Standards, controls,
and evidence.
Your requirements should shape the software from the start.
Explore the standards your system needs, the controls they call for, and the evidence to check.
See our security results and compare your software Requirements belong
in the software.
We turn your requirements into controls, tests, and evidence for the information your system handles and the people using it.
We build on Azure Government for FedRAMP High requirements, enforce application controls, and tie test evidence to releases.
Government cloud and contractsChoose the cloud, control baseline, and assessment required by the contract.
| Standard or requirement | Where it applies | What to verify |
|---|---|---|
| FedRAMP High | Federal cloud services and their authorization boundary. | We build for FedRAMP High requirements in Azure Government. Verify the offering, in-scope services, and application controls covered by the agency’s authorization. |
| GovRAMP / StateRAMP | State and local cloud procurement. | Verify the product’s status, impact level, monitoring evidence, and service boundary against the procurement requirements. |
| TX-RAMP | Cloud services within Texas’s program scope. | Verify the purchased application’s certification or recognized equivalent, required level, assessment, and monitoring. |
| Arizona cloud requirements | Arizona’s transition from AZRAMP to GovRAMP. | Check current state requirements, the product’s authorization, and its covered service boundary. |
| CMMC | Defense contracts handling FCI or CUI. | Verify the contract’s required level, information scope, assessment, affirmation, and NIST revision. |
| NIST SP 800-53 | Security and privacy controls for a defined system. | Check each selected control’s implementation, owner, and test evidence. See our application controls and service inventory. |
Application security and secure deliveryTurn broad security promises into requirements that can be tested.
| Standard or requirement | Where it applies | What to verify |
|---|---|---|
| OWASP ASVS 5.0 | Testable web application security requirements. | Check results against versioned requirements for the agreed verification level. Inspect our conversation isolation, request validation, and browser protections. |
| NIST SSDF 1.1 / SP 800-218 | Secure software preparation, protection, production, and vulnerability response. | Review development practices, dependency handling, vulnerability response, and tested release checks. |
| CIS Controls v8.1 | Prioritized safeguards for systems and operations. | Check the implementation group, inventory, access, configuration, vulnerability management, logging, and recovery. See our support and backup practices. |
| NIST CSF 2.0 | Govern, Identify, Protect, Detect, Respond, and Recover. | Compare the system’s risk profile and control owners with its architecture, incident handling, and recovery evidence. |
Accessible public servicesEvaluate the workflows, documents, and interfaces people actually use.
| Standard or requirement | Where it applies | What to verify |
|---|---|---|
| WCAG 2.2 | Our AA target, with AAA criteria where possible. | Review all-page axe, IBM Equal Access, and browser results, plus keyboard and assistive technology testing. Automated checks cover only the criteria tested. |
| Section 508 | Federal ICT, including covered web and non-web content. | Check the product’s conformance report against Revised 508 Standards, WCAG 2.0 AA, and applicable document and other ICT requirements. |
| ADA Title II | State and local government web content and mobile apps. | Check applicable WCAG 2.1 AA requirements. Our WCAG 2.2 target adds newer criteria. Compare accessibility requirements. |
| EN 301 549 | ICT accessibility requirements used in European procurement. | Check the required edition and applicable ICT clauses in the product’s Accessibility Conformance Report, including test methods and limitations. |
Sensitive and regulated government dataThe data determines the safeguards, service boundary, and approval work.
| Standard or requirement | Where it applies | What to verify |
|---|---|---|
| NIST SP 800-171 | Controlled Unclassified Information in nonfederal systems. | Check the contract-required revision, system security plan, implemented controls, assessment, and outstanding actions. |
| CJIS Security Policy | Criminal Justice Information and the people and services handling it. | Verify FBI and state authority requirements, approved operating scope, personnel, access, encryption, audit, and incident response. |
| IRS Publication 1075 | Federal Tax Information received by agencies and covered contractors. | Trace FTI through access, cloud services, encryption, audit, and reporting. These safeguards differ from direct IRS filing integration. |
Verify the assessment, too.
SOC 2 reports and ISO/IEC 27001 certificates provide independent assurance for a defined scope. Check the product or organization, covered services, assessment period, issuer, and exceptions.
Our public test results are on the Trust page. Required authorizations and independent assessments belong in the project’s delivery plan.
Plan your system’s security review