Public sector
Government cloud controls, evidenced and sovereign.
Public sector teams answer to security control profiles, assessors and the public. ACSE checks your cloud against those profiles, fixes what fails through code your team reviews, and keeps the evidence of every change in your own account, under your jurisdiction.
Assessment evidence as you go
Controls are evaluated on every scan and each fix is sealed, so assessments start from a record.
Sovereignty without trade-offs
Your runtime, credentials and evidence stay in your account. ACSE’s control plane holds no identifiers.
Nothing changes without a person
Every fix is approved with step-up MFA, and ACSE never writes to your cloud.
Control profiles
Mapped to the profiles you are assessed against
Each ships as a signed, versioned pack on the same checks. ACSE maps your posture to them; it does not grant an authorization.
- Canadian federal
- CCCS Medium
- Control catalogue
- NIST 800-53 Rev 5
- US federal cloud baseline
- FedRAMP Moderate
- Hardening
- CIS benchmarks
- Department standards
- Custom frameworks, published by two people
Sovereignty
Your evidence, in your jurisdiction
The record of every decision and fix is written to append-only storage in your own account. Even ACSE can’t rewrite it.
The control plane region is chosen per deployment, and moving it is a recorded request a second admin must approve.
Least privilege
Read-only, and no keys to leak
ACSE reaches your cloud through a federated, short-lived identity with read-only permissions. There is no long-lived access key to store, rotate or lose.
Your team runs the setup ACSE generates, so you see every permission before you grant it.
For assessors
What an assessor can check alone
Offline verification
Exported cases verify on an air-gapped machine, with no ACSE account.
Two verifiers agree
Independent Python and TypeScript verifiers must reach the same verdict.
Read-only auditor role
Assessors can see reports, exports and the people list, and change nothing.
Questions
What people ask us
Is ACSE FedRAMP authorized or CCCS assessed?
No. ACSE maps your cloud posture to those profiles and produces evidence for your own assessment. It does not hold an authorization itself.
Can we run ACSE without an external AI service?
Yes. AI is off by default and optional. If you turn it on, it runs on the model service in your own account.
Who can approve a fix?
Only the Security Approver role, with step-up MFA, and never the change’s author.
Keep reading
Related
CCCS Medium
ACSE maps cloud checks to the ITSG-33 technical controls of the CCCS Medium cloud profile it tracks, with evidence held in your own cloud.
ReadFrameworksFedRAMP Moderate
ACSE maps cloud checks to the technical controls of the FedRAMP Moderate baseline, based on NIST SP 800-53 Rev. 5, and keeps signed evidence of every fix.
ReadSolutionsData residency
ACSE runs its runtime and evidence store in your own account. Only shapes and counts reach its control plane, and changing region takes two admins.
ReadTalk to us
See ACSE on your cloud.
Tell us what you run and what your auditors ask for. We’ll show you the loop end to end: a real finding, a fix as code, an approval with MFA and the sealed record.