Public Standard
Ref: ETP-AC-STD-001
Ver: 1.0.0
Owner: Technical Architecture & Security Operations
⚡ Direct Answer Summary (AI Overview / Key Takeaway)
Defines the 3-tier division of security responsibilities across Hyperscalers, eTrepid MSSP, and Customers under NIST SP 800-171 and CMMC Level 2.
eTrepid ThreatKrusher MSSP Shared Responsibility Matrix
Governing Standard: NIST SP 800-171 Rev 2 / CMMC Level 2 ESP Guidance
1. Executive Overview & Purpose
eTrepid Inc. operates as a specialized Managed Security Service Provider (MSSP) and External Service Provider (ESP) delivering defense-in-depth cybersecurity, compliance engineering, and managed operations through the ThreatKrusher Cyber Defense System.
Security and regulatory compliance in a modern cloud and hybrid architecture are shared responsibilities. This matrix defines the precise division of security controls, administrative boundaries, operational duties, and compliance obligations between:
2. Shared Responsibility Model Across ThreatKrusher Pillars
flowchart TD
subgraph Tiers ["Operating Responsibility Tiers"]
C["Customer Tier: Data Ownership, Role Authorization, Physical Custody"]
M["eTrepid MSSP Tier: Telemetry Ingestion, 24/7 ThreatKrusher SOC, Enclave Config, Compliance Alignment"]
H["Hyperscaler Tier: Physical Datacenter, Hypervisor, Core Network Fabric, Hardware Redundancy"]
end
C --- M
M --- H
2.1 Pillar-Level Responsibility Allocations
| ThreatKrusher Pillar | Hyperscaler Responsibility | eTrepid MSSP Responsibility | Customer Responsibility | |
|---|---|---|---|---|
| Command (AI Governance) | Underlying foundational AI cloud infrastructure. | Governed AI as a System orchestration, policy enforcement, model boundary sandboxing, and context isolation. | Authorize AI workflow use cases; ensure organizational staff adhere to acceptable AI usage boundaries. | Designate 24/7 incident escalation POCs; authorize host isolation and containment actions. |
| ITSM (Operations & SOC) | Infrastructure provider uptime and SaaS redundancy. | 24/7 Security Operations Center (SOC) triage, Network Operations Center (NOC), Helpdesk support, automated patch management, and health telemetry. | Ensure end-user machine uptime for maintenance; authorize critical host isolation actions and approve application changes. | Ensure end-user machine uptime for patching windows; approve change requests impacting core line-of-business applications. |
| Trust (Zero Trust) | Underlying Software-Defined Network (SDN) and global fabric routing. | Micro-segmentation rule design, network access broker configuration, posture verification policies, and perimeter inspection. | Define internal departmental data access boundaries and segment trust tier requirements. | |
| Access (Identity & MFA) | Identity provider uptime (Microsoft Entra ID / Okta) and cryptographic token infrastructure. | Conditional access policies, FIDO2/hardware MFA enforcement rules, privileged role administration, and sign-in risk inspection. | Immediate notification of employee termination; user credential lifecycle approval; safeguarding assigned hardware tokens. | |
| Cloud (Sovereign Enclaves) | FedRAMP High / DoD IL4/IL5 datacenter physical security and hypervisor isolation. | Tenant provisioning, sovereign baseline hardening, CUI enclave segregation, and cryptographic configuration. | Marking and managing Controlled Unclassified Information (CUI); internal access provisioning approvals. | |
| Continuity (Backup & DR) | Physical storage resilience, geo-redundancy, and raw block-level availability. | Immutable backup policy management, air-gapped replication, daily job verification, and quarterly restoration validation. | Designate mission-critical systems and define Recovery Point Objectives (RPO) / Recovery Time Objectives (RTO). | |
| Comply (CMMC / GRC) | Underlying infrastructure compliance attestations (FedRAMP Moderate/High packages). | ESP boundary definition, System Security Plan (SSP) control contribution mapping, evidence generation, and SPRS score optimization support. | Formal adoption of organizational policies; executing employee training acknowledgments; holding ultimate audit liability. |
3. CMMC Level 2 / NIST SP 800-171 Control Domain Allocations
| NIST SP 800-171 Domain | Control Focus | Hyperscaler Role | eTrepid Role | Customer Role | Responsibility Type |
|---|---|---|---|---|---|
| Access Control (3.1) | Account management, least privilege, session lock, remote access. | Provider IAM fabric. | Configures MFA, conditional access, and role-based access. | Authorizes user access grants and offboarding. | Shared |
| Awareness & Training (3.2) | Security awareness and insider threat training. | Internal staff only. | Provides compliance training modules and tracking. | Ensures personnel complete mandatory training. | Customer |
| Audit & Accountability (3.3) | Log generation, central retention, log analysis. | Cloud control plane logs. | Central log collection, correlation, 24/7 SOC review, and retention. | Cooperates with audit log investigations. | Shared (eTrepid Primary) |
| Configuration Mgmt (3.4) | Baseline configurations, change management, software inventory. | Physical host baselines. | Automated hardening, baseline audit, unauthorized software blocking. | Submits and approves line-of-business software requests. | Shared |
| Identification & Auth (3.5) | User identification, password complexity, MFA. | Core authentication engine. | Implements FIDO2/phishing-resistant MFA and SSO integration. | Enforces secure token custody and credential secrecy. | Shared |
| Incident Response (3.6) | Incident handling, containment, reporting. | Datacenter incident response. | Threat detection, triage, containment, and forensic evidence collection. | Approves containment actions; executes regulatory/DoD reporting. | Shared |
| Maintenance (3.7) | System maintenance and diagnostic tools. | Datacenter hardware maintenance. | Remote maintenance management, tool curation, and privileged logging. | Provides scheduled maintenance windows. | Shared (eTrepid Primary) |
| Media Protection (3.8) | Media marking, storage, and sanitization. | Datacenter media disposal. | Enforces cryptographic media protection and remote wiping. | Physical marking and handling of paper/physical media. | Shared |
| Personnel Security (3.9) | Screening and termination procedures. | Hyperscaler background checks. | Screens all eTrepid technicians and cleared engineers. | Conducts background checks and termination workflows for client staff. | Customer |
| Physical Protection (3.10) | Facility access, visitor logs, surveillance. | Datacenter physical perimeter. | Advises on office physical security requirements. | Manages physical building access, locks, and visitor logs. | Customer |
| Risk Assessment (3.11) | Vulnerability scanning and periodic assessments. | Datacenter vulnerability sweeps. | Automated vulnerability scanning, patch verification, risk registers. | Authorizes remediation prioritization and risk acceptance. | Shared |
| Security Assessment (3.12) | System security plans and periodic review. | Third-party 3PAO assessments. | Drafts technical SSP contributions and conducts mock assessments. | Formally approves SSP, POA&M, and submits SPRS scores. | Customer |
| System & Comms Protection (3.13) | Cryptography, boundary protection, isolation. | Datacenter transport encryption. | FIPS 140-2/3 encryption, firewall rules, zero trust isolation. | Defines external partner communication needs. | Shared |
| System & Info Integrity (3.14) | Flaw remediation, malicious code protection. | Hypervisor threat defense. | Deploys EDR/MDR, manages automated signatures, isolates threats. | Refrains from disabling security agents on managed endpoints. | Shared (eTrepid Primary) |
4. Exceptions and Boundary Demarcations
5. Upstream SaaS & Third-Party Vendor AI Disclaimer
eTrepid Inc. governs, inspects, and strictly bounds the proprietary AI architectures and direct Retrieval-Augmented Generation (RAG) pipelines it deploys within the ThreatKrusher ecosystem.
However, modern third-party software vendors, operating system developers, and commercial SaaS providers (such as hyperscalers, office productivity suites, and IT management software) continually embed generative AI and algorithmic automation into their commercial products.
6. Private Assurance Showings & Auditing Inquiries
eTrepid recognizes that defense contractors, prospective enterprise clients, and certified C3PAO assessors require verifiable proof beyond public summaries.
We offer Private Assurance Showings under our standard Mutual Non-Disclosure Agreement (MNDA). Authorized reviewers may schedule a dedicated, guided demonstration to inspect:
To schedule a session, select Schedule a Private Showing in the Assurance Center or submit a request via the eTrepid Sovereign Trust Center Intake Form (Topic: Private Assurance Showing & Enclaves).
7. Review and Maintenance
This standard is reviewed annually and updated upon significant changes to the ThreatKrusher service architecture, NIST regulatory revisions, or DoD CMMC rulemaking milestones.