Trust & compliance
Where something isn't protected, we say so.
Rhombus is designed to support your accreditation, not to replace it. Here's exactly what the platform provides today, in the words we'd use with your assessor.
Hardened to DISA STIG
Host and guest images are hardened to the DISA STIG, and every deviation is documented with its rationale. A documented deviation is a decision; an unexamined one is a finding.
FIPS 140-3 mode
The host and every hardened guest run in FIPS mode, using the operating system’s FIPS 140-3 cryptographic modules.
Encryption at rest
LUKS2 full-disk encryption on current-generation kits, unlocked by a removable key with a recovery passphrase. Media sanitization supports NIST SP 800-88 cryptographic erase.
Compliance evidence
On-demand compliance scans against each VM’s STIG profile, with CAT I/II/III findings, exported as ARF, HTML and STIG Viewer import files or a signed-off PDF.
Access control & audit
Role-based access, single sign-on, logged break-glass access, and an audit trail of every deploy, reset and destroy. The web tier is SELinux-enforced and its API is CSRF-protected.
Supply of updates
Sustainment bundles are signed and checksummed, verified before apply, applied atomically and reversible.
Passive by default
Capture ports carry no IP and never sit in the production data path.
Offline licensing
Signed license files. No license server, no phone-home.
Your ATO
Designed to support your RMF package.
Authorization is granted to your system, in your environment, by your authorizing official. Rhombus shortens the path with repeatable builds, acceptance-test templates, exportable scan evidence and encryption documentation written to be quoted in your System Security Plan.
Compliance scan scores support your accreditation of the kit. They aren't a certification, and we'll never present them as one.
Field guides
Field guides to every day after deployment.
- How to Reset a Fly-Away Kit to a Known-Good BaselineHow to return a fly-away kit to a known-good baseline between missions: rebuild mission machines from code, protect core services and check the result.
- Kit Acceptance Testing: Proving a Deployable Kit's Sensors WorkHow to validate a deployable cyber kit and produce an acceptance test report: check every service, prove the sensors see traffic and record sign-off.
- Offline Patching for Air-Gapped Fly-Away Kits, With RollbackHow to patch an air-gapped fly-away kit offline: signed update bundles, verification before anything changes, and a rollback point for every apply.
- STIG Evidence for a Deployable Kit's RMF PackageHow to produce DISA STIG scan evidence for a deployable kit: ARF results, STIG Viewer imports, documented deviations and a PDF your assessor can file.
Talk to our team about your accreditation path.
We'll walk your ISSM through the evidence package, hardening deviations and encryption design.