Compliance on

Chainguard VMs compliance features

Thu, 20 Nov 2025 08:04:00 +0000

Chainguard VMs provide pre-hardened, audit-ready Linux virtual machine images designed for regulated and high-assurance environments (federal, defense, healthcare, financial services, and suppliers to those sectors). These images combine the following features:

Feature	Description
FIPS 140-3 validated cryptography	NIST CMVP-validated software modules and SP 800-90B compliant entropy, with runtime guardrails blocking non-FIPS crypto.
STIG hardening	Pre-configured to DISA STIG controls, delivered as production-ready images.
CIS benchmark compliance	CIS Level 1 hardened variants, hybrid STIG + CIS baseline.
Secure Boot	Secure Boot enabled by default across AWS, Azure, GCP, and on-prem.
Compliance evidence & reporting	FIPS certificates, OpenSSL docs, Security Content Automation Protocol (SCAP) scan results, and POA&M-ready artifacts.
CVE remediation SLA	7 days for critical CVEs, 14 days for high, medium, and low.

Chainguard FIPS 140-3 validated and hardened VM images serve as ready-to-use replacements for standard operating systems across AWS, Azure, and GCP, allowing organizations to maintain existing infrastructure and workflows while achieving immediate compliance. This guide outlines the compliance features of Chainguard VMs and how they can help reduce engineering toil for your organization.

SLSA compliance at Chainguard

Wed, 23 Jul 2025 01:24:23 +0000

SLSA (pronounced “salsa”), or Supply chain Levels for Software Artifacts, is a security framework consisting of standards and controls that prevent tampering, improve integrity, and secure packages and infrastructure. It is described in depth in What is SLSA?.

All Chainguard products — including Chainguard Containers, Guarded VMs, and Chainguard Libraries — are SLSA Level 3 compliant to provide confidence in the security of these products.

This page describes what we have done to bring Chainguard products into full SLSA Level 3 compliance.

PCI DSS at Chainguard

Wed, 21 Aug 2024 14:05:09 +0000

Compliance with PCI DSS 4.0, or Payment Card Industry Data Security Standard, requires adherence to strong security standards. Rigorous requirements must be met in order to secure your networks, systems, storage, and access according to the guidelines.

Chainguard doesn’t build images specifically for PCI DSS, but our images can help you meet the requirements in many ways, easing your burden in the process of achieving compliance. Securing your software supply chain provides a solid foundation for minimizing vulnerabilities.

CMMC at Chainguard

Fri, 09 Aug 2024 19:10:09 +0000

Achieving Cybersecurity Maturity Model Certification (CMMC) 2.0 Level 2 or Level 3 certification can be a complex and resource-intensive process, particularly for organizations managing containerized environments and addressing vulnerabilities. Chainguard simplifies this journey by offering specialized solutions that drastically reduce the time and effort needed to meet compliance requirements. Our FIPS-compliant Federal Information Processing Standard images, combined with detailed SBOM (Software Bill of Materials) and STIG-hardened (Security Technical Implementation Guide) configurations, provide a strong foundation for meeting the requirements of CMMC 2.0.