Compliance

What we claim, what we are pursuing, and what we do not claim

Compliance statements are easy to make and hard to back up. This page says precisely where Direwolf stands, and it changes when our status changes.

Our posture

Aligned to NIST SP 800-171: We have mapped NIST SP 800-171 (Revision 2, as used by CMMC Level 2) to the Direwolf Platform and to our company practices, and we are building the system security plan, control matrix with evidence, and plan of action and milestones that an assessment requires. "Aligned" means we implement the requirements as we understand them and keep evidence of it. It is not a third-party certification.
Pursuing CMMC Level 2: Direwolf is preparing for a CMMC Level 2 assessment. In July 2026 the Department of War suspended the requirement for third-party (C3PAO) Level 2 assessments while it reviews the CMMC program; self-assessment requirements remain in force. We will update this page when our status changes. Until an assessment is complete and recorded, we do not describe Direwolf as CMMC certified.
Built for AWS GovCloud (US): The Direwolf Platform is built to run in AWS GovCloud (US) and is not yet in service. AWS states that AWS GovCloud (US) is FedRAMP Certified at Class D (formerly the FedRAMP High baseline), so when the Platform is in service, the infrastructure beneath it carries that certification. Direwolf itself is not FedRAMP certified or authorized. FedRAMP certification applies to the AWS infrastructure we build on, not to the Direwolf Platform.
Designed for FIPS 140-validated TLS and key management: When the Platform is in service, data in transit will be protected with TLS 1.2 or higher, terminated with a FIPS 140-validated cryptographic module (AWS-LC, CMVP certificate #4631), and data at rest (databases, object storage, queues, secrets and logs) will be encrypted with customer-managed keys held in AWS KMS hardware security modules validated to FIPS 140-3 Level 3 (CMVP certificate #4884), with automatic key rotation. We make no FIPS claim about any other component.

Shared responsibility

When you use Direwolf, three parties share the security of the service. AWS is responsible for the physical and virtual infrastructure of GovCloud and for the FIPS-validated cryptographic modules we rely on. Direwolf is responsible for everything inside the platform boundary: tenant isolation, identity and multi-factor authentication, session controls, audit logging, configuration and vulnerability management, encryption configuration, incident handling for the platform, and the guardrails around the AI SOC. You remain responsible for your own people and endpoints: who gets an account and which role, removing leavers promptly, protecting MFA devices, installing sensors only on endpoints you own, reviewing your organization’s audit log, acting on notifications, and the organizational policies that no technology provides. Our customer responsibility matrix, which we are completing as controls are implemented, will spell this out requirement by requirement.

Ask about the customer responsibility matrix

A note on controlled unclassified information (CUI)

At launch, the Direwolf Platform handles security protection data: alerts, sensor inventory, triage notes, and your users’ accounts. It is not designed to store, process, or transmit CUI, and customers should not place CUI in alert notes, settings, or support messages. A cloud service that stores, processes, or transmits CUI is subject to additional federal authorization requirements that do not apply to the security protection data we handle today. A CUI document repository is on our roadmap and would be subject to those requirements before release.

Company facts

Ownership: Service-Disabled Veteran-Owned Small Business (SDVOSB), SBA certified. Certified by the U.S. Small Business Administration through its Veteran Small Business Certification (VetCert) program.
Legal name and headquarters: Direwolf Cybersecurity, headquartered in Colorado Springs, Colorado.
Equal opportunity employer: Direwolf Cybersecurity is an equal opportunity employer. Read our EEO statement.

What we do not claim

Direwolf is not FedRAMP authorized. Our infrastructure provider’s authorization is not ours.
Direwolf is not yet CMMC certified.
We do not hold SOC 2 or ISO/IEC 27001 attestations.
Our compliance guidance is not legal advice and does not replace an assessment of your own organization by an authorized assessor.

Last reviewed October 24, 2026. Every statement on this site is checked against our internal claims register before it is published.