect client and the authenticated proxy; there is no direct SSH, RDP, or console access to VMs. Every session is logged. | None, provided by tiCrypt | Retained | ||||
Employ cryptographic mechanisms to protect the confidentiality of remote access sessions. | tiCrypt | Remote sessions are double-encrypted: TLS plus a per-session Diffie-Hellman layer between client and VM, using FIPS-validated AES-256, RSA-2048, and SHA-256. | None, provided by tiCrypt | Withdrawn: incorporated | ||||
Route remote access via managed access control points. | tiCrypt | The Connect client and backend proxy are the single managed entry point; only ports 22 and 443 accept inbound traffic. | None, provided by tiCrypt | Withdrawn: incorporated | ||||
Authorize remote execution of privileged commands and remote access to security-relevant information. | tiCrypt | Remote privileged commands are limited to authorized admins, authenticated through the same proxy, and logged. | Document which remote privileged commands are authorized. | Withdrawn: incorporated | ||||
Authorize wireless access prior to allowing such connections. | University | University control | Retained | |||||
Protect wireless access using authentication and encryption. | University | University control | Withdrawn: incorporated | |||||
Control connection of mobile devices. | University | University control | Retained | |||||
Encrypt CUI on mobile devices and mobile computing platforms. | University | University control | Withdrawn: incorporated | |||||
Verify and control/limit connections to and use of external systems. | tiCrypt | External systems cannot connect directly. VMs deny all outbound traffic by default, and any external endpoint (e.g., a license server) requires an explicit allowlist rule approved by a SuperAdmin. | Define the policy for permitted external connections and exports. | Retained | ||||
Limit use of portable storage devices on external systems. | University | University control | Withdrawn: incorporated | |||||
Control CUI posted or processed on publicly accessible systems. | Shared | The platform exposes no publicly accessible content. | Designate who may post information publicly and review public postings to confirm no CUI is released. | Retained | ||||
Ensure that managers, systems administrators, and users of organizational systems are made aware of the security risks associated with their activities and of the applicable policies, standards, and procedures related to the security of those systems. | University | University control | Retained | |||||
Ensure that personnel are trained to carry out their assigned information security-related duties and responsibilities. | University | University control | Retained | |||||
Provide security awareness training on recognizing and reporting potential indicators of insider threat. | University | University control | Withdrawn: incorporated | |||||
Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity. | tiCrypt | Audit logging is always on and cannot be disabled or bypassed. 150+ event types are recorded (authentication, files, sharing, VMs, keys, admin actions), and records are kept for the life of the deployment by default on your own audit server. | Confirm the retention period meets your records policy (default: retained indefinitely) and back up the audit server. | Retained: split | ||||
Ensure that the actions of individual system users can be uniquely traced to those users, so they can be held accountable for their actions. | tiCrypt | Every action is tied to an authenticated user, session, and source IP, with millisecond UTC timestamps and a hash-chain position. | None, provided by tiCrypt | Retained | ||||
Review and update logged events. | Shared | tiCrypt supplies the audit data, query tools, and real-time alerting; the logged event set is defined by the product. | Set a review cadence, assign reviewers, investigate alerts, and periodically confirm the logged events still meet your needs. | Merged | ||||
Alert in the event of an audit logging process failure. | tiCrypt | The logging path is fail-closed: capacity alerts fire and key issuance halts at 90% log-storage use. Real-time alerts at five severity levels flag failures such as hash-chain breaks. | Route alerts to the right staff (email, Splunk, or another SIEM). | Retained | ||||
Correlate audit record review, analysis, and reporting processes for investigation and response to indications of unlawful, unauthorized, suspicious, or unusual activity. | tiCrypt | The separate audit system (ClickHouse) correlates events across users, resources, event types, and time ranges, and can forward alerts to Splunk, email, or other SIEMs. | Use the audit tools in your review process; set review cadence and alert routing. | Retained | ||||
Provide audit record reduction and report generation to support on-demand analysis and reporting. | tiCrypt | A query builder, predefined compliance reports, direct SQL access, and Excel export support reduction and reporting without altering original records. | None, provided by tiCrypt | Retained | ||||
Provide a system capability that compares and synchronizes internal system clocks with an authoritative source to generate time stamps for audit records. | tiCrypt | All components record UTC timestamps with millisecond precision. | Synchronize host clocks to an authoritative NTP source. | Retained | ||||
Protect audit information and audit logging tools from unauthorized access, modification, and deletion. | tiCrypt | Audit records are SHA-256 hash-chained, so any change, insertion, or deletion is detectable. The backend pushes logs one way to a separate audit server with no return path. | None, provided by tiCrypt | Retained | ||||
Limit management of audit logging functionality to a subset of privileged users. | tiCrypt | Only a limited group of authorized infrastructure administrators can access audit logs, and records cannot be modified or deleted through the application. | Limit audit-server access to designated administrators. | Withdrawn: incorporated | ||||
Establish and maintain baseline configurations and inventories of organizational systems (including hardware, software, firmware, and documentation) throughout the respective system development life cycles. | University | University control | Retained: split | |||||
Establish and enforce security configuration settings for information technology products employed in organizational systems. | tiCrypt | Core security settings are architectural rather than optional. Automated configuration management reconciles components against the baseline, and system settings have full change tracking. | Set organization-defined values and approve any deviations. | Retained | ||||
Track, review, approve or disapprove, and log changes to organizational systems. | tiCrypt | Settings history records the previous value, new value, timestamp, and administrator. Platform releases are staged before production. | Run your change-control process (review and approve changes). | Retained | ||||
Analyze the security impact of changes prior to implementation. | tiCrypt | Changes to profiles, quotas, and project access go through audited Management Console controls, and Tera Insights evaluates platform changes before release. | Perform and record security impact analyses for changes in your environment. | Retained | ||||
Define, document, approve, and enforce physical and logical access restrictions associated with changes to organizational systems. | tiCrypt | Configuration changes are restricted to designated admins and audited. Software and VM images are signed, and boot images reset on every boot to prevent tampering. | Designate who may make changes and run change approval. | Retained | ||||
Employ the principle of least functionality by configuring organizational systems to provide only essential capabilities. | tiCrypt | Services are deny-by-default with only ports 22 and 443 open. VMs boot from immutable images containing only pre-approved software, with no persistent state. | None, provided by tiCrypt | Retained | ||||
Restrict, disable, or prevent the use of nonessential programs, functions, ports, protocols, and services. | tiCrypt | Images include only the OS and VM installer; extra software must be added by admins in a new image. Software can be blocked per project, and stack execution is disallowed. | Define any per-project software blocklists. | Withdrawn: incorporated | ||||
Apply deny-by-exception (blacklisting) policy to prevent the use of unauthorized software or deny-all, permit-by-exception (whitelisting) policy to allow the execution of authorized software. | tiCrypt | Per-project allowlists and blocklists are supported. The VM Controller governs execution, and users cannot modify boot images. | Define per-project allow/deny lists. | Retained | ||||
Control and monitor user-installed software. | tiCrypt | Users can install software only where no admin privilege is needed, and those installs are discarded at shutdown; only admin-approved base-image software persists. | Approve software added to base images. | Withdrawn: incorporated | ||||
Identify system users, processes acting on behalf of users, and devices. | tiCrypt | Each user has a unique RSA-2048 identity; processes and VMs are identified by UUIDs and digital signatures. | None, provided by tiCrypt | Retained | ||||
Authenticate (or verify) the identities of users, processes, or devices, as a prerequisite to allowing access to organizational systems. | tiCrypt | Users authenticate by signing a server challenge with their private key, no password is sent. Endpoints and VMs are authenticated by key material before any connection is established. | None, provided by tiCrypt | Retained: split | ||||
Use multifactor authentication for local and network access to privileged accounts and for network access to non-privileged accounts. | tiCrypt | MFA through Duo or Shibboleth is layered on top of the private-key signature. The MFA assertion is signed and verified independently, and its identity must match the key holder or the session is denied. | Enable MFA and set its scope (off until enabled). Provide MFA for host-level admin access outside tiCrypt. | Retained | ||||
Employ replay-resistant authentication mechanisms for network access to privileged and non-privileged accounts. | tiCrypt | Each login challenge uses a random single-use nonce, so a captured response cannot be replayed. | None, provided by tiCrypt | Retained | ||||
Prevent reuse of identifiers for a defined period. | tiCrypt | User identifiers and UUIDs are unique and never reused, even after deletion. | None, provided by tiCrypt | Retained | ||||
Disable identifiers after a defined period of inactivity. | tiCrypt | Inactive accounts are disabled after a configurable period, and users removed from all teams are deactivated. | Set the account-inactivity period. | Withdrawn: aligned with 800-53 | ||||
Enforce a minimum password complexity and change of characters when new passwords are created. | tiCrypt | Configurable password-strength rules apply at registration and on change, and passwords are screened against weak or compromised lists. The password only protects the user's local private key. | Define password composition rules. | Retained | ||||
Prohibit password reuse for a specified number of generations. | tiCrypt | Changing a password regenerates the key's salt and IV, which invalidates older copies of the key file. | Define password reuse rules in your password policy. | Withdrawn: aligned with 800-53 | ||||
Allow temporary password use for system logons with an immediate change to a permanent password. | tiCrypt | One-time registration requires the user to create a password and generate their key file immediately. | None, provided by tiCrypt | Withdrawn: aligned with 800-53 | ||||
Store and transmit only cryptographically-protected passwords. | tiCrypt | Passwords are never sent to or stored on the server. The private key is AES-256 encrypted client-side, and with MFA enabled the IV and salt are held on the server behind MFA, so neither side can recover the key alone. | None, provided by tiCrypt | Withdrawn: incorporated | ||||
Obscure feedback of authentication information. | tiCrypt | Password entry is obscured, and login errors are generic, they do not reveal whether a username exists or which credential failed. | None, provided by tiCrypt | Retained | ||||
Establish an operational incident-handling capability for organizational systems that includes preparation, detection, analysis, containment, recovery, and user response activities. | University | University control | Retained | |||||
Track, document, and report incidents to designated officials and/or authorities both internal and external to the organization. | Shared | Audit logs and real-time, severity-tiered alerts provide detection data and forensic evidence for investigations. | Track, document, and report incidents to designated officials and authorities, including DoD's 72-hour reporting window. | Retained | ||||
Test the organizational incident response capability. | University | University control | Retained | |||||
Perform maintenance on organizational systems. | University | University control | Withdrawn: not CUI-specific | |||||
Provide controls on the tools, techniques, mechanisms, and personnel used to conduct system maintenance. | tiCrypt | The management interface is the only maintenance tool for the platform, and all maintenance runs over authenticated, encrypted, audited channels. | Approve and inspect any maintenance tools used on host infrastructure. | Withdrawn: incorporated | ||||
Ensure equipment removed for off-site maintenance is sanitized of any CUI. | University | University control | Withdrawn: incorporated | |||||
Check media containing diagnostic and test programs for malicious code before the media are used in organizational systems. | University | University control | Retained | |||||
Require multifactor authentication to establish nonlocal maintenance sessions via external network connections and terminate such connections when nonlocal maintenance is complete. | tiCrypt | Remote maintenance uses the same RSA challenge-response authentication, with MFA where required; sessions are encrypted and closed when finished. | Pre-approve and supervise vendor remote access; enable MFA. | Retained | ||||
Supervise the maintenance activities of maintenance personnel without required access authorization. | University | University control | Retained | |||||
Protect (i.e., physically control and securely store) system media containing CUI, both paper and digital. | Shared | All data is AES-256 encrypted before it reaches any media, and decryption keys are never stored on the infrastructure, so media holds only ciphertext. | Physically control and securely store the media (disks, backups) that hold the ciphertext. | Retained | ||||
Limit access to CUI on system media to authorized users. | Shared | Reading CUI requires tiCrypt authentication and the owner's key, regardless of who can touch the media. | Control physical access to the media. | Retained | ||||
Sanitize or destroy system media containing CUI before disposal or release for reuse. | Shared | Cryptographic erasure: destroying a resource's per-file or per-drive key makes the remaining ciphertext unrecoverable. | Sanitize physical media and the unencrypted metadata database per NIST SP 800-88 before disposal or reuse, and make sure escrowed and backup key copies are destroyed. | Retained | ||||
Mark media with necessary CUI markings and distribution limitations. | Shared | tiCrypt's interfaces support configurable CUI markings and labels. | Apply physical markings, distribution limits, and handling caveats to media. | Retained | ||||
Control access to media containing CUI and maintain accountability for media during transport outside of controlled areas. | Shared | All transfers are logged, and data in transit is encrypted end to end. | Keep custody, accountability, and handling records for physical media transported outside controlled areas. | Retained | ||||
Implement cryptographic mechanisms to protect the confidentiality of CUI stored on digital media during transport unless otherwise protected by alternative physical safeguards. | tiCrypt | Data is ciphertext from the moment it is created (AES-256), so media, replicas, and backups are protected in transport without the owner's key; network transport adds TLS plus Diffie-Hellman. | None, provided by tiCrypt | Withdrawn: incorporated | ||||
Control the use of removable media on system components. | tiCrypt | VMs have no USB passthrough by default. Removable-media access is limited to privileged users and requires admin hardware configuration and approval. | Set the removable-media approval policy. | Retained | ||||
Prohibit the use of portable storage devices when such devices have no identifiable owner. | tiCrypt | Every drive, file, and VM in tiCrypt has an explicit owner, and ownership transfers require an authenticated action. | Enforce the owner rule for portable devices outside the platform. | Withdrawn: incorporated | ||||
Protect the confidentiality of backup CUI at storage locations. | tiCrypt | Backups contain only ciphertext because no decryption keys are stored on the infrastructure. | None, provided by tiCrypt | Retained | ||||
Screen individuals prior to authorizing access to organizational systems containing CUI. | University | University control | Retained | |||||
Ensure that organizational systems containing CUI are protected during and after personnel actions such as terminations and transfers. | University | University control | Retained | |||||
Limit physical access to organizational systems, equipment, and the respective operating environments to authorized individuals. | University | University control | Retained: split | |||||
Protect and monitor the physical facility and support infrastructure for organizational systems. | University | University control | Retained | |||||
Escort visitors and monitor visitor activity. | University | University control | Withdrawn: incorporated | |||||
Maintain audit logs of physical access. | University | University control | Withdrawn: incorporated | |||||
Control and manage physical access devices. | University | University control | Withdrawn: incorporated | |||||
Enforce safeguarding measures for CUI at alternate work sites. | University | University control | Retained | |||||
Periodically assess the risk to organizational operations (including mission, functions, image, or reputation), organizational assets, and individuals, resulting from the operation of organizational systems and the associated processing, storage, or transmission of CUI. | University | University control | Retained | |||||
Scan for vulnerabilities in organizational systems and applications periodically and when new vulnerabilities affecting those systems and applications are identified. | Shared | Tera Insights scans tiCrypt's own components, issues advisories, and coordinates authenticated access for your scans. | Scan host operating systems, network infrastructure, and non-tiCrypt software in the CUI boundary, and remediate findings. | Retained | ||||
Remediate vulnerabilities in accordance with risk assessments. | tiCrypt | Tera Insights identifies, patches, and releases fixes for platform components on a regular cadence, with critical fixes released out of band. | Schedule and apply platform updates; remediate host-level findings. | Withdrawn: incorporated | ||||
Periodically assess the security controls in organizational systems to determine if the controls are effective in their application. | Shared | Tera Insights supplies SSP templates, assessment evidence packages, and direct support during C3PAO assessments. | Coordinate the C3PAO engagement, provide evidence for university controls, and make sure the assessment covers the full CUI boundary. | Retained | ||||
Develop and implement plans of action designed to correct deficiencies and reduce or eliminate vulnerabilities in organizational systems. | Shared | Tera Insights helps draft POA&M items for platform controls, provides templated workflows, and handles platform-side remediation. | Own and track the POA&M and report milestones to the C3PAO. | Retained | ||||
Monitor security controls on an ongoing basis to ensure the continued effectiveness of the controls. | tiCrypt | The audit system continuously records user actions and security events and raises real-time alerts, providing telemetry for ongoing monitoring. | Run your continuous-monitoring program using tiCrypt telemetry, including server health (CPU, memory, disk), which tiCrypt does not monitor. | Retained | ||||
Develop, document, and periodically update system security plans that describe system boundaries, system environments of operation, how security requirements are implemented, and the relationships with or connections to other systems. | University | University control | Withdrawn: incorporated | |||||
Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems. | tiCrypt | The backend is the single enforcement point. Only ports 22 and 443 accept inbound traffic, VMs run on isolated networks with deny-all outbound, and storage only ever receives ciphertext. | None, provided by tiCrypt | Retained | ||||
Employ architectural designs, software development techniques, and systems engineering principles that promote effective information security within organizational systems. | tiCrypt | Zero-knowledge design: client-side encryption, user-held keys, microservice isolation, and least privilege mean the server operates on data it cannot read. | None, provided by tiCrypt | Withdrawn: not CUI-specific | ||||
Separate user functionality from system management functionality. | tiCrypt | User work runs in Secure VMs, separate from the security layer and management services; administrators never see plaintext user data. | None, provided by tiCrypt | Withdrawn: incorporated | ||||
Prevent unauthorized and unintended information transfer via shared system resources. | tiCrypt | VMs reset to immutable images on every boot, and each service has its own database. SFTP into VMs is write-only, and transfers go through the audited Vault. | None, provided by tiCrypt | Retained | ||||
Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks. | tiCrypt | The public-facing frontend is separated from CUI processing in isolated VM networks, and ingress services sit in a DMZ-like zone with only a one-way path to the backend. | None, provided by tiCrypt | Withdrawn: incorporated | ||||
Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception). | tiCrypt | Inbound and outbound traffic is denied by default. Every outbound exception requires a firewall/allowlist rule created with SuperAdmin privilege. | Approve any outbound exceptions (e.g., license servers). | Retained | ||||
Prevent remote devices from simultaneously establishing non-remote connections with organizational systems and communicating via some other connection to resources in external networks (i.e., split tunneling). | tiCrypt | Remote devices reach the system only through the managed, authenticated tunnel; there is no direct external network path to VMs. | None, provided by tiCrypt | Withdrawn: incorporated | ||||
Implement cryptographic mechanisms to prevent unauthorized disclosure of CUI during transmission unless otherwise protected by alternative physical safeguards. | tiCrypt | Data in transit is double-encrypted (TLS 1.2+ plus Diffie-Hellman session keys) with FIPS-validated algorithms, and SHA-256 verifies integrity. | None, provided by tiCrypt | Retained | ||||
Terminate network connections associated with communications sessions at the end of the sessions or after a defined period of inactivity. | tiCrypt | Tunnels close at session end and idle sessions disconnect; client keys are purged on termination. | Set the idle-disconnect interval. | Retained | ||||
Establish and manage cryptographic keys for cryptography employed in organizational systems. | tiCrypt | Keys are generated client-side (AES-256 per file and drive, RSA-2048 per user) and never stored unwrapped on the server. Key recovery uses escrow split across at least three independent holders. | Define escrow groups (minimum three) and their membership. | Retained | ||||
Employ FIPS-validated cryptography when used to protect the confidentiality of CUI. | tiCrypt | All cryptography runs through the FIPS-validated OpenSSL 3.1.2 FIPS provider (CMVP #4985) in approved mode, no custom cryptography. FIPS mode is also enabled in secure VMs. | None, provided by tiCrypt | Retained | ||||
Prohibit remote activation of collaborative computing devices and provide indication of devices in use to users present at the device. | tiCrypt | Not applicable by design: collaborative computing devices (cameras, microphones) are not supported in the environment, so remote activation cannot occur. | None, provided by tiCrypt | Retained | ||||
Control and monitor the use of mobile code. | tiCrypt | The frontend bundles all its dependencies and references no external code; it runs in the controlled Connect app, and software is signed. VMs have no browser-based code paths to external networks. | None, provided by tiCrypt | Retained | ||||
Control and monitor the use of Voice over Internet Protocol (VoIP) technologies. | tiCrypt | Not applicable by design: VoIP is not supported; all communication uses authenticated, encrypted channels. | None, provided by tiCrypt | Withdrawn: aligned with 800-53 | ||||
Protect the authenticity of communications sessions. | tiCrypt | Sessions are authenticated by RSA challenge-response over mutually authenticated channels (TLS plus Diffie-Hellman), preventing hijacking and replay. | None, provided by tiCrypt | Retained | ||||
Protect the confidentiality of CUI at rest. | tiCrypt | CUI is AES-256 encrypted at rest: Vault files in 8 MB chunks with per-file keys, and VM drives with LUKS or BitLocker. Metadata such as file names is not encrypted at rest. | Protect the metadata database as part of the CUI boundary. | Withdrawn: incorporated | ||||
Identify, report, and correct system flaws in a timely manner. | tiCrypt | Tera Insights maintains the software lifecycle, identifies flaws, and releases signed updates; VM images are rebuilt with current patches. | Apply updates on your schedule. | Retained | ||||
Provide protection from malicious code at designated locations within organizational systems. | tiCrypt | Anti-virus scanning is integrated on data import and access. Immutable VM images reset on boot (removing persistent malware), and deny-all networking blocks command-and-control traffic. | Supply the anti-virus product and schedule scans. | Retained | ||||
Monitor system security alerts and advisories and take action in response. | tiCrypt | Real-time alerts at five severity levels cover authentication failures, access attempts, and anomalies, and Tera Insights relays relevant security advisories. | Act on advisories and alerts. | Retained | ||||
Update malicious code protection mechanisms when new releases are available. | tiCrypt | The controller server delivers the latest VM images and VM Controller at every boot, with current patches. | Keep anti-virus signatures current. | Withdrawn: incorporated | ||||
Perform periodic scans of organizational systems and real-time scans of files from external sources as files are downloaded, opened, or executed. | tiCrypt | Files are scanned on import and access, boot resets restore a known-good state each session, and chunk-level encryption blocks file injection. | Schedule periodic scans. | Withdrawn: incorporated | ||||
Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks. | tiCrypt | All VM traffic passes through the logged backend proxy; unauthorized attempts are blocked and recorded. The audit system provides alerting (e.g., impossible-travel logins, lockouts) and forensic queries. | Run the monitoring program and route alerts to your SOC/SIEM. | Retained | ||||
Identify unauthorized use of organizational systems. | tiCrypt | The audit system detects and alerts on unauthorized access, failed authentication, and privilege escalation. | Investigate alerts as part of your monitoring program. | Withdrawn: incorporated | ||||
This guide summarizes Tera Insights' published shared-responsibility model for tiCrypt. Each institution's System Security Plan defines its own boundary and implementation, and the final determination of compliance rests with the institution and its C3PAO. Release baseline (ticrypt.com/releases, October 21, 2026): Frontend 2.18.1 · Backend 3.15.0 · Host Controller 1.3.2 · Audit 1.10.1 · SFTP 1.5.1