Trust & Compliance
CMMC, NIST 800-171, ITAR, HIPAA and GDPR compliance at the data layer.
XQ enforces security at the data object level, so the controls your auditors ask about — encryption, key sovereignty, access policy, audit trail — are the same controls that carry your compliance posture across every framework below.
Defense & Public Sector
Critical Infrastructure (IT/OT)
Enterprise & Data Privacy
Cryptographic Standards
Control Mapping
Framework, control, and how XQ covers it.
Every row below maps a specific regulatory or industry control to the exact XQ platform capability that satisfies it.
Framework
Control Focus
Platform Coverage
Learn More
CMMC 2.0 L2 / L3
CUI protection at the data object level
Zero Trust Data Encryption and Externalized Key Management enforce object-level AES-256 encryption with customer-held keys for every CUI record.
DFARS 252.204-7012
Safeguarding covered defense information
Multi-KAS architecture and an immutable, HMAC-signed audit trail extend coverage across coalition and disconnected edge environments.
NIST SP 800-171
Protecting CUI in nonfederal systems
AI-powered classification auto-labels CUI categories at ingestion and maps them directly to NIST 800-171 controls.
ITAR / EAR
Export-controlled technical data
Geofencing and RBAC/ABAC policy enforcement restrict decryption by jurisdiction, live, at the moment of access.
NERC CIP / IEC 62443
OT/ICS telemetry and plant-floor access
Edge telemetry encryption at ingestion plus policy-gated ICS/SCADA access, without disrupting real-time control loops.
HIPAA / HITECH
PHI confidentiality and access audit
Object-level encryption plus an immutable, HMAC-signed log of every PHI access and decryption event.
GDPR
Data subject rights and cross-border transfer
Automated DSAR fulfillment locates and exports records tied to a data subject; customer-managed keys travel with the data across any cloud.
CRA (Cyber Resilience Act)
Security-by-design, vulnerability handling, and update obligations
Dynamic, policy-based key rotation with time-limited expiring access, plus real-time encryption usage and access logs organizations can use as CRA compliance documentation.
FIPS 140-2/3
Validated cryptographic modules
AES-256-GCM object-level encryption, paired with NIST-selected post-quantum algorithms for long-lived data.
FAQ
Compliance, mapped to plain answers.
Where can I find XQ's control-by-control compliance mapping?
The matrix above maps each framework to the specific XQ platform capability that satisfies it. For a deeper control-by-control breakdown of a specific framework, start with the linked solution or the CMMC 2.0 Data Protection Guide in Resources.
Which cryptographic standards does XQ's encryption meet?
XQ encrypts every object with AES-256-GCM, and pairs it with NIST-selected post-quantum algorithms, including Dilithium, to protect long-lived sensitive data against harvest-now-decrypt-later attacks.
Has AWS validated XQ for zero trust in government?
Yes. AWS validated XQ for the Data pillar of AWS ZTAG-I (Zero Trust Accelerator for Government – Integrated), AWS’s reference zero trust architecture for the US federal government. In the combined solution, AWS encrypts stored data while XQ adds encryption for sensitive information and communications, monitors data access, enforces encryption policies and assesses access risk.
Does using XQ make us compliant on its own?
No single product makes an organization compliant. XQ provides the data-layer controls auditors ask about — object-level encryption, key custody, access policy evaluated at decryption and an immutable, HMAC-signed audit trail — plus the evidence they produce, alongside your existing network, system and procedural controls.
Need a compliance packet for procurement?
Talk to our team for framework-specific documentation, architecture diagrams, and attestation support.