# Assurance Continuum **Entity class:** Comparative security model ## Definition The **assurance continuum** maps progressively specialized trust requirements from ordinary commercial controls through regulated and federal civilian systems to defense and intelligence environments. The systems share primitives—identity, access control, cryptography, monitoring, audit, provenance, and risk acceptance—while differing in threat model, authority, classification, compartmentation, parameters, and consequences. It is a continuum of compatible building blocks, not a claim that SOC 2, NIST controls, DoD impact levels, and IC authorization are equivalent. ## Relationships - **commercial layer:** [[wiki/SOC 2 and the Trust Services Criteria|SOC 2]]. - **federal foundation:** [[wiki/NIST SP 800-53|NIST SP 800-53]] and [[wiki/Risk Management Framework|RMF]]. - **national-security layer:** [[wiki/CNSSI 1253|CNSSI 1253]] and [[wiki/ICD 503|ICD 503]]. - **cross-domain mechanism:** [[wiki/Machine-Readable Assurance|Machine-Readable Assurance]]. ## Sources / Provenance - [NIST — Unified framework announcement, June 16, 2009](https://www.nist.gov/news-events/news/2009/06/nist-dod-intelligence-agencies-join-forces-secure-us-cyber-infrastructure) - [AICPA — SOC suite](https://www.aicpa-cima.com/topic/audit-assurance/audit-and-assurance-greater-than-soc-2)