A zero trust product, built zero trust.
ZTASphere holds the evidence of your security posture, so it is engineered to the NIST SP 800-53 Rev. 5 Moderate baseline and documented for a FedRAMP Moderate assessment.
Where we are on FedRAMP Moderate.
We state our status plainly. ZTASphere is not yet FedRAMP authorized.
- Complete
Readiness package
System Security Plan for the Moderate baseline, readiness self-assessment, POA&M, policies and plans.
- Complete
Production hardening
Dedicated AWS environment with WAF, encrypted database, private networking and session-managed administration.
- Next
Independent assessment
Third-party (3PAO) assessment and penetration test, then a GovCloud deployment for agency use.
- Then
Agency authorization
Sponsoring-agency ATO and FedRAMP Moderate authorization.
What protects your evidence.
| Family | Control | How ZTASphere does it |
|---|---|---|
| IA | Strong authentication | MFA required in production; PBKDF2 password hashing; opaque session tokens; the app refuses to start with unsafe settings. |
| AC | Least privilege | 17 roles with separation of duties, just-in-time elevation, and review of evidence by someone other than its submitter. |
| AU | Tamper-evident audit | Every action is written to a hash-chained log that auditors can verify in one click. |
| SC | Encryption in transit | TLS at the edge; post-quantum hybrid TLS policy on the origin load balancer; mutual TLS between internal services in container deployments. |
| SC | Encryption at rest | Encrypted managed database and backups; key rotation built into the application. |
| SC | Boundary protection | CloudFront and AWS WAF in front of a private origin; egress proxy with a domain allowlist for outbound integration traffic. |
| SI | Integrity | SHA-256 on every evidence file at upload and download; malware scanning of uploads. |
| SR | Supply chain | CycloneDX 1.6 and SPDX 2.3 SBOMs for every release, signed container images, dependency audits. |
| RA / CA | Testing | Static analysis, container and infrastructure scanning, and OWASP ZAP dynamic scans in CI. |
| SC-12 / SC-13 | Post-quantum readiness | Cryptographic inventory of every algorithm in use; symmetric primitives (AES-256-GCM, HMAC-SHA-256, SHA-256) at rest and in tokens; hybrid ML-KEM TLS preferred where supported; key id and version on every ciphertext for crypto agility. Details |
| SC-13 | Cryptographic modules | Build option for a FIPS 140 OpenSSL provider; validation in CI is an open POA&M item. |
Aligned to the frameworks your program answers to.
Read-only by design
ZTASphere never needs write access to your security tools. It observes and scores; your teams make the changes.
Your boundary, your choice
Run it as a managed service or inside your own cloud account, data center or air-gapped enclave.
Assessor-ready documentation
SSP, SBOM, policies and plans are available to qualified prospects under NDA during evaluation.
Need the security package?
Request a demo and tell us what your security review needs. We share the SSP, SBOM and readiness assessment under NDA.