Shared Responsibility

GovConHouse is a toolbox for your compliance program. It is not your compliance program, and it is not a certification authority.

What stays yours

• Your certifications. Scores, control states, evidence, and exports produced by the platform are material for your own assessments. They are not certifications GovConHouse holds on your behalf.
• Your determinations. Classification labels, control-implementation assertions, and risk decisions are yours to make and defend to your assessor.
• Your flow-downs. Obligations that flow down to your subcontractors and suppliers are yours to pass down. The platform does not sign flow-downs for you.
• Your submissions. SPRS scores, CMMC evidence, and FedRAMP OSCAL exports are yours to validate before submitting to the government or an assessor.

What the platform does

• Runs the tools that compute outputs from your inputs: SPRS scoring per the DoD methodology, CMMC control-state tracking, FAR/DFARS clause checking against a real clause catalog, and FedRAMP OSCAL export.
• Keeps your company’s data isolated from other tenants.
• Processes data through its own service providers under your agreement with GovConHouse. See Subprocessors.