ADR 0069 — Project OCTOPUS Wave-5 Enterprise Compliance¶
| Status | Date | Author | Supersedes | Superseded by |
|---|---|---|---|---|
| Accepted | 2026-05-16 | André Luiz Gallon | — | — |
Context¶
Wave-1..3 ships TLSStress.Art with baseline security (PQC, ZTP-prem, audit chain, RBAC). Wave-4 hardens at hyperscale. Wave-5 opens enterprise/regulated/defense markets via formal compliance certifications + Confidential Computing universal rollout.
This ADR formalizes Wave-5. Trigger gate: 100k+ clientes OR primeiro contrato Defense/FedRAMP fechado. Below the gate, baseline posture from Waves 1-4 + ZTP-prem (ADR 0048) is sufficient for self-serve + mid-market enterprise.
Wave-5 is heavier on process, audit prep, and certification timing than on code. Most "PRs" in Wave-5 are evidence-collection automation, compliance control mappings, and Confidential Computing rollouts.
Architectural decision¶
10 LOCKED decisions.
D1: SOC 2 Type II via Drata or Vanta automation¶
SOC 2 Type II (Trust Services Criteria: Security + Availability + Confidentiality minimum; add Processing Integrity + Privacy for regulated customers).
- Drata or Vanta for evidence-collection automation (continuous control monitoring, auto-evidence pull from cloud accounts + GitHub + Slack + Atlassian)
- 6-month evidence window (auditor reviews 6mo of operational evidence)
- External auditor: AICPA-licensed CPA firm (~$30k-50k engagement)
- Annual recertification (Type II is ongoing, not one-time)
Choice between Drata and Vanta deferred to PR-W5-1.1 RFP based on: existing GRC tool integrations, price ($30k-50k/year), TLSStress.Art's audit framework count (SOC 2 + ISO + FedRAMP all need this).
D2: ISO 27001 certification¶
ISO/IEC 27001:2022 (Information Security Management System).
- Stage 1 audit: documentation review (~1 month)
- Stage 2 audit: implementation verification (~1-2 weeks on-site/remote)
- Surveillance audits: annual (12 months after Stage 2)
- Recertification: every 3 years
Reuses ~90% of SOC 2 evidence (Drata/Vanta covers both). Incremental audit cost ~$25k-40k.
ISO 27017 (cloud security) + 27018 (PII in cloud) add ~$10k each. Defer to PR-W5-2.1 if customer demand.
D3: FedRAMP Moderate ATO via sponsored process¶
FedRAMP Moderate (US Federal authority-to-operate).
- Sponsorship required: a US federal agency must sponsor the process (no self-application path)
- 3PAO (Third Party Assessment Organization): independent auditor (~$200k-400k engagement)
- 12-18 month process (NIST 800-53 Moderate baseline = ~325 controls)
- POA&M (Plan of Action & Milestones) ongoing remediation
- Annual continuous monitoring (~$100k/year)
Spec in ADR 0070. Triggered only by signed sponsor LOI.
D4: HIPAA BAA infrastructure + audit¶
HIPAA (Health Insurance Portability and Accountability Act).
Required when handling Protected Health Information (PHI). For TLSStress.Art:
- NOT a Covered Entity (we're not a healthcare provider)
- Business Associate if customer is a healthcare org
- Sign BAA (Business Associate Agreement) with healthcare customer
- HIPAA controls overlap heavily with SOC 2 + ISO 27001
- Specific: encryption at rest + in transit, audit logs, breach notification 60-day window
Implementation effort: low (most controls already in place); BAA template + audit log retention reconfiguration is the main work.
D5: PCI DSS Level 1 (only if payment platform tier)¶
PCI DSS Level 1 (>6M card transactions/year).
TLSStress.Art uses Stripe + Razorpay for card handling — PCI scope is delegated to them. We never see raw cardholder data.
Wave-5 PCI scope ONLY applies if TLSStress.Art transitions to a payment platform itself (unlikely; Wave-6 D5 stays with Stripe).
Defer ENTIRELY unless business model changes. Mention in ADR for completeness; no Wave-5 PR ships.
D6: CMMC Level 2 (DoD contractor prerequisite)¶
CMMC 2.0 Level 2 (Cybersecurity Maturity Model Certification).
- Required for DoD contractors handling CUI (Controlled Unclassified Information)
- 110 controls from NIST 800-171
- Certified C3PAO assessment (~$50k-100k)
- 3-year cycle
Triggered only by DoD prime/sub contract. Otherwise defer.
D7: GDPR DPO formal designation + EU representative + DPIA template¶
GDPR Article 37: formal Data Protection Officer required when: - Processing on a large scale special-category data, OR - Core activities require regular and systematic monitoring of data subjects on a large scale
TLSStress.Art at 100k+ customer scale crosses Article 37 threshold. Wave-5 formalizes:
- DPO designated: external DPO-as-a-Service initially (~$15k/year) → internal hire when >500 employees
- Article 27 EU representative: required if non-EU established; hire via DPO-as-a-Service ~$10k/year
- DPIA template (Data Protection Impact Assessment) for new high-risk processing
- DSAR portal (Data Subject Access Request) — already shipped Wave-2 PR-W2-9
D8: Confidential Computing universal rollout¶
ADR 0048 ZTP-prem L7 Confidential Computing currently optional (PR-ZTP-8). Wave-5 makes it mandatory across all cells:
- AMD SEV-SNP (Secure Encrypted Virtualization, AMD EPYC)
- Intel TDX (Trust Domain Extensions, Sapphire Rapids+)
- AWS Nitro Enclaves
- Azure Confidential Computing
- GCP Confidential VMs
Per-cloud rollout: - AWS: c7i.metal-24xl with Nitro Enclaves - Azure: DC-series Confidential VMs (DCa, DCb) - GCP: c2d-highmem with Confidential Computing
Customer cells (Defense Tier in ADR 0053) ALREADY have this. Wave-5 expands to all Enterprise+ tiers.
Attestation chain: hardware attestation → Cisco Satellite Root CA co-signature → audit chain entry.
D9: Sigstore admission policy strict (Wave-4 D10 reference)¶
ADR 0060 D10 (Wave-4) already mandates Sigstore strict mode. Wave-5 verifies this is enforced in production (not just dev/staging) before SOC 2 audit window opens — auditor inspects admission policy as Configuration Management control.
D10: Cisco Crosswork integration¶
Cisco-internal partnership: TLSStress.Art available inside Cisco Crosswork product family for Cisco's enterprise customers.
- Distribution channel: Cisco TAC for support
- Joint go-to-market: TLSStress.Art as Cisco-recommended TLS posture validator
- Defense customers: Crosswork Defense supports air-gapped deployment of TLSStress.Art on classified networks
- Compliance baseline alignment: Crosswork-included compliance reports satisfy CMMC + FedRAMP customer needs
Triggered by Cisco BU approval — typically follows first paid Enterprise customer in regulated vertical.
Wave-5 PR roadmap¶
| PR | Scope | Estimated LoC + Process |
|---|---|---|
| PR-W5-1 | ADR 0069 Wave-5 umbrella (this) | docs |
| PR-W5-2 | ADR 0070 FedRAMP Moderate ATO plan | docs |
| PR-W5-3 | pkg/octopus/compliance/ scaffold (control catalog + evidence types) |
~700 |
| PR-W5-4 | Reviewer checklist + rollout runbook | docs |
| PR-W5-5 | Drata or Vanta integration (evidence collection automation) | ~800 |
| PR-W5-6 | SOC 2 Type II control mapping + evidence runbook | docs |
| PR-W5-7 | ISO 27001:2022 ISMS docs + control mapping | docs |
| PR-W5-8 | HIPAA BAA template + audit log reconfig | ~400 |
| PR-W5-9 | CMMC 2.0 Level 2 control mapping + gap analysis | docs |
| PR-W5-10 | GDPR DPO formal designation + Article 27 rep + DPIA template | docs |
| PR-W5-11 | Confidential Computing AWS Nitro Enclaves rollout | ~800 |
| PR-W5-12 | Confidential Computing Azure DC-series rollout | ~600 |
| PR-W5-13 | Confidential Computing GCP Confidential VMs rollout | ~600 |
| PR-W5-14 | Cisco Crosswork integration (joint catalog listing + TAC handoff) | ~500 |
| Total | ~4400 LoC + ~6 months audit prep |
Trigger gates (BLOCKING)¶
Do NOT begin Wave-5 implementation until ALL met:
- 100k+ clientes ativos sustained 4 weeks (validates customer-base scale)
- OR primeiro contrato Defense/FedRAMP signed (specific revenue trigger)
- CTO + CFO budget approval for $400k-700k annual compliance ops cost
- Internal head of compliance hired (not contracted — full-time)
- External legal counsel retained (HIPAA, GDPR, DoD contracting)
Below the gates, ZTP-prem (ADR 0048) + baseline TLSStress.Art posture is sufficient.
Cost summary¶
One-time setup (Year 1)¶
- SOC 2 Type II audit: ~$50k
- ISO 27001 Stage 1+2: ~$40k
- FedRAMP Moderate 3PAO: $200k-400k
- HIPAA BAA legal review: ~$10k
- CMMC 2.0 L2 C3PAO: $50k-100k
- GDPR DPO-as-a-Service initial setup: ~$5k
- Confidential Computing migration cost: ~$30k labor
Year-1 total: $385k-625k
Annual ongoing¶
- Drata/Vanta: $30k-50k
- SOC 2 Type II recertification: $30k
- ISO 27001 surveillance audit: $15k
- FedRAMP continuous monitoring: $100k
- GDPR DPO-as-a-Service: $25k
- Compliance lead headcount: $250k-350k (fully loaded)
Annual total: $450k-570k
Patent claim mapping¶
Wave-5 establishes Patent Family H (Regulated Industry Trust Posture):
- Claim 31: Audit-chain-attested Confidential Computing chain (hw attestation → root CA → audit chain root)
- Claim 32: Unified compliance evidence collection across SOC 2 + ISO 27001 + FedRAMP + CMMC from single drata-style platform with control framework cross-mapping
- Claim 33: GDPR + HIPAA + CCPA unified DSAR portal with audit chain consent provenance
Provisional filing target Q1 2028.
Cross-references¶
- ADR 0048 — ZTP-prem predecessor
- ADR 0060 D10 — Sigstore strict (verified in Wave-5)
- ADR 0070 — sibling FedRAMP spec
- Wave-2 PR-W2-9 — DSAR portal (predecessor)
- 09-compliance/ — existing compliance docs structure
- NIST 800-53 Rev 5 (FedRAMP control catalog)
- NIST 800-171 Rev 3 (CMMC L2 controls)
- AICPA SOC 2 Trust Services Criteria 2024
- ISO/IEC 27001:2022 + 27002:2022