The Federal Moat

Aiudit renders NIST OSCAL 1.1.2 JSON documents directly from live control, assessment, and evidence data. Each document is canonicalised, SHA-384 hashed, and Ed25519-signed at serialization time; a CNSA 2.0 ML-DSA signature is layered when the org enables it. Supported baselines: FedRAMP Low / Moderate / High, DoD IL2–IL6, StateRAMP Moderate / High, ISO/IEC 42001, and NIST AI RMF. Bundles land in eMASS, Xacta, and Telos Xacta 360 without transformation.

Every governed agent produces a CycloneDX 1.6 AIBOM enumerating models, versions, providers, licenses, and data sources — dovetailed with a classical SBOM of software dependencies and a VEX statement for known CVEs. The three artifacts share a serial number so Dependency-Track, GUAC, and Iron Bank pipelines can correlate them.

PIV / CAC smart cards terminate at a reverse proxy that sets client-cert headers and an mTLS shared secret; any request lacking the shared secret is rejected before the cert headers are trusted. WebAuthn (Yubikey, TouchID) serves as the smart-card fallback and step-up channel. SAML and OIDC broker federation (DoD SSO, Login.gov, ADFS) is available for tenants that cannot deploy cert-based auth. OCSP / offline CRL revocation is checked per session; in air-gapped mode a signed offline CRL bundle replaces OCSP.

Strict-FIPS mode restricts algorithms to the SP 800-131A Rev. 2 approved set (SHA-384, ECDSA-P384). CNSA 2.0 dual-signature layers an ML-DSA (Dilithium3, FIPS 204) signature on top of the classical Ed25519 / ECDSA-P384 signature, so evidence packages, ledger anchors, and OSCAL bundles survive the transition to post-quantum without a re-issue.

A single deployment_config.mode switch (SaaS / sovereign / air-gapped) drives every outbound decision. Air-gapped mode disables all outbound egress via the withEgress guard, re-routes anchoring to a local HSM ledger, and swaps OCSP for offline CRL bundles. Attempted egress is logged as a CDM BOUND-E event for compliance review.

Aiudit emits structured events aligned to the CDM capability model (HWAM, SWAM, CSM, VUL, TRUST, BEHAVE, CRED, PRIV, BOUND-F/E, MNGEVT). Events deliver via the existing external-endpoint pipeline to agency SIEMs and the Federal Dashboard, in an OCSF-shaped envelope familiar to SOC analysts.

Every tenant can compile a procurement kit — NAICS / PSC codes, SAM UEI, CAGE, past performance, and a capability statement — hashed and signed so solicitations reference the exact packet Aiudit submitted. GSA MAS, SEWP VI, CIO-SP4, and StateRAMP surfaces are pre-templated.