tiCrypt
Compliance
Administrator
Compliance is the set of pages that connect what tiCrypt does to what an assessor asks. It enables you to scope a deployment, show which requirement each capability meets, and produce the evidence behind it. These pages describe tiCrypt's side of a shared responsibility. Your System Security Plan defines your own boundary and implementation, and your assessor makes the final determination.
Compliance contains the following functionality
- Scoping Guide: every component of a deployment, the CMMC asset category it falls in, and a network diagram for your SSP.
- Cryptographic Modules: each cryptographic operation, the validated module that performs it, and its certificate.
- Assessment Evidence: for each CMMC practice, the query, screen, or configuration line to show an assessor.
- Incident Response: what tiCrypt provides for a DFARS 252.204-7012 report, and what your organization adds.
- Rev 3 Readiness: where a deployment stands against NIST SP 800-171 Revision 3 with the Department of Defense's parameter values.
- External Service Provider: Tera Insights' role in your assessment, and what to write about it in your SSP.
Control guides and plans
The pages above refer to these throughout.
- CMMC Level 2 control guide: the 110 practices, with who implements each one and what your organization still does.
- NIST SP 800-171 Rev 3 control guide: every Revision 3 requirement, mapped from the CMMC practices.
- System Security Plan: control-by-control implementation statements you can adapt.
- Security Whitepaper: the encryption architecture and key management in full.