CMMC Level 2
CaseBender supports Cybersecurity Maturity Model Certification (CMMC) Level 2, which requires implementation of 110 practices from NIST SP 800-171.Key Capabilities
- Practice Management: Track all 110 CMMC Level 2 practices across 14 domains
- SPRS Scoring: Calculate and track your Supplier Performance Risk System (SPRS) score over time
- Assessment Tracking: Manage self-assessments and third-party assessments (C3PAO)
- POA&M Management: Track Plans of Action and Milestones for practices not yet fully implemented
- Evidence Collection: Automated collectors gather evidence mapped to specific practices
Domain Coverage
FedRAMP Moderate
CaseBender supports FedRAMP Moderate authorization, implementing controls from NIST SP 800-53 Rev 5.Key Capabilities
- Control Management: Track all 325 FedRAMP Moderate controls with implementation status
- System Security Plan (SSP): Manage SSP documentation with version control and approval workflows
- Continuous Monitoring (ConMon): Automated monthly reporting on control effectiveness
- POA&M Management: Track remediation plans with OMB A-130 compliance
- Authorization Periods: Manage authorization boundaries, ATOs, and reauthorization schedules
- Significant Change Management: Track and assess significant changes that may affect authorization
Control Families
CaseBender maps its capabilities to all 20 NIST SP 800-53 control families, with particular strength in:- AC (Access Control): RBAC, MFA, session management, PAM
- AU (Audit and Accountability): Unified audit trail, integrity protection, SIEM forwarding
- IA (Identification and Authentication): Multi-factor, device trust, service authentication
- IR (Incident Response): Case management, playbooks, SLA tracking
- SC (System and Communications Protection): Encryption, TLS, network segmentation
HIPAA
CaseBender supports HIPAA compliance for organizations that handle Protected Health Information (PHI) as part of security operations.Security Rule Safeguards
Administrative Safeguards (164.308)
Technical Safeguards (164.312)
Breach Notification Rule (164.404-408)
- Individual Notification: Generate and track notifications to affected individuals
- HHS Notification: Manage notification to the Department of Health and Human Services
- Media Notification: For breaches affecting 500+ individuals, manage media notifications
- Breach Documentation: Maintain breach records for 6 years as required
Business Associate Agreements
- Track BAAs with all business associates
- Monitor BAA expiration dates and renewal requirements
- Document BAA terms and data handling obligations
PCI DSS v4.0
CaseBender supports PCI DSS v4.0 for organizations that process payment card data in security investigations.Key Capabilities
- Requirement Tracking: All 12 PCI DSS requirements with 78 sub-requirements
- Evidence Collection: Automated collectors for access controls, encryption, logging, and network security
- Control Testing: Scheduled testing with evidence capture and result tracking
- Incident Management: PCI-specific incident tracking with notification requirements
- Assessment Periods: Manage QSA assessments and self-assessment questionnaires
Requirement Coverage
Export Control
CaseBender includes export control compliance for organizations handling controlled technology data.Key Capabilities
- ECCN/ITAR Classification: Classify security data and tools under Export Administration Regulations (EAR) and International Traffic in Arms Regulations (ITAR)
- Denied Party Screening: Screen entities against government restricted and denied party lists before data sharing
- Country Controls: Enforce embargoed and restricted country rules on data access and sharing
- License Management: Track export licenses with expiration dates and usage limits
- Auto-Classification Engine: Suggest classifications based on data content and context
Screening Lists
CaseBender screens against:- Consolidated Screening List (CSL)
- Entity List (BIS)
- Specially Designated Nationals (OFAC SDN)
- Denied Persons List (BIS)
- Debarred List (DDTC)
EU AI Act
CaseBender supports EU AI Act compliance for organizations using AI capabilities within the platform.Key Capabilities
- AI System Registration: Register and catalog AI systems used within CaseBender (AI insights, auto-enrichment, correlation engine)
- Risk Assessment: Evaluate AI systems against EU AI Act risk categories (minimal, limited, high, unacceptable)
- Incident Reporting: Report and track AI-related incidents with root cause analysis
- Conformity Assessment: Manage conformity assessments for high-risk AI systems
- Human Oversight: Document human oversight mechanisms for AI-assisted decisions
- Transparency: Maintain transparency records showing how AI systems make recommendations
Related Documentation
- Compliance Overview — Framework matrix and unified compliance
- SOC2 Type II — SOC2 deep dive
- ISO 27001:2022 — ISO 27001 deep dive
- GDPR & Privacy — GDPR deep dive