Keyboard shortcuts

Press ← or → to navigate between chapters

Press S or / to search in the book

Press ? to show this help

Press Esc to hide this help

Compliance Mapping

This page maps Vouch features to common compliance frameworks. Vouch’s hardware-backed authentication model satisfies many of the strictest access control requirements across multiple regulatory standards.

NIST 800-53

Control IDControl NameVouch Implementation
IA-2Identification and AuthenticationFIDO2 authentication with hardware-bound credentials
IA-2(1)Multi-Factor Authentication to Privileged AccountsHardware FIDO2 key (something you have) + PIN (something you know) + physical touch (presence proof)
IA-2(2)Multi-Factor Authentication to Non-Privileged AccountsSame hardware MFA applied to all accounts; no weaker alternative
IA-2(6)Access to Accounts — Separate DeviceYubiKey is a separate hardware device from the workstation
IA-2(8)Access to Accounts — Replay ResistantFIDO2 challenge-response is inherently replay-resistant
IA-2(12)Acceptance of PIV CredentialsFIDO2/WebAuthn hardware authenticators accepted
IA-5Authenticator ManagementShort-lived credentials (8-hour SSH certificates, 1-hour AWS tokens); no long-lived secrets
IA-5(1)Password-Based AuthenticationYubiKey PIN verified on-device; never transmitted to server
IA-5(2)Public Key-Based AuthenticationEd25519 SSH certificates issued by built-in CA; DPoP-bound OAuth tokens
IA-5(6)Protection of AuthenticatorsPrivate keys are hardware-bound and non-extractable on YubiKey
AU-2Event LoggingAll credential issuance and authentication events logged
AU-3Content of Audit RecordsAudit records include user identity, timestamp, credential type, authenticator AAGUID, and IP address
AU-8Time StampsCertificate validity tied to server time; supports GPS/NTP in air-gapped environments
AU-9Protection of Audit InformationAudit logs stored in database with configurable retention periods
AC-2Account ManagementUser enrollment via verified identity (OIDC); key registration via CLI (vouch register); revocation via CLI (vouch keys remove) or admin API
AC-7Unsuccessful Logon AttemptsFIDO2 PIN retry limits enforced by YubiKey hardware (locks after 8 attempts)
AC-11Device LockSessions expire after configurable duration (default 8 hours); re-authentication required
AC-12Session TerminationExplicit logout (vouch logout) and automatic session expiration
SC-12Cryptographic Key Establishment and ManagementEd25519 SSH CA key; ES256 OIDC signing key; support for HSM and split-custody key storage
SC-13Cryptographic ProtectionFIDO2/CTAP2 with hardware-backed cryptography; TLS for transport; JWT signing for tokens; FIPS 140-3 cryptography (validated aws-lc-rs FIPS module embedded in server binaries on Linux; OS FIPS mode enabled in the attestable AMI — the kernel 6.18 modularized crypto module’s CMVP validation is in process, expected 2027)
SC-23Session AuthenticityDPoP (RFC 9449) sender-constrained tokens; FAPI 2.0 client authentication

SOC 2

Trust Service CriteriaRequirementVouch Implementation
CC6.1Logical access securityHardware FIDO2 authentication mandatory for all access; no password-only path
CC6.2Authentication mechanismsMulti-factor: hardware key + PIN + physical presence
CC6.3Authorization and access managementShort-lived credentials scoped to specific services (SSH, AWS, GitHub); role-based AWS access via OIDC federation
CC6.6Restriction of system accessCredential expiration (8 hours) limits access window; no persistent credentials
CC6.7Management of credentialsAutomated credential lifecycle for user credentials (SSH certificates, AWS tokens); per-org issuer signing keys rotated via admin UI
CC6.8Prevention of unauthorized accessHardware-bound keys cannot be copied, phished, or replayed; DPoP prevents token theft
CC7.1Detection of unauthorized accessAuthentication event logging; FIDO2 attestation recorded for each session
CC7.2Monitoring of system componentsAudit trail of all credential issuance; configurable event retention
CC8.1Change managementServer configuration via environment variables or S3; TLS hot-reload for certificate rotation

FedRAMP

Control FamilyControlVouch Implementation
Identification and Authentication (IA)IA-2(1), IA-2(2)Hardware MFA required for all users; no option to bypass
Identification and Authentication (IA)IA-2(6)YubiKey is a physically separate authenticator device
Identification and Authentication (IA)IA-2(8)FIDO2 challenge-response protocol prevents replay attacks
Identification and Authentication (IA)IA-5(2)Public key authentication via Ed25519 SSH certificates and DPoP-bound tokens
Identification and Authentication (IA)IA-5(6)Hardware-bound, non-extractable private keys on YubiKey
Access Control (AC)AC-2Centralized user enrollment and key management through Vouch server
Access Control (AC)AC-7YubiKey enforces PIN lockout after consecutive failures
Access Control (AC)AC-12Sessions auto-expire; explicit logout available
Audit and Accountability (AU)AU-2, AU-3All authentication and credential issuance events logged with identity, timestamp, and method
Audit and Accountability (AU)AU-8Time-bound certificates; NTP/GPS time sync supported for air-gapped deployments
System and Communications Protection (SC)SC-12, SC-13Hardware-backed cryptography; Ed25519 CA; ES256 OIDC signing; TLS transport encryption; FIPS 140-3: validated aws-lc-rs FIPS module in server binaries; OS crypto-policy FIPS + kernel fips=1 in the attestable AMI (kernel crypto module validation in process)
System and Communications Protection (SC)SC-23FAPI 2.0 with DPoP sender-constrained tokens; private_key_jwt client authentication
Configuration Management (CM)CM-2Server configured via environment variables with S3 centralized config support
Contingency Planning (CP)CP-9Database backup/restore procedures; CA key recovery with split custody

HIPAA

HIPAA SectionRequirementVouch Implementation
164.312(a)(1)Access Control — Unique User IdentificationEach user enrolled with verified identity via OIDC; unique credentials per YubiKey
164.312(a)(2)(i)Unique User IdentificationUser email as principal in SSH certificates; sub claim in OIDC tokens
164.312(a)(2)(iii)Automatic LogoffSessions expire after configurable duration (default 8 hours)
164.312(a)(2)(iv)Encryption and DecryptionTLS for transport; hardware-backed cryptographic operations on YubiKey
164.312(b)Audit ControlsAll authentication events logged; configurable retention (default 90 days, adjustable for compliance)
164.312(c)(1)Integrity ControlsFIDO2 attestation provides cryptographic proof of authenticator identity; signed SSH certificates and JWT tokens
164.312(d)Person or Entity AuthenticationHardware FIDO2 key + PIN + physical touch provides strong person authentication
164.312(e)(1)Transmission SecurityTLS encryption for all server communication; DPoP prevents token interception
164.312(e)(2)(ii)EncryptionTLS 1.2+ enforced; base64-encoded PEM keys for configuration; rustls (no OpenSSL)
164.308(a)(3)(ii)(A)Workforce Clearance ProcedureEnrollment controlled by allowed email domains; administrative key revocation
164.308(a)(4)(ii)(B)Access AuthorizationRole-based access via OIDC scopes and AWS IAM role federation
164.308(a)(5)(ii)(C)Log-in MonitoringAuthentication events include IP address, timestamp, authenticator AAGUID, and authentication method references (AMR)
164.308(a)(5)(ii)(D)Password ManagementYubiKey PIN managed on-device; minimum 8 characters; lockout after failed attempts