Trust Center
Compliance posture
The Winston & Miller platform is built to NIST SP 800-53 Rev 5 Moderate control standards and SOC 2 Type II control standards; in the evidence-collection phase; no certification is claimed.
Honest compliance language
Our policy: We describe our control design and evidence posture accurately. “In the evidence-collection phase” means controls are designed and implemented; third-party audit evidence is being gathered. No compliance certification or authorization is awarded until a qualified assessor issues a formal opinion. We will not claim any certification we do not hold.
Control standards
NIST SP 800-53 Rev 5
Baseline: Moderate
Control design complete; evidence-collection in progress
Controls are implemented against the Moderate baseline. The control selection, implementation, and initial testing are complete. Third-party assessor evidence collection is in progress. No Authorization to Operate (ATO) is claimed.
SOC 2 Type II
Baseline: Trust Services Criteria (Security)
Control design complete; evidence-collection in progress
Controls are implemented against the SOC 2 Security Trust Service Criteria. The observation period has begun. No SOC 2 Type II report has been issued by a qualified auditor.
FedRAMP
Baseline: Moderate (readiness design)
Designed with FedRAMP readiness in mind
The platform architecture and control selection account for FedRAMP Moderate requirements. No FedRAMP authorization has been granted. The platform is not listed on the FedRAMP Marketplace.
Security practices in place
- Encryption in transit (TLS 1.3, minimum TLS 1.2) and at rest (AES-256)
- Access control based on least privilege and role-based permissions
- Multi-factor authentication required for all privileged access
- Security event logging with immutable, tamper-evident audit records
- Vulnerability management program with tracked remediation
- Documented incident response plan tested annually
- Annual security awareness training for all personnel with system access
- Background screening for personnel with privileged access
Related trust resources