CMMC Level 2
Department of War (DoW) contractor compliance: requirements identical to NIST SP 800-171 Rev 2 (110 practices; 3 program requirements tracked separately).
Trust · Scope · Evidence
Trust starts with a clear account of what we do.
Designed for commercial and DIB teams. Review our boundaries, deployment options and the role of human judgment before choosing your compliance workspace.
Frameworks supported
9 of the most-requested frameworks are highlighted below; every catalog framework can be attached to a system at onboarding. Framework support does not confer authorization or certification.
SOC 2
Trust services criteria for SaaS and customer-facing platforms.
HIPAA Security Rule
Healthcare PHI safeguards, breach timers, OCR audit prep.
ISO 27001:2022
International ISMS standard with Annex A control set.
FedRAMP Moderate
323-control NIST SP 800-53 Rev 5 baseline; FedRAMP 2026 rules use Certification Classes A–D.
PCI DSS v4.0.1
Cardholder data environment safeguards for finance and retail.
NIST 800-53 Rev 5
Federal control catalog underpinning RMF authorization.
NIST CSF 2.0
Cybersecurity Framework: Govern, Identify, Protect, Detect, Respond, Recover.
CISA BOD 26-04
TRACE Score uses inputs that correspond to the directive's four decision signals.
Plus 591 more, including CMMC L1 / L3, FedRAMP Low / High, DFARS, ITAR, GLBA, NY DFS, NIS2, DORA, GDPR, SOX ITGC, CIS Controls v8.1, COBIT 2019, OWASP Top 10, NIST AI RMF, ISO/IEC 42001, EU AI Act, 87 AI & emerging-tech frameworks and 14 quantum / PQC standards.
Compliance support, with explicit boundaries
FedRAMP
Support for the 323-control NIST SP 800-53 Rev 5 baseline (Rev5; FedRAMP 2026 rules use Certification Classes A–D); framework support does not confer authorization.
We are not FedRAMP authorized. We help customers with their FedRAMP compliance work.
Advisedly is NOT FedRAMP authorized; using the platform does not confer an authorization.
SOC 2
Framework catalog also includes PCI DSS v4.0.1; coverage varies by control.
We are not SOC 2 certified. We support customers’ SOC 2 readiness.
Readiness support is distinct from an independent examination and report.
Federal authorization
eMASS remains the system of record, and the Authorizing Official decision stays human. Registration identifiers are not authorization badges.
Mapped by logic. Automated by AI. Decided by people.
Connectors automate collection; AI assists analysis, drafting and triage. SSP narrative publication requires human review. Review requirements for other workflows depend on their configured controls.
Reviewable provenance
Traceability uses the in-platform ai_provenance audit record and, when successfully persisted, a signed enforcement receipt. Review receipt availability and chain verification for the workflow. It is not an invisible text watermark in the generated characters.
Copy-paste or rewrite of the generated text does not carry the provenance trail. Open-source watermark removers defeat that class of mark. Auditors verify against the in-platform receipt and audit record.
Recorded provenance and prompt versions help reviewers inspect the context of governed AI outputs. They do not guarantee identical regeneration. Review the evidence available for the specific workflow.
Control lookup
500+ frameworks in the catalog. Cross-framework control lookup uses curated crosswalk records and deterministic rules where data exists. Coverage varies by framework and control.
Document Intake
Classifies uploaded documents, extracts structured fields and generates summaries. AI-assisted document associations are separate from cross-framework edges and should be reviewed.
Open Document Intake (sign-in required)Deployment follows your requirements
Availability, data flows and AI processing depend on the selected profile, customer configuration and provider policy. Assess the complete configuration against your boundary requirements.
Tier C — SaaS
Commercial cloud hosting. This is not an offer of an authorized federal cloud environment. Discuss data classification and hosting requirements before selecting this profile.
Tier B — Connected On-Premises
Customer-controlled, single-tenant infrastructure with operator-controlled egress for signed updates. Integrations and AI connections require configuration and policy review.
Tier A — Disconnected
Customer-controlled, single-tenant air-gap or closed-network infrastructure. Signed offline bundles are imported manually through the customer’s approved transfer process. Customer-hosted AI depends on the applicable profile and policy.
The read-only eMASS mirror is on-premises / air-gap only, subject to required DoD-network reachability. The customer holds the certificates. It is unavailable in SaaS.
Known regional recovery gap
Our documented recovery posture includes same-region point-in-time restore. Regional disaster recovery remains a known gap; same-region recovery does not cover a regional outage.
A same-region restore drill ran on 2026-11-08; teardown did not complete, so it is not yet a qualified drill. We publish no measured recovery timings here. Ask the trust team for current recovery evidence and discuss whether this limitation fits your requirements.
Ask for evidence that fits your review
Discuss deployment documentation, specific AI workflow provenance and recovery limitations with our team. Keep your scanners of record and kernel EDR; evaluate integrations and bounded workflow coverage individually.