Compliance status
Devexana has no third-party assessment or certification. This page lists control design labels and the evidence that auditors can export.
On this page
Status
Devexana has no SOC 2 report, no StateRAMP or FedRAMP authorization, and no CJIS assessment. Devexana has no completed third-party penetration test.
| Assessment or certification | Status |
|---|---|
| Third-party penetration test | Not completed |
| SOC 2 report | None |
| StateRAMP authorization | None |
| FedRAMP authorization | None |
| CJIS assessment | Not completed |
Control names used as design labels
Control names identify the purpose of each feature. These names do not show assessment results. Screens such as the evidence pack card show these names as labels.
| Control | Name in NIST SP 800-53 | Product design | Details |
|---|---|---|---|
| AU-3 | Content of audit records | Each audit record identifies the actor, action, time and outcome | The audit log |
| AU-5(2) | Response to audit logging process failures: real-time alerts | An alert when an audit write fails or the chain check fails | The audit log |
| AU-9 | Protection of audit information | The appliance checks the hash-chained, append-only audit log and egress log at start-up | Audit log and the auditor evidence pack |
| AC-5 | Separation of duties | The Auditor role can view logs and cannot read other data | Accounts, roles and sign-in |
| AC-7 | Unsuccessful logon attempts | Account lockout after repeated failed sign-ins | Accounts, roles and sign-in |
| AC-8 | System use notification | Before viewing data, each user must accept a system-use notice | Accounts, roles and sign-in |
| SI-7 | Software, firmware and information integrity | The appliance verifies signed updates before installation | How Devexana is delivered |
What auditors can export
Auditors can export an OSCAL package as part of the evidence pack. The pack also holds the role matrix, access grants and the audit-chain integrity result. The steps are on Audit log and the auditor evidence pack.
Known gaps relevant to an assessment
The full list of product limits is on What Devexana does not do (limitations).
Questions from procurement
Send security and procurement questions to security@devexana.com.
Applies to Devexana release 0.3.182. Page updated 2026-10-20. Questions or corrections: support@devexana.com.