Compliance alignment
Vardhold helps you govern AI agents inside the control frameworks you already answer to. This page shows which controls it produces evidence or enforcement for.
Vardhold is not certified or accredited under any framework. These mappings describe the support it is designed to provide; your assessor decides how it counts toward a control.
NIST SP 800-53 Rev. 5#
| Control | How Vardhold helps |
|---|---|
| AU-2, AU-3, AU-12 Event logging and content | Every agent action recorded with agent, process, target, rule and verdict |
| AU-9 Protection of audit information | Keyed HMAC-SHA256 audit chain over events, approvals, alerts and policy history; key encrypted with DPAPI; data folder limited to SYSTEM and Administrators; chain head anchored in the SIEM |
| AU-6 Audit review, AU-11 Retention | Live timeline, alerts, SIEM export, configurable retention |
| AC-3 Access enforcement, AC-6 Least privilege | The policy decides what each agent may read, write, run and call |
| CM-3 Configuration change control | Policy changes reviewed with a diff and a dry run, applied only with administrator confirmation, versioned and sealed |
| CM-7 Least functionality | Block or require approval for high-risk commands and MCP tools |
| SC-13 Cryptographic protection | All cryptography performed by Windows CNG, DPAPI and SChannel, using approved algorithms only |
| SI-4 System monitoring | Discovery and attribution of agent processes and MCP servers; real-time file, network and process telemetry for agent processes |
| IR-4 Incident handling | Kill switch; suspend, end or firewall an individual agent; exportable evidence |
AI and software supply chain#
| Framework | Area | How Vardhold helps |
|---|---|---|
| OWASP Top 10 for LLM Applications | LLM06 Excessive Agency | Human approval and least privilege for agent actions |
| NIST AI RMF 1.0 | Govern, Manage | A central, versioned policy for AI agent behaviour, with an audit trail |
| EO 14028, NTIA SBOM minimum elements | Software supply chain transparency | A CycloneDX SBOM with every release, meeting the NTIA minimum elements |
| DoD Zero Trust Reference Architecture | Visibility and Analytics; Automation and Orchestration | Per-action decisions on endpoint agents, streamed to the SIEM |
Evidence for your package#
- Requirements and spec sheet: printable system description.
- Hardening checklist: STIG-style configuration checks.
- Cryptography and FIPS: every cryptographic function and the module performing it.
- The CycloneDX SBOM shipped with each release.
Pilot customers can request the full hardening guide, with check and fix text for every item, from [email protected].