What "Closed Environment" Actually Means
The requirement that recurs across federal data-analysis work is simple to state and easy to get wrong: analyze the government's data without sending the government's data anywhere. The controlling variable is where inference happens — not who owns the model weights.
Open-weight models are perfectly acceptable to federal buyers when they are self-hosted inside an isolated boundary with no external connectivity and no data egress. What is prohibited is sending government data to a public or hosted third-party model service. A dedicated, single-tenant, VPC-isolated deployment in a FedRAMP-authorized government cloud region is also generally acceptable, provided that environment is exclusive to the engagement.
Not permitted
- Government data sent to a public or hosted commercial model API
- Data retained or used to train, fine-tune, or improve any vendor model
- Multi-tenant environments shared with other workloads
- Inference performed outside the authorization boundary
Permitted
- Open-weight models self-hosted inside the isolated environment
- A dedicated single-tenant environment in an authorized government cloud region, exclusive to the engagement
- Deterministic rules engines, statistical models, and classical ML where they fit better than generative AI
- All inference inside the boundary, with no egress path
The controlling question is not whether a model's weights are publicly available. It is where inference happens and whether data can leave. Ours cannot.
Architecture
Every engagement runs inside a single authorization boundary. Data enters through a government-provided secure channel, is processed on hardened hosts with no outbound route, and is destroyed on completion. There is no path from the analysis subnet to the public internet.
Controls, Mapped to Standards
Each control below describes how the environment is architected and operated, mapped to the federal standard it aligns to. These are statements of practice — true whenever we operate this way — and they form the basis of the security-questionnaire response we provide to a contracting officer on request.
| Control area | What we implement | Standard reference |
|---|---|---|
| Access control | Unique user identity, multi-factor authentication, least-privilege role-based access, tiered admin separation, and documented provisioning and de-provisioning. | NIST SP 800-53 AC family; HSPD-12-aligned authentication per NIST SP 800-63 |
| Audit & accountability | Operating-system and application logs sufficient to attribute actions to individual users; logs retained through contract close and available for government review. | NIST SP 800-53 AU family |
| Configuration management | Hardened baselines with DISA STIG and CIS profiles applied, and a documented baseline inventory of hardware, software, and firmware. | NIST SP 800-53 CM family |
| Cryptography at rest | Full-disk and volume encryption using CMVP-validated FIPS 140-3 modules. | FIPS 140-3 |
| Cryptography in transit | TLS with current, non-deprecated versions and cipher suites; deprecated protocols disabled. | NIST SP 800-52 Rev 2 |
| Vulnerability management | Continuous scanning, centrally managed patching, expanded security maintenance on the OS baseline, and documented remediation timelines. | NIST SP 800-53 RA/SI families |
| Incident response | Documented IR plan; suspected or actual breach reported to the contracting officer and COR within one hour of discovery, with a written follow-up report. | NIST SP 800-61; standard agency breach clauses |
| Media sanitization | Purge or destroy on completion, with the method matched to the media type and a certificate issued. | NIST SP 800-88 |
| Personnel security | U.S. citizens residing in the U.S.; signed NDAs; signed rules of behavior; annual security, privacy, and insider-threat awareness training; a separation checklist on role exit. | Agency personnel-security clauses; FISMA training requirements |
| Supply chain | Software Bill of Materials provided on request using NTIA minimum elements; a C-SCRM plan prepared in the structure of NIST SP 800-161 Appendix E. | EO 14028; NIST SP 800-161 |
| Interconnection | Where an information-exchange agreement is required, it is prepared in the structure recommended by NIST SP 800-47 Rev 1. | NIST SP 800-47 Rev 1 |
| Health information | HIPAA administrative, physical, and technical safeguards applied to any data containing health information; de-identification verified against Safe Harbor or Expert Determination before treating data as non-PHI. | HIPAA Security & Privacy Rules; 45 CFR 164.514 |
| CUI handling | Controlled Unclassified Information marked, stored, and transmitted per federal CUI requirements; protections aligned to NIST SP 800-171. | 32 CFR Part 2002; NIST SP 800-171 |
| AI governance | Model inventory and disclosure before award; documented training provenance for each model used; human review of all AI-assisted conclusions; no government data used for training or improvement. | NIST AI RMF (AI 100-1); agency AI disclosure requirements |
The Ubuntu Pro FIPS Baseline
Our processing hosts run Ubuntu Pro with FIPS mode enabled. Ubuntu 22.04 LTS ships NIST CMVP-certified FIPS 140-3 cryptographic modules — kernel, OpenSSL, libgcrypt, and GnuTLS — available to Ubuntu Pro subscribers, with SSH linked against the FIPS OpenSSL library. The same subscription provides expanded security maintenance across the package archive and Canonical's Ubuntu Security Guide tooling, which applies CIS Benchmark and DISA STIG hardening profiles and produces machine-readable compliance reports. The result is a baseline where the cryptography is independently validated, the hardening is benchmarked against the profiles federal reviewers already use, and the whole thing stays patched under vendor support for the life of the engagement.
FIPS-certified modules are pinned to the exact binaries NIST validated, so they can lag current patch levels. We track certificate status and CVE exposure on the certified modules and document the position for the government in our security-questionnaire response, rather than leaving it implicit. Canonical's 22.04 FIPS certificates were issued as interim certificates under NIST's certificate backlog scheme, pending conversion to full five-year certificates — a detail we disclose rather than obscure.
Received, Analyzed, Destroyed
Receive
Government secure file transfer only; encrypted in transit; logged.
Verify
Checksum verified on receipt; dataset validated against the agreed schema.
Isolate
Loaded into the closed environment; no outbound route from the analysis subnet.
Analyze
Self-hosted models and deterministic pipelines; human review of AI-assisted findings.
Deliver
Outputs returned through the same government channel that provided the data.
Destroy
Data purged; media sanitized to NIST SP 800-88; certificate of destruction issued.
No long-term storage. Government data exists in our environment only for the duration of the analysis and is destroyed on completion, with written certification to the contracting officer.
Method Follows Requirement
Methods
- Deterministic rules engines
- Duplicate and near-duplicate detection
- Code-pair and consistency validation
- Provider, vendor, and facility outlier detection
- Statistical benchmarking against published federal schedules and reference rates
- Utilization and trend analysis
- Anomaly and pattern detection
- Entity resolution across inconsistent records
- Self-hosted language models for unstructured text, narrative synthesis, and document triage
Applications
- Improper-payment and fraud, waste, and abuse review
- Healthcare and insurance claims analysis
- Procurement and invoice integrity
- Grant and program integrity
- Backlog and case-file processing
- Records and correspondence review
- Data-quality assessment and cleansing on messy government datasets
Outputs
Executive summary, record-level findings, entity-level findings, ranked reports, documented methodology, and a detailed audit file — delivered in Word, Excel, or other structured formats, with an oral read-out on request.
Method follows requirement. Where a deterministic rule is the correct instrument, we use a deterministic rule and document why. Generative models are used where language, not arithmetic, is the problem — and every conclusion they contribute is reviewed by a qualified human analyst before delivery.
From Questionnaire to Certified Destruction
Security Documentation
Security questionnaire completed; controls documented for review.
Exchange Agreement
Information exchange agreement executed in the structure of NIST SP 800-47.
Secure Transfer
Data transferred through the government's provisioned secure channel.
Analysis
Analysis performed inside the boundary, with interim deliverables.
Delivery & Destruction
Final delivery, oral read-out, and certified destruction of the data.
Attestations, Stated Honestly
The controls in the mapping above are matters of architecture and operating practice, in place whenever we run an engagement this way. The items below are formal third-party attestations and registrations. Each is shown at its true current status — we do not describe an attestation we do not hold.
| Item | Current status |
|---|---|
| Unique Entity ID (UEI) | Registered in SAM.gov — provided on request |
| CAGE Code | Pending |
| ISO/IEC 27001 | Not currently held |
| SOC 2 | Not currently held |
| CMMC | Not currently held |
| NIST SP 800-171 self-assessment (SPRS) | Not currently held |
| HIPAA workforce training records | Not currently held |
A contractor is not "FedRAMP authorized," "ATO-holding," or "HIPAA certified" — those authorizations attach to systems and offerings, not to companies. Where an authorized cloud is used, it is described as a FedRAMP-authorized cloud service, which is an architecture statement, not a claim about Orelands.
Talk to Us About a Closed-Environment Analysis
Contracting officers, agency buyers, and teaming partners — reach out to discuss an isolated analysis of claims, payment, program, or records data. We respond with a capability statement and a security-questionnaire-ready control summary.