---
title: "Authorized cloud ≠ compliant use · Consus"
description: "Why connecting to AWS GovCloud or Azure Government doesn't make your AI use compliant, what direct integration leaves you to build, and how Consus closes the gap."
canonical: https://consus.io/compare
---

Why Consus

# “We connected to AWS GovCloud, ~so we’re compliant~.”

Wrong.

Their own paperwork says so. FedRAMP authorization covers the **platform**, not your use of it. Each CSP publishes a Customer Responsibility Matrix that rules, control by control, on what customers actually inherit. We tallied every row of all three:

AWS GovCloud

11%

11%

89%

Azure Government

10%

10%

90%

Google Cloud

19%

19%

81%

**At best, 1 in 5, and that slice is mostly the building:** badge readers, HVAC, disk shredders. The rest you build, document, and defend in your CMMC assessment. Or you route through Consus: it’s configured on day one, and our 3PAO has already assessed it against all 410 FedRAMP High controls.

The control gap

## What direct integration leaves you: _a six-figure compliance project_

Every ✗ below is a NIST 800-53 / CMMC 2.0 control you implement, document, and defend in your CMMC assessment. Every ✓ ships configured through the Consus Gateway.

      
| Control | CMMC 2.0 | What it requires | Consus Gateway | AWS Bedrock | Azure Foundry | GCP Enterprise Agent |
| --- | --- | --- | --- | --- | --- | --- |
| Audit & Accountability |  |  |  |  |
| AU-2 | 3.3.1 | Log every AI request and response (no prompts or response bodies) invocation logging is off by default | Configured for you | Not configured | Not configured | Not configured |
| AU-6 | 3.3.5 | Review and correlate audit records no cross-request review or alerting | Configured for you | Not configured | Not configured | Not configured |
| AU-9 | 3.3.8 | Protect audit logs from tampering logs not tamper-protected | Configured for you | Not configured | Not configured | Not configured |
| AU-11 | 3.3.1 | Retain audit records (FedRAMP: 1 year) no retention configured by default | Configured for you | Not configured | Not configured | Not configured |
| AU-12 | 3.3.1 | Generate a record for every invocation no audit record generated | Configured for you | Not configured | Not configured | Not configured |
| Access Control |  |  |  |  |
| AC-2 | 3.1.1 | Manage the API-consumer account lifecycle no issue / scope / revoke lifecycle | Configured for you | Not configured | Not configured | Not configured |
| AC-4 | 3.1.3 | Enforce which models & regions CUI can flow to no model/region allowlisting by default | Configured for you | Not configured | Not configured | Not configured |
| AC-7 | 3.1.8 | Detect & throttle brute-force / bad keys none on a raw API key | Configured for you | Not configured | Not configured | Not configured |
| Identification & Authentication |  |  |  |  |
| IA-5 | 3.5.10 | Issue, scope & auto-disable API-consumer credentials no consumer-credential lifecycle | Configured for you | Not configured | Not configured | Not configured |
| System & Communications Protection |  |  |  |  |
| SC-7 | 3.13.1 | Protect the service boundary (WAF) no WAF in front of model calls | Configured for you | Not configured | Not configured | Not configured |
| SC-8 | 3.13.8 | Enforce a minimum TLS 1.2 / FIPS cipher floor client TLS/FIPS floor not enforced | Configured for you | Not configured | Not configured | Not configured |
| SC-13 | 3.13.11 | Use FIPS-validated cryptography SDKs default to non-FIPS endpoints | Configured for you | Not configured | Not configured | Not configured |
| System & Information Integrity |  |  |  |  |
| SI-4 | 3.14.6 | Monitor traffic for attacks & anomalies AI traffic unmonitored | Configured for you | Not configured | Not configured | Not configured |
| Assessment & Continuous Monitoring |  |  |  |  |
| CA-7 | 3.12.3 | Continuously monitor controls & produce evidence one-time setup, no ongoing evidence | Configured for you | Not configured | Not configured | Not configured |
| Incident Response |  |  |  |  |
| IR-4 | 3.6.1 | Provide an incident-response capability no detection, containment or IR plan | Configured for you | Not configured | Not configured | Not configured |
| IR-6 | 3.6.2 | Detect, report & notify on incidents (72-hr DFARS) no notification workflow | Configured for you | Not configured | Not configured | Not configured |

Representative subset, not a complete control set. AWS GovCloud, Azure Government, and GCP Assured Workloads are FedRAMP-authorized _platforms_. The gap shown here is the _usage layer_, which the shared-responsibility model leaves to the customer. Every ✓ corresponds to a control executed by Consus.

[See full compliance details](/compliance)

## Close the gap with one line of code

US-based defense contractors only. Access is granted after a company review and contract. No self-serve.

[Request Access →](https://tally.so/r/QKBYVg) [Book a compliance call](https://cal.com/emagliarditi/consus-gateway-intro-discussion)