Security & Compliance
Rated High on all three.
Kurrent Logic supports systems rated FISMA High in confidentiality, integrity, and availability — the most demanding impact level in the federal framework. The controls below are how that rating is held, not just earned.
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
Backed by an ISO/IEC 27001:2022 certified information security management system.
Control ledger
Five areas, and the evidence behind each.
Expand any row to see how the control is implemented on the systems we support and what it produces for an assessor.
AC Access Control Role-based access control limits what each user can do
Applications are built around role-based access control, so a user’s permissions follow the role they hold rather than being granted account by account. Each role carries the least privilege the work requires, which keeps access reviews short and makes it clear who can reach what, and why.
Roles are enforced in the application itself, so the limit holds regardless of how a user reaches the system. Group Policy still applies baseline configuration across the environment underneath.
- Mechanism
- Active Directory GPOs
- Scope
- All systems in the environment
AU Audit & Accountability All user interactions logged into Splunk
All user interactions are logged so the system stays audit-ready between formal assessments. We work with agency Splunk teams to integrate those audit records into Splunk, which puts the evidence where security operations already looks instead of in an application-only log nobody reads.
- Coverage
- All user interactions
- Destination
- Agency Splunk
RA Vulnerability Scanning Applications, servers, and databases
Applications, servers, and databases are scanned for vulnerabilities using Web Inspect, Invicti, and Tenable. The value is in what happens next: our team reads the findings, separates the exploitable from the noise, traces each one to the code or configuration that caused it, and retests after the fix so the finding is closed rather than deferred.
Scanning all three layers matters because an application patched against its own findings still inherits whatever the host and the database underneath it are carrying.
- Targets
- Applications, servers, databases
- Tooling
- Web Inspect, Invicti, Tenable
SA Secure Development OWASP best practices in .NET
Our .NET development follows OWASP best practices, so the common classes of web vulnerability are addressed in the code rather than discovered by a scanner later in the cycle. Findings that do surface are cheaper to fix when the pattern was right to begin with.
- Standard
- OWASP best practices
- Applied in
- .NET application development
CA Assessment & Authorization Artifacts gathered with agency ISSOs
During FISMA assessments we work directly with the agency's Information System Security Officers, gathering the artifacts and evidence the assessment requires. The ISSO stays the accountable party; our job is to make their evidence package complete and defensible without stalling the delivery schedule.
- Partner
- Agency ISSOs
- Produces
- Assessment artifacts & evidence
Working with the ISSO
Assessment season should not be a fire drill.
Because logging, configuration, and scanning run continuously, the evidence an assessment asks for already exists. Four things the security officer can count on.
- Artifacts
- Documentation and evidence collected alongside the ISSO during FISMA assessments.
- Audit trail
- User interaction logs, retained and readable rather than reconstructed after the fact.
- Scan results
- Findings across the application, server, and database layers from established tooling.
- Configuration proof
- Group Policy enforcement that shows a control applied across every system, not a sample.
Scan coverage
Three layers, because attackers do not stop at one.
A clean application scan says nothing about the host it runs on or the database behind it. We scan all three.
Web-facing code checked against the vulnerability classes OWASP practice is meant to prevent.
Hosts assessed for exposure, patch level, and configuration weakness.
The data layer scanned in its own right, not assumed safe behind the app.
Tooling
- Web Inspect
- Invicti
- Tenable
The record
Where this has been applied.
- Impact level
- FISMA High — confidentiality, integrity, and availability.
- Certification
- ISO/IEC 27001:2022 certified information security management system.
- Standards
- OWASP best practices for .NET development; Active Directory Group Policy enforcement across all systems.
- Tooling
- Web Inspect
- Invicti
- Tenable
- Splunk
- Proven on
- Upgrading Legacy Applications and Moving DHS Into the Cloud.