FedRAMP & CUI

    FedRAMP & CUI handling, in one place

    Regulated communications and evidence stay inside the authorized secure boundary. Athena Fortify-CMMC runs the assessment workflow on approved metadata, opaque references, responsibilities, status, and sanitized conclusions. Everything below is a surface that either enforces that separation or explains it.

    Operate the boundary

    Configure and monitor the separation between the authorized secure boundary (AWS Wickr) and Athena's SaaS. Regulated content never enters Athena; Athena carries sanitized metadata, references, status, and conclusions.

    CUI

    FedRAMP / CUI Handling

    Engagement profile, labelled capability register, secure-handoff ledger, and the decision log for every boundary refusal.

    Open

    CUI Boundary Overview

    The public capability statement: what stays inside the regulated boundary, what Athena is allowed to receive, and how that is enforced.

    Open
    E2EE

    End-to-End Encryption

    Per-user vault keys, browser-side encryption for regulated notes and evidence, and customer-managed key options.

    Open

    Scope and mark regulated data

    Decide what is actually in scope before you spend money assessing it, then label it so handling rules survive an assessor challenge.

    CUI Scoping Guide

    The four asset categories, the enclave strategy, boundary mistakes that fail assessments, and how to document scope for a C3PAO.

    Open

    CUI Marking Guide

    Banner and portion markings, limited-dissemination controls, and the handling rules that follow the label.

    Open

    ITAR vs CUI

    Where export-controlled data changes the handling story, and why ITAR content is refused at the upload boundary.

    Open

    Understand the authorization position

    Athena's SaaS is not FedRAMP authorized, and no component's authorization transfers to Athena. These pages state the position precisely so proposals and assessors get the same answer.

    FedRAMP vs CMMC

    How the two programs differ, where they overlap, and which one your contract actually requires.

    Open

    Shared-responsibility statement

    The permanent scope disclosure: authorized components, Athena's sanitized role, and the customer-retained obligations.

    Open

    Ask about a regulated engagement

    Send the offering, region, and data types you need covered and get the screened answer in writing.

    Open