Security & Web Requirements

1. Zero-Retention AI Governance & Model Privacy

CyberPosture RAMP operates under a strict Zero-Data-Retention principle for artificial intelligence evaluation. When our VALORA AI engine evaluates your model manifests, autonomous agents, and prompts against NIST AI RMF or ISO 42001:

• No Model Training: Customer prompts, controls, and configuration data are never utilized to train, fine-tune, or calibrate public or proprietary AI models.
• Ephemeral In-Memory Scanning: Control validation routines process manifests in transient memory and immediately dispose of raw payload buffers upon workpaper generation.
• Air-Gapped Assessment Options: Enterprise tenants may run RAMP assessment runners within their own isolated VPC perimeter.

2. Data Encryption & Cryptographic Integrity

All data transit and evidence storage enforce modern cryptographic standards:

• In Transit: Transport Layer Security (TLS 1.3) with strict HSTS, PFS (Perfect Forward Secrecy), and modern cipher suites.
• At Rest: AES-256 encryption with client-managed or dedicated KMS key hierarchies.
• Workpaper Hashing: Every generated audit evidence workpaper bundle is stamped with an immutable SHA-256 checksum to guarantee non-repudiation for audit firms.

3. Web Application & Browser Requirements

To guarantee optimal security and seamless console rendering, CyberPosture platforms mandate the following client standards:

• Browser Support: Current versions of Google Chrome, Mozilla Firefox, Apple Safari, and Microsoft Edge (Chromium).
• Authentication & SSO: SAML 2.0 and OIDC (OpenID Connect) supporting enterprise identity providers including Okta, Microsoft Entra ID, and Google Workspace with mandatory Multi-Factor Authentication (MFA).
• Role-Based Access Control (RBAC): Granular permissions restricting audit bundle generation to authorized Compliance Officers, CISO deputies, and designated review teams.

4. Continuous Compliance Monitoring (CCM) & Audit Firm Interoperability

RAMP produces standardized, structured file packages (including XLSX control cross-walks, JSON metadata ledgers, and signed PDF narrative files). These packages are deliberately formatted to ensure effortless ingestion into Continuous Compliance Monitoring (CCM) platforms and direct review by independent audit firms without requiring proprietary connector lock-in.

5. Vulnerability Disclosure & Security Contact

We welcome responsible security research. If you believe you have discovered a vulnerability in any CyberPosture web endpoint or application interface, please report it immediately to our security operations desk at security@thecyberposture.com. We acknowledge receipt within 24 hours.