Government, defence & public sector
Federal departments, defence primes, state agencies and municipalities face the same adversaries as the private sector, plus a set that has a national budget behind it. Guardian Sentinel is FedRAMP High and DoD Impact Level 5 authorised, deploys into fully disconnected enclaves, and tracks the state-sponsored groups that target public institutions specifically.
Authorisations & framework alignment
Authority to operate is the longest pole in most public sector security programmes. Guardian arrives with existing authorisations, inheritable control documentation and a control implementation summary your assessor can read on day one — not a promise to pursue authorisation after the contract is signed.
| Framework | Guardian status | What you inherit | Assessment artefacts |
|---|---|---|---|
| FedRAMP High | Authorised — JAB P-ATO | 421 of 421 High baseline controls implemented or inherited from the underlying IaaS | SSP, SAR, POA&M and continuous monitoring feed through the FedRAMP repository |
| DoD Cloud Computing SRG | Provisional authorisation, IL4 and IL5 | Dedicated infrastructure with US-person-only administration and CAC/PIV enforcement | DISA PA package, CDS interconnection documentation |
| StateRAMP | Authorised — High | Reciprocity for state, local and territorial procurement without re-assessment | StateRAMP security package and quarterly ConMon submissions |
| CMMC 2.0 Level 2 | Assessed and conformant | Direct coverage of 71 of the 110 NIST 800-171 Rev 2 practices for defence suppliers | Shared responsibility matrix and practice-by-practice evidence export |
| NIST 800-53 Rev 5 | Mapped and continuously assessed | Automated evidence for AC, AU, CA, CM, IR, RA, SC and SI control families | OSCAL component definition, importable into eMASS, Xacta and RegScale |
| CJIS Security Policy | Conformant, v6.0 | Advanced authentication, audit and personnel screening requirements for CJI systems | CJIS security addendum and signed personnel attestations |
| ITAR / EAR | Supported | Technical data segregated in a US-only enclave with US-person access enforcement | Access attestation and export-control handling procedure |
| EO 14028 / OMB M-22-09 | Aligned | Zero trust pillar coverage, EDR requirement satisfaction and log retention per M-21-31 | Zero trust maturity scorecard mapped to the CISA model |
Scroll the table sideways to see every column.
Guardian's public sector team supports ATO packages directly, including control narrative drafting and assessor liaison. See compliance advisory.
Nation-state threat defence
State-sponsored intrusion sets do not smash and grab. They acquire legitimate credentials, live off the land, blend with administrative traffic and wait — for a policy decision, a negotiation, a deployment order. Guardian Labs tracks 71 such groups and converts their observed tradecraft into behavioural detections that do not depend on an indicator anyone has published yet.
Nation-state operators burn infrastructure between campaigns, so hash and domain feeds are always late. Guardian detects the behaviour — credential access from an unexpected process lineage, signed-binary proxy execution, timed exfiltration staging — which is far more expensive for an adversary to change.
When a new technique is characterised, Guardian re-runs the detection across your retained telemetry automatically. Deployments routinely surface intrusions that began months before the sensor was installed.
Every finding arrives with attribution confidence, the specific tradecraft observed, the affected systems, and the containment already taken — in a format that survives transfer to a classified reporting channel.
Deployment models
Guardian runs in four topologies. All four use the same sensor, the same detection logic and the same console — the difference is where the analysis plane sits and how intelligence reaches it.
FedRAMP High multi-tenant in AWS GovCloud and Azure Government. Fastest to authority to operate; inherits the most controls.
Typical ATO: 6–10 weeks with inherited package.
Single-tenant infrastructure with US-person-only administration, CAC/PIV authentication and mission-owner-controlled encryption keys.
Typical ATO: 10–16 weeks.
The full analysis plane inside your data centre, with outbound intelligence updates over a controlled, allow-listed egress path.
Typical ATO: 12–20 weeks.
Zero network egress. Detection, analytics, response and reporting run entirely inside the enclave; intelligence arrives on signed media.
Typical ATO: 16–24 weeks.
Classified environment support
In a classified enclave, Guardian cannot see your telemetry, cannot read your alerts and cannot troubleshoot by looking at your data. Everything about the product is built so that this is a supported mode of operation rather than a degraded one.
Guardian maintains a bench of TS/SCI-cleared engineers, several with polygraph, available for on-site deployment, sustainment and incident support. Contract vehicles support cleared labour categories directly.
The platform diagnoses itself. Health, performance and detection-efficacy reports are generated inside the enclave and reviewed by your team, with a redaction workflow if you choose to share a summary with Guardian support.
Content packages are reproducibly built, signed with a hardware-backed key and hashed. Import verifies the signature and the manifest before anything is applied, and every import is recorded in the enclave's audit trail.
Reports are generated at a marked classification level with structured metadata, so a summary can be released to a lower domain through your cross-domain solution without manual re-typing or sanitisation risk.
Agencies running several enclaves at different classifications can produce a consolidated posture view at the highest level, with per-domain drill-down restricted by clearance and need to know.
No licence phone-home. Air-gapped entitlements are issued as signed, time-bounded certificates. The platform never attempts an outbound connection for any reason, including telemetry, updates or activation.
Zero trust
OMB M-22-09 set the destination; the CISA Zero Trust Maturity Model set the scoring. Guardian reports your position on each pillar continuously, so the quarterly submission is a report you export rather than a survey you complete.
Median across 340 public sector deployments. Maturity is scored traditional, initial, advanced, optimal — the percentages below show progress toward optimal on each pillar.
IdentityAdvanced — 84%
DevicesOptimal — 92%
NetworksAdvanced — 78%
Applications & workloadsAdvanced — 81%
DataAdvanced — 74%
Visibility & analyticsOptimal — 95%
Automation & orchestrationOptimal — 93%
Baseline at deployment: three pillars at traditional, four at initial. Guardian supplies the evidence behind each score, not just the score.
Guardian satisfies EL1 through EL3 logging requirements with the required retention split — 12 months active, 18 months cold — and produces the maturity self-assessment as a scheduled export. Log integrity is cryptographically verifiable end to end.
EO 14028 §7 requires endpoint detection and response across federal civilian executive branch systems, with CISA-accessible telemetry. Guardian provides the persistent access capability and the threat-hunting interface CISA specifies, scoped and logged.
Guardian publishes a CycloneDX SBOM for every release, attests builds through SLSA Level 3 provenance, and supports the self-attestation form required under M-23-16.
Review our supply chain postureMission proof
Details are generalised at the customer's request. The programme covers fourteen component agencies, three classification domains and two air-gapped enclaves.
We had spent four years trying to get consistent endpoint visibility across fourteen components that each had their own authority. Guardian's inherited FedRAMP package removed the argument about whether it could be authorised, and the component CISOs could see their own data inside a group console without giving up control of it. We finished the rollout in eight months.
Procurement
Guardian is available through the vehicles public sector buyers already hold, and through a partner network that includes small, veteran-owned and 8(a) resellers where set-aside requirements apply.
SIN 54151S, with published ceiling pricing and cooperative purchasing authority for state and local buyers.
Available through multiple prime holders for federal civilian and defence customers.
For integrated programmes bundling platform, deployment services and cleared sustainment labour.
Department-wide pricing agreements for defence components, including IL5 and air-gapped entitlements.
Active in 34 states plus NASPO ValuePoint for participating entities.
Concessionary terms for eligible state, local, tribal and territorial government members.
E-Rate eligible categories and consortium pricing through regional purchasing cooperatives.
Authorised 8(a), HUBZone, SDVOSB and WOSB resellers in every federal region. Find a partner.
Need a sole-source justification or a market research package? Guardian's public sector team supplies capability statements, comparative technical differentiators and pricing documentation in the format contracting officers expect. Request the package.
Keep reading
How Guardian Labs tracks and characterises state-sponsored groups.
PIV, CAC and derived-credential aware session analytics.
Critical infrastructure protection for OT and ICS estates.
Red and purple team exercises using tracked nation-state tradecraft.
Guardian's public sector team will map your authorisation boundary, identify which controls you can inherit, and give you a realistic date — before you write a requirement. Cleared briefings are available at the appropriate level.