Continuous compliance with the AIC kits

Analog Informatics Corporation (AIC) kits make continuous compliance possible. The kits receive constant feeds, generate alerts, mitigate issues, and constantly monitor system configuration compliance while the environment operates. That record is continuous. It is not a point-in-time check. A secure enclave is useful in many industries. The same kits run air-gapped, on a system that is not generally connected, and they run where a general network connection exists. See Secure enclaves and Air-gapped systems.

The kit keeps receiving feeds, raising alerts, mitigating issues, and checking configuration compliance. A point-in-time review is one mark on a line.

How does the AIC kit make continuous compliance possible?

The AIC kit receives constant feeds, generates alerts, mitigates issues, and constantly monitors system configuration compliance. Those actions run as the environment operates. The organization can stay in continuous compliance instead of relying on a point-in-time review. Current State Compliance and configuration compliance perform identity security posture management (ISPM). Audit and Incident Response perform identity threat detection and response (ITDR).

Who shares the Assessment Binder?

The Assessment Binder is the shared audit binder. It is a shared asset of the Cybersecurity Maturity Model Certification (CMMC) Third-Party Assessment Organization (C3PAO), the Managed Service Provider (MSP), and the customer. Each of them works from the same living record. The binder is built into the AIC Level 1, Level 2, and Level 3 kits.

How does continuous compliance relate to the False Claims Act and force majeure?

Analog Informatics believes continuous compliance provides a strong defense against False Claims Act claims, and that the same living record helps support a force majeure defense. A point-in-time snapshot does not give that record. This is not legal advice.

How does AIC make a cybersecurity program complete?

Through free training, automation, and integration. The kits put monitoring, alerts, mitigation, and the shared Assessment Binder in one offering.

Screenshots

Control State History table showing each control's previous state, observed state, and drift reason over the last 90 days, with a Run Sweep button. — Control state history records drift over time, the core of continuous compliance.

Current State Compliance page testing against CMMC Level 2 with 110 NIST SP 800-171 practices, and the list of controls for the operating package. — Measurement and Mitigation checks the environment against the selected framework and level.

Related References

CMMC: Kits, Level 1, Level 2, Level 3, Defense contractors, C3PAO
Defense contract requirements: SPRS score, DFARS 252.204-7012, DFARS 252.204-7021, NIST SP 800-171 self-assessment, CUI marking, CMMC Phase 2

See it on your use case

Request a demo