FedRAMP Secure Configuration Guide

Rules: SCG-CSO-RSC (content), SCG-CSO-PUB (public availability), SCG-CSO-AUP (use instructions), SCG-CSO-SDF (secure defaults). FedRAMP Consolidated Rules for 2026.

Version 1.0 — 2026-07-04

This guide describes how to securely configure and operate Partos for federal agency and enterprise use. It is published publicly and requires no login.

1. Introduction

Purpose. Help customer administrators securely access, configure, operate, and decommission their Partos environment.

Audience. Agency and enterprise tenant administrators, security teams validating configuration against agency baselines, and auditors reviewing customer-configurable controls.

Scope. Partos SaaS platform, delivered as a Government Community Cloud offering from AWS GovCloud (US). Covers the customer-facing services identified as in-scope in the Partos public service list.

Digital identity assurance. Partos supports configuration consistent with NIST SP 800-63 IAL2, AAL2, and FAL2. Customer administrators are responsible for enforcing the authentication and federation settings described in this guide to maintain these levels.

How to obtain and use this guide (SCG-CSO-AUP). This guide is available publicly at https://partos.ai/fedramp/secure-configuration-guide-SCG-CSO-PUB and is linked from the Partos FedRAMP Public Information page and Trust Center. It is versioned; see the change history at the end.

2. Top-level administrative accounts

Top-level administrative accounts control enterprise-wide access to the entire Partos offering for your organization. Secure them with the highest priority.

Accessing. Access top-level administrative functions only through the Console using an account federated to your identity provider (IdP) with multi-factor authentication (MFA) enforced. Do not share top-level administrative credentials.

Configuring. On initial provisioning, Partos applies recommended secure defaults (see §6). Configure your IdP as the authoritative authentication source, enforce MFA, and assign top-level administrative rights to the minimum number of individuals required.

Operating. Review top-level administrative account membership at least quarterly. Monitor administrative actions through the audit log. Use separate accounts for administrative versus day-to-day work.

Decommissioning. When a top-level administrator leaves or changes role, immediately revoke their access through the admin console (or your IdP if federated), reassign any sole-owner responsibilities, and confirm removal in the next access review. Deactivate rather than delete where records must be retained for audit.

3. Security-related settings controlled by top-level administrative accounts

The following settings can be operated only by top-level administrative accounts and carry enterprise-wide security implications:

Identity provider / SSO federation. Establishes how all users authenticate. Misconfiguration can weaken authentication for the entire organization; restrict allowed application URLs to Partos tenant domains.

MFA enforcement policy. Determines whether MFA is required org-wide. Keep enforced for all accounts.

Role and permission structure. Defines the organization's RBAC model. Follow least privilege.

Data classification and access boundaries. Partos classifies assets (including ITAR, EAR, and CUI designations) and can enforce access boundaries based on attributes such as user nationality and geographic location. Administrators are responsible for configuring user attributes accurately so that export-control and classification-based access rules apply as intended.

Model Registry. Controls which AI models are permitted for use with your data. Restrict to models approved for your data classification.

Audit log configuration. Governs security monitoring for the tenant. Keep enabled.

4. Security-related settings controlled by privileged accounts

Privileged (non-top-level) accounts can operate settings including group membership management, workflow publishing in Workflow Builder, Vault document access and classification, and API key issuance. Assign privileged roles by least privilege and review quarterly. Agentic workflows may query connected data sources and should be scoped to the minimum access needed.

5. Baseline security posture

For reference, Partos enforces the following at the platform level:

Transport encryption: TLS 1.3 standard (TLS 1.2 minimum) on all endpoints.
Encryption at rest: AES-256 for databases; SSE-KMS with per-vault customer-managed keys for stored documents, within the AWS GovCloud (US) boundary.
Data residency: Customer data remains within AWS GovCloud (US).
AI inference boundary: Model inference for federal tenants is performed within the AWS GovCloud (US) boundary; customer data is not transmitted to commercial model endpoints outside the boundary. The multi-provider model gateway is constrained to boundary-resident models approved for the tenant's data classification.
Session controls: For sessions accessing sensitive data, 60-minute maximum lifetime and 15-minute idle timeout.
Audit logging: Security-relevant events retained for three years on tamper-resistant storage.

6. Secure defaults (SCG-CSO-SDF)

Partos provisions new organizations with recommended secure defaults for administrative and privileged accounts, including MFA enforcement, least-privilege default roles, and audit logging enabled. Administrators should retain these defaults unless a documented business need requires change.

7. Customer hardening checklist

• Enforce MFA for all users via your IdP
• Federate SSO to your authoritative IdP; disable local password sign-in where supported
• Assign least-privilege roles; limit top-level administrators to the minimum
• Configure user nationality and location attributes accurately to support export-control and classification-based access enforcement
• Configure session timeouts consistent with your agency baseline
• Restrict the Model Registry to approved AI models for your data classification
• Review Workflow Builder permissions before publishing shared workflows
• Verify Vault document classification (ITAR / EAR / CUI / PII) on ingestion
• Rotate API keys at least every 90 days and on personnel change
• Establish a quarterly access review of users, groups, and roles
• Configure a monitored security contact for Partos notifications

8. Enhanced capabilities

The following FedRAMP-recommended enhanced capabilities are in development:

• Settings comparison (compare current settings to secure defaults) — Target: 2026-Q4
• Machine-readable settings export — Target: 2026-Q4
• Configuration API (view/adjust security settings via API) — Target: 2026-Q4
• Machine-readable version of this guide — Target: 2026-Q4
• Customer SIEM export of audit logs — Target: 2026-Q4

9. Getting help

To report a security issue or request configuration help, email security@partos.ai. For urgent security matters, mark the subject line SECURITY.

Change history