Request Access → “We connected to AWS GovCloud, so we’re compliant.”
Wrong.
Their own paperwork says so. FedRAMP authorization covers the platform, not your use of it. Each CSP publishes a Customer Responsibility Matrix that rules, control by control, on what customers actually inherit. We tallied every row of all three:
At best, 1 in 5, and that slice is mostly the building: badge readers, HVAC, disk shredders. The rest you build, document, and defend in your CMMC assessment. Or you route through Consus: it’s configured on day one, and our 3PAO has already assessed it against all 410 FedRAMP High controls.
What direct integration leaves you: a six-figure compliance project
Every ✗ below is a NIST 800-53 / CMMC 2.0 control you implement, document, and defend in your CMMC assessment. Every ✓ ships configured through the Consus Gateway.
| Control | CMMC 2.0 | What it requires | Consus Gateway | AWS Bedrock | Azure Foundry | GCP Enterprise Agent |
|---|---|---|---|---|---|---|
| Audit & Accountability | ||||||
| AU-2 | 3.3.1 | Log every AI request and response (no prompts or response bodies) invocation logging is off by default | Configured for you | Not configured | Not configured | Not configured |
| AU-6 | 3.3.5 | Review and correlate audit records no cross-request review or alerting | Configured for you | Not configured | Not configured | Not configured |
| AU-9 | 3.3.8 | Protect audit logs from tampering logs not tamper-protected | Configured for you | Not configured | Not configured | Not configured |
| AU-11 | 3.3.1 | Retain audit records (FedRAMP: 1 year) no retention configured by default | Configured for you | Not configured | Not configured | Not configured |
| AU-12 | 3.3.1 | Generate a record for every invocation no audit record generated | Configured for you | Not configured | Not configured | Not configured |
| Access Control | ||||||
| AC-2 | 3.1.1 | Manage the API-consumer account lifecycle no issue / scope / revoke lifecycle | Configured for you | Not configured | Not configured | Not configured |
| AC-4 | 3.1.3 | Enforce which models & regions CUI can flow to no model/region allowlisting by default | Configured for you | Not configured | Not configured | Not configured |
| AC-7 | 3.1.8 | Detect & throttle brute-force / bad keys none on a raw API key | Configured for you | Not configured | Not configured | Not configured |
| Identification & Authentication | ||||||
| IA-5 | 3.5.10 | Issue, scope & auto-disable API-consumer credentials no consumer-credential lifecycle | Configured for you | Not configured | Not configured | Not configured |
| System & Communications Protection | ||||||
| SC-7 | 3.13.1 | Protect the service boundary (WAF) no WAF in front of model calls | Configured for you | Not configured | Not configured | Not configured |
| SC-8 | 3.13.8 | Enforce a minimum TLS 1.2 / FIPS cipher floor client TLS/FIPS floor not enforced | Configured for you | Not configured | Not configured | Not configured |
| SC-13 | 3.13.11 | Use FIPS-validated cryptography SDKs default to non-FIPS endpoints | Configured for you | Not configured | Not configured | Not configured |
| System & Information Integrity | ||||||
| SI-4 | 3.14.6 | Monitor traffic for attacks & anomalies AI traffic unmonitored | Configured for you | Not configured | Not configured | Not configured |
| Assessment & Continuous Monitoring | ||||||
| CA-7 | 3.12.3 | Continuously monitor controls & produce evidence one-time setup, no ongoing evidence | Configured for you | Not configured | Not configured | Not configured |
| Incident Response | ||||||
| IR-4 | 3.6.1 | Provide an incident-response capability no detection, containment or IR plan | Configured for you | Not configured | Not configured | Not configured |
| IR-6 | 3.6.2 | Detect, report & notify on incidents (72-hr DFARS) no notification workflow | Configured for you | Not configured | Not configured | Not configured |
Representative subset, not a complete control set. AWS GovCloud, Azure Government, and GCP Assured Workloads are FedRAMP-authorized platforms. The gap shown here is the usage layer, which the shared-responsibility model leaves to the customer. Every ✓ corresponds to a control executed by Consus.
See full compliance detailsClose the gap with one line of code
US-based defense contractors only. Access is granted after a company review and contract. No self-serve.