ARC-AMPE (CMS EDE)
Jun 30 2027 · last business day
DE-Entity baseline · 308 controls
254/30882%
median 9d · oldest 141d
0 crit3 high11 mod22 low
ISCM annual package
Demo tenant · Meridian Health Plan · FY26 program cycle
Compliance command center
608/764
controls evidenced · 80%
SEALED2550ba9a · 2026-08-05
composed 2026-08-05 13:00 UTC · fixture data
123 open findings · 4 programs
Human gate · review required
3 decisions awaiting human review
Agent-prepared writes stay parked until a person reviews the source change and releases the record. This read-only demo fixture does not open or approve a live decision.
Example held record · fixture
- Plan
- pci-segmentation-rule-diff
- Target
- edge firewalls · 12 policies
- Candidate record
- sha256:1e8c47f0
Program posture
4 programs · 764 controls in scope
PCI DSS v4.0.1
Nov 9 2026
Full ROC scope · 264 requirements
206/26478%
median 17d · oldest 109d
1 crit6 high14 mod9 low
QSA onsite (ROC)
HITRUST r2
Oct 14 2026
r2 validated scope · 156 control specs
115/15674%
median 23d · oldest 98d
0 crit9 high21 mod17 low
Interim assessment
SOC 2 Type II
Dec 31 2026
TSC Security + Availability · 36 criteria
33/3692%
median 5d · oldest 195d
0 crit1 high3 mod6 low
Observation window closes
| Program | Controls evidenced | Evidence freshness | Open findings | Next regulatory gate |
|---|---|---|---|---|
ARC-AMPE (CMS EDE) DE-Entity baseline · 308 controls ISCM active · Year 2 | 254/30882% | median 9d oldest artifact 141d | 0 crit3 high11 mod22 low | ISCM annual package Jun 30 2027 · last business day |
PCI DSS v4.0.1 Full ROC scope · 264 requirements First ROC cycle | 206/26478% | median 17d oldest artifact 109d | 1 crit6 high14 mod9 low | QSA onsite (ROC) Nov 9 2026 |
HITRUST r2 r2 validated scope · 156 control specs Interim assessment scheduled | 115/15674% | median 23d oldest artifact 98d | 0 crit9 high21 mod17 low | Interim assessment Oct 14 2026 |
SOC 2 Type II TSC Security + Availability · 36 criteria Observation window open | 33/3692% | median 5d oldest artifact 195d | 0 crit1 high3 mod6 low | Observation window closes Dec 31 2026 |
Deadline horizon
Regulated calendar · Aug 2026 – Jul 2027
Scheduled runs
Next 7 days · results seal to the chain · held writes await a reviewer
| Plan | Target | Cadence | Last result | Next fire |
|---|---|---|---|---|
| evidence-freshness-sweep | All programs · 764 controls | daily 06:00 UTC | pass · 4m 12ssha256:a91f20c4 | Aug 06 · 06:00 UTC |
| ampe-monthly-vuln-scan | prod-vpc · 114 hosts | monthly · first week | pass · 38m 05ssha256:7c03e9b2 | Aug 07 · 02:00 UTC |
| soc2-change-mgmt-sample | github/meridian · 42 repos | weekly | pass · 6m 41ssha256:f2b8d716 | Aug 08 · 05:00 UTC |
| pci-asv-external-scan | edge CIDR 203.0.113.0/24 | quarterly | pass · 1h 52msha256:04d7a1ce | Aug 09 · 01:00 UTC |
| access-review-delta | Okta · 1,284 identities | weekly | pass · 11m 09ssha256:9e51cc08 | Aug 10 · 05:30 UTC |
| poam-assembly-dry-run | ARC-AMPE · Q3 POA&M | gate − 21 days | pass · 3m 58ssha256:6b7fe4d9 | Aug 10 · 09:00 UTC |
| hitrust-interim-gap-diff | r2 scope · 156 control specs | weekly | pass · 9m 22ssha256:d248ab53 | Aug 11 · 05:00 UTC |
| pci-segmentation-rule-diff | edge firewalls · 12 policies | weekly | held · awaiting reviewersha256:1e8c47f0 | Aug 11 · 04:00 UTC |