Regulated communications and evidence stay inside the authorized secure boundary. Athena Fortify-CMMC runs the assessment workflow on approved metadata, opaque references, responsibilities, status, and sanitized conclusions. Everything below is a surface that either enforces that separation or explains it.
Six questions that separate a CMMC Level 2 lane from one that carries FedRAMP dependencies. Nothing is stored — this is a scoping aid, not a determination of record.
Do you offer a cloud service (SaaS, PaaS, or IaaS) directly to a federal agency, where the agency is the end user?
This is about your own product being consumed by the government — not about cloud tools you buy.
Does any solicitation, contract, or prime flow-down you are pursuing name FedRAMP as a requirement?
Look for "FedRAMP Moderate", "FedRAMP authorized", or an agency ATO obligation.
Will CUI be stored, processed, or transmitted in a cloud service operated on your behalf by an external provider?
Includes M365, Google Workspace, file sharing, ticketing, MSP-hosted infrastructure, and collaboration tools.
Does any in-scope data carry export-control obligations (ITAR or EAR) or a U.S.-person access restriction?
Technical data packages, drawings, and munitions-list items typically qualify.
Does any customer require FedRAMP High, DoD Impact Level 4, or Impact Level 5 accommodation?
Usually stated by the agency or prime, not inferred from data type alone.
Regulated content never leaves the customer-controlled AWS boundary on the left. Only sanitized references, mapping, status, and approved conclusions pass the gate into Athena on the right.
How can Athena provide a FedRAMP solution?
It does not, and never claims to. No. Athena does not represent Fortify-CMMC as FedRAMP authorized. Athena has intentionally architected CUI and regulated evidence out of its SaaS. For regulated engagements, AWS Wickr is used as the authorized secure-collaboration component only after the applicable offering, region, authorization scope, configuration, and supporting AWS services have been validated. CUI and regulated evidence remain within the approved Wickr and customer-controlled retention environment. Athena manages the CMMC workflow through approved metadata, external references, responsibilities, status, and sanitized conclusions.
Is this defensible in an assessment?
The C3PAO makes that determination, not Athena. What the arrangement gives an assessor is a narrow, evidenced boundary: regulated content stays in the customer-controlled environment, every release into the SaaS is classified server-side and human-approved, and each refusal and approval is written to an append-only log. The six tests below are what an assessor typically probes, and where the supporting record lives.
Secure collaboration
AWS Wickr (offering recorded per engagement)
Region recorded per engagement
Controlled retention repository
Separately configured customer component
Stays here, always
2 · Sanitization gate
Server-side, fail-closed. Blocked entries are refused and logged.
Human certifier plus a second approver on every release.
Receives only
And does this with it
What an assessor tests — and where the record lives
Is the system boundary drawn and documented?
Boundary profile, this architecture view, and the SSP boundary section
Is the authorization scope of the collaboration component evidenced?
Offering + region + services-in-scope determination, with source reference and validator
Can you show regulated content never entered the SaaS?
Server-side classification gate, fail-closed refusals, and the append-only audit log
Is each release into the SaaS sanitized and human-approved?
Sanitization review records with certifier and second approver
Are the retention repository and its supporting AWS services determined?
Retention stack determinations with evidence reference and accountable owner
Is the arrangement kept current, not just set up once?
Periodic revalidation cadences, annual re-attestation, and currency score
Test 2 is not yet satisfied for this engagement: the authorization scope of the recorded offering and region has not been verified against the applicable AWS services-in-scope listing. Until that determination is on record, no authorization is represented here.
This document describes Athena's use of AWS Wickr as a FedRAMP-authorized component. It does not represent Athena's SaaS or Athena Consulting Group as independently FedRAMP authorized.
The same five steps every piece of regulated evidence follows. Steps 2 and 3 happen entirely inside the customer boundary; only step 4’s approved output is visible to Athena.
Request raised
Athena creates an evidence request with the practice, objective, owner, and due date. No content yet.
Delivered in the secure room
The customer submits the artifact inside the approved collaboration room. The file never touches Athena.
Retained in the repository
The record lands in the controlled retention repository under customer keys, logging, and schedules.
Sanitized and certified
A reviewer records the opaque reference, hash, and a sanitized summary. A second person approves it.
Athena reasons on the reference
Only that approved record enters Athena, where it drives scoring, findings, POA&Ms, and deliverables.
One artifact, six stages. Select a stage to see exactly what changes about the data, which NIST SP 800-171 families apply there, and which records an assessor can pull as proof. Export the whole map — every stage plus the control mapping — as a print-friendly document or PDF for your audit package.
The contractor produces or exports the source artifact (config export, log extract, screenshot, policy) and applies its own marking. No Athena component participates.
Data in
Nothing yet — the artifact originates on contractor-controlled systems.
Data out
Original artifact with full CUI/FCI content, marked at the owner’s classification.
Controls that apply here
Artifacts produced
Never present at this stage
This document describes Athena's use of AWS Wickr as a FedRAMP-authorized component. It does not represent Athena's SaaS or Athena Consulting Group as independently FedRAMP authorized.
Filter by control family, then jump to the exact stage of the flow above that carries it. Families with no stage touchpoint are satisfied at the layer level only.
3.1 Access Control
3.3 Audit and Accountability
3.4 Configuration Management
3.5 Identification and Authentication
3.6 Incident Response
3.8 Media Protection
3.9 Personnel Security
3.12 Security Assessment
3.13 System and Communications Protection
Hosting and Data Residency
Allocated in the layer matrix below; no single stage of the artifact flow exercises it.
10 of 10 families shown · 6 stages in the flow
Three zones, ten systems, one crossing. Select a numbered handoff to see exactly what moves, what is refused, and which side owns the data at that moment.
People
Humans who act on the system. No system-to-system trust.
Control owner
Uploads regulated evidence
Security officer
Approves policy, region, readiness
C3PAO assessor
Receives the audit bundle
Customer regulated boundary
Customer-owned AWS. CUI is created, stored, and retained here — and stays here.
AWS Wickr Premium
E2EE rooms, messages, files
Retention stack
S3 + customer-managed KMS + CloudTrail
Single sanitization gate
GateDeny-by-default, two-person certification
No return path CUI messages and files never flow back into the SaaS.
No return path Retained originals stay in the customer boundary, always.
Athena SaaS (assessment engine)
Receives sanitized, non-CUI assessment records only. Never a CUI system of record.
Intake + AI guard
Classifies, refuses, logs
War Room
Objective scoring, forecasts, handoff lane
Package generator
Issuance ledger + SHA-256 manifest
Provenance snapshots
Immutable, defensibility-scored
Who talks to whom
Single sanitization gate → Intake + AI guard
Customer regulated boundary → Athena SaaS (assessment engine)
What moves
Non-CUI assessment record
The only crossing into the SaaS: reference ID, hash, control mapping, sanitized rationale, two approver signatures.
What never moves
Nothing crosses without a recorded classification decision and second-person certification.
Athena is the assessment engine; AWS Wickr and the customer retention stack are the authorized custodians of regulated data. Only step 4 crosses the boundary, and it carries sanitized, non-CUI assessment records.
Pick something you would actually send during an assessment. The answer below is computed by the same classification gate that runs server-side — not a diagram someone drew.
1 · Where it starts
A message thread discussing how a control is implemented
2 · What the gate decides
This information cannot be entered into Athena's SaaS. Submit and retain it within the approved AWS Wickr and retention boundary. Record only the approved artifact identifier and sanitized status here.
3 · What happens
Stays in the AWS Wickr enclave. Athena records only that the exchange occurred.
4 · Where the original lives
AWS Wickr enclave
Decision recorded under policy boundary-policy-v1. Refusals are logged; the content itself is never copied into the log.
Paste sample text — never real regulated content — and see exactly which rule fires. This runs the same pattern set the server uses to refuse an outbound payload.
110/1200 characters. Nothing here is transmitted or stored — screening happens in your browser.
Refused — 2 rules fired
What a redacted version would look like
Evidence request EV-1042: firewall at [REDACTED: IP address] still exposes the legacy port; see [REDACTED: Vulnerability identifier (CVE)] in the scan.
23 characters removed. In production the payload is refused outright rather than auto-redacted — a human records an approved sanitized summary instead.
Every CMMC program picks one of three models, usually without saying so out loud. Here is the trade each one makes.
Put CUI in the GRC tool
The common shortcut: upload everything and let the platform index it.
Where regulated data lives
Inside a vendor SaaS you do not control
What the SaaS can see
Everything — file bodies, previews, OCR, embeddings
If the tool is breached
Your CUI is in the blast radius
Assessment speed
Fast
What the C3PAO is shown
A vendor you must now justify as in-scope
Keep it fully manual
Air-gapped folders, spreadsheets, and email chains outside any platform.
Where regulated data lives
Under your control, but scattered
What the SaaS can see
Nothing — because there is no platform
If the tool is breached
No tool to breach; custody is unproven instead
Assessment speed
Slow, and it degrades between assessments
What the C3PAO is shown
Whatever someone reassembled by hand
Athena boundary model
AthenaRegulated data stays in your AWS enclave; only sanitized references cross the gate.
Where regulated data lives
Your AWS Wickr enclave and your retention repository
What the SaaS can see
Identifiers, practice mapping, status, approved conclusions
If the tool is breached
No regulated content to lose — the gate has no return path
Assessment speed
Fast, because the sanitized record is machine-usable
What the C3PAO is shown
A continuously maintained, provenance-backed package
Level 2 practices, allocated practice-by-practice across the AWS Wickr enclave, the controlled retention repository, and Athena’s SaaS. Customer configuration and independent validation remain required.
AWS Wickr enclave
0 practices in view
Retention repository
0 practices in view
Athena SaaS
0 practices in view
This document describes Athena's use of AWS Wickr as a FedRAMP-authorized component. It does not represent Athena's SaaS or Athena Consulting Group as independently FedRAMP authorized.
Configure and monitor the separation between the authorized secure boundary (AWS Wickr) and Athena's SaaS. Regulated content never enters Athena; Athena carries sanitized metadata, references, status, and conclusions.
Decide what is actually in scope before you spend money assessing it, then label it so handling rules survive an assessor challenge.
Athena's SaaS is not FedRAMP authorized, and no component's authorization transfers to Athena. These pages state the position precisely so proposals and assessors get the same answer.