Compliance pre-wiring — what's active on Day 0
The problem this solves
In a typical platform build, compliance controls are retrofitted after the platform is running — FIPS gets enabled after a finding, STIGs get applied before an audit, SBOM tooling gets added when a policy requires it. Each retrofit is a project.
SmoothGlue ships compliance controls as part of the platform baseline. The following are active when smoothglue install completes.
What's active on Day 0
FIPS 140-2/3
All cryptographic operations in SmoothGlue components use FIPS-validated modules: TLS termination, secret storage (Vault), authentication tokens (Keycloak), and artifact signatures. FIPS mode is on by default and cannot be disabled without modifying platform configuration.
DISA Kubernetes STIG (V1R11)
Kyverno policy engine enforces STIG controls at admission time — any pod spec that violates the STIG is rejected before it runs. Controls covered: no privileged containers, no host networking, required security contexts, image provenance checks. View the active policy set in the Console under Tools → Kyverno.
Zero-Trust Network
Istio service mesh enforces mTLS between all platform services. Keycloak AuthService gates all external access. Default-deny network policy: no workload can communicate with another unless explicitly permitted.
Runtime Behavioral Analysis
NeuVector monitors all running containers for behavioral anomalies — unexpected processes, network connections outside defined baselines, privilege escalation attempts. Alerts surface in the Console and in Ground Control dashboards.
SBOM on every build
Every container image built through the Pillars of Creation pipeline gets a CycloneDX SBOM attached automatically. No developer action required. Compliance leads can pull the SBOM for any image via the Console.
What you still own
- Application-level controls: your app's code and dependencies produce SBOMs, but you own the findings
- Agency-specific controls: controls in your overlay beyond the SmoothGlue baseline
- Residual risk acceptance: SmoothGlue documents what it covers; your ISSO signs off on the residual