UNCLASSIFIED // PRE-DECISIONAL // FOR OFFICIAL USE ONLY
Every assertion on this page can be substantiated inside a controlled data room — by framework, by control family, and by the auditor who issued the report. What follows is the public posture of ArmyMARS Defense Systems, Inc. against the standards that govern U.S. Army, DoD, and allied defense software acquisitions.
SECTION 01 // CURRENT POSTURE
Each entry below carries a current attestation date, the issuing or assessing body, the scope of assessment, and the most recent surveillance or re-certification cycle. Full reports — including the underlying control narratives, test procedures, and auditor findings — are available to cleared personnel inside our compliance data room.
Issuing body: Independent registered public accounting firm
Renewed annually with no exceptions noted across the FY2024 operational year.
Issuing body: UKAS-accredited certification body
Statement of Applicability v4.2 covers all 93 Annex A controls.
Issuing body: C3PAO under DoD Cyber AB
Aligned with NIST SP 800-172 enhanced security requirements.
Assessed to: Protecting CUI in Nonfederal Systems
All 320 assessment objectives satisfied; pending CMMC L3 final issuance.
Authorizing official: DoD Cloud Computing POR
Initial authorization to operate granted in 23 days — 4.6x faster than the DoD median.
Mapping to: Federal information systems & OEs
Operates as the control catalog our other frameworks inherit from.
CAGE 7X9M4 / UEI Q8N2LM3K9P71 / FCL TOP SECRET // SCI ELIGIBLE / SCIF 18,000 SQ FT — IL6-CAPABLE / NATO CIV NCN-2024-AIP
SECTION 02 // ASSESSMENT DETAIL
Each top framework is paired with the auditor-style annotation below: scope of assessment, evidence types collected, control families covered, and renewal cadence. We do not summarize away the substance of the work — we publish enough for a program security officer to plan their own review.
FIG. 02.A — SOC 2 ON-SITE WALKTHROUGH, FY2025
FRAMEWORK 01 / SOC 2 TYPE II
The Type II opinion covers the operating effectiveness of controls across the full FY2025 operational year — roughly 8,760 hours of sampled evidence. The auditor's testing universe includes change-management records, access provisioning tickets, vulnerability remediation logs, vendor reviews, and incident response timelines.
FRAMEWORK 02 / CMMC LEVEL 3
CMMC Level 3 (Expert) is the highest tier under CMMC 2.0. The assessment validates that ArmyMARS protects Controlled Unclassified Information with the same rigor applied to higher-classification workloads — including the 35 enhanced security requirements drawn from NIST SP 800-172.
FIG. 02.B — CMMC L3 ASSESSMENT ARTIFACT BINDER
FIG. 02.C — IL5 PROVISIONAL ATO REVIEW
FRAMEWORK 03 / DOD IL5 PROVISIONAL ATO
The provisional authorization permits ArmyMARS to operate the MARS Platform at Impact Level 5 — controlled unclassified information plus National Security Systems data — on a FedRAMP High baseline with the DoD Cloud Computing SRG IL5 overlay. The path to full ATO is in active review.
FRAMEWORK 04 / ISO/IEC 27001:2022
ISO 27001 certification extends beyond the platform to the Information Security Management System itself — including HR onboarding, vendor onboarding, physical access, internal audit, and management review. The 2022 revision incorporates threat intelligence and ICT readiness for business continuity as first-class controls.
FIG. 02.D — ISO 27001 STATEMENT OF APPLICABILITY, v4.2
SECTION 03 // OPERATING DISCIPLINE
Certifications are snapshots. Compliance is the daily work that makes a snapshot possible. At ArmyMARS the same engineering organization that ships the platform also operates the controls that protect it — controls are versioned, automated, and reviewed on a defined cadence by people whose job descriptions name the responsibility in plain language.
Every control inherits from a written policy in the ISMS, an automated test in our continuous monitoring stack, and a named owner whose quarterly attestation is recorded in an immutable ledger. Findings — when they occur — are triaged within four hours, remediated under a documented plan of action, and verified by an internal assessor before closure. New frameworks do not land as a scramble; they are added to the Statement of Applicability, mapped to existing controls where overlap exists, and gap-analyzed against named owners before attestation.
The result is a posture that an auditor can sample at any point in the year, not just in the second week of December. A program security officer who walks into our facility on any given Tuesday will see the same evidence they would see during a formal assessment — because the formal assessment is a window into work we are already doing, not work we prepared to perform.
Office of the CISO — ArmyMARS Defense Systems, Inc.
SECTION 04 // CORROBORATING PARTIES
A posture is only as credible as the parties willing to put their name behind it. The list below is the public subset of auditors, assessment bodies, and federal programs that have engaged ArmyMARS on a documented basis. Classified program names are omitted per program security officer guidance.
