Compliance as Infrastructure™

Most CMMC work is writing about your systems and hoping an assessor agrees. We take the opposite approach: we make compliance a property of the systems themselves: hardened by default, verified by machine, and documented from the system's real state rather than authored on the side.

Build the system right, and the compliance follows.

Video series

Compliance as Infrastructure™, on video

Short episodes working through the model on this page, one idea at a time.

  1. Watch on YouTube

  2. Watch on YouTube

Players load from youtube-nocookie.com only when you press play. All episodes on YouTube.

The problem nobody says out loud

Compliance feels like a paperwork problem. It isn't. It's a knowledge problem wearing paperwork's clothes.

Behind every requirement sit four layers that almost no one connects end to end: what the framework says you must do, how that requirement is actually measured, which controls satisfy it, and the specific registry keys, configuration files, and API states that prove the control is real. The framework works top-down. Your systems work bottom-up. The gap in the middle is where compliance projects go to die, and it is why this work has always demanded expensive consultants who carry the mapping around in their heads.

So you assemble evidence by hand, across every operating system and cloud service you run, for 110 requirements and their hundreds of underlying objectives. Then you hand it to an assessor who, through no fault of their own, cannot fully see a modern environment in the time they have, and falls back on a mental template of how things "should" look. Correct-but-unfamiliar setups get dinged. Familiar-but-weak ones pass. You are not bad at compliance. The model is broken.

A different model

Archstone's Rosetta platform inverts the usual order. Instead of building a system and then writing documents that argue it is compliant, we build the system right first, hardened to a defensible baseline, and treat compliance as something computed from the system's actual state, not authored after the fact.

The configuration is the definition. The scan result is the source of truth. When the system changes, the evidence changes with it. Compliance stops being a project you survive every few years and becomes a property of the infrastructure you run every day. That is the whole idea: make the system the evidence.

What Compliance as Infrastructure means Four stacked layers from framework requirement down to live system state. The old way authors compliance claims top-down and stops short of real system state; Compliance as Infrastructure computes evidence bottom-up from the live system scan. Framework requirement what you must satisfy Assessment objective how it is measured Security control what you configure System state: live scan the source of truth the old way claims written top-down, never meeting reality Compliance as Infrastructure™ evidence computed bottom-up
Verified system state drives compliance upward, instead of documentation pushing down.

How it works

  • Start from hardened images. Your endpoints and servers deploy from images hardened to an industry baseline (CIS Level 2) plus Rosetta's own opinionated extensions: the configuration choices that make the result genuinely defensible, not just "passes a checklist."
  • Verify continuously, by machine. Every control is checked by an automated, machine-readable scan, not a human attestation. If a setting drifts, you see it. The scan result is authoritative. We would rather fail loudly than pass quietly.
  • Map all four layers. Rosetta connects each system setting up through the controls, the assessment objectives, and the framework requirement it satisfies. It is an explicit, traceable thread from "this setting is configured" to "this 800-171 objective is met."
  • Documentation from the same source of truth. Because the system's real state drives everything, your compliance artifacts are designed to be generated from the evidence that runs your machines, not maintained as a separate, ever-stale parallel universe.

Why this beats the alternatives

  • Versus a compliance consultant: their knowledge lives in one person's head and walks out the door when the engagement ends. Rosetta's lives in your infrastructure and stays.
  • Versus a checklist / GRC tool: those track what you claim. Rosetta verifies what your systems actually do, down to the setting, and shows its work.
  • Versus a point-in-time audit: a passing assessment is a photograph. Rosetta is the live feed: evidence stays current because it is generated from running systems.

No proprietary black box, either: the foundations are open standards and open source (CIS, Wazuh, OSCAL). You can read every check. The value is not lock-in. It is a security posture built on infrastructure that is genuinely better.

Built for the DIB, on purpose

Rosetta is focused on the organizations getting squeezed hardest: small and mid-size defense contractors facing CMMC Level 2 and NIST SP 800-171 with a fraction of the security staff the primes have. You don't need a bigger compliance team. You need systems that arrive compliant and prove it on their own.


Talk to us about your Level 2 path

Compliance as Infrastructure™ is a trademark of Archstone Security LLC.