Commercial Deployment Security Policies

This guide outlines the security processes and standards required for applications deployed in Second Front's commercial environment. Although the commercial environment is outside formal Authorization to Operate (ATO) and FedRAMP boundaries, the goal is to uphold the same rigorous security practices used in Department of War (DOW) environments, including:

• Body of Evidence (BoE)
• CVE Management
• External Data Connections (EDCs)
• Authorization Boundary Diagram (ABD)
• Image Hardening
• DAST & SAST Requirements

---

Body of Evidence (BoE)

Complete a Body of Evidence (BoE) for every application in the 2F platform. You may omit the following sections:

• Role Identification
• Information Security Plan
• CAC Personnel
• Secure Software Development Framework (SSDF) Attestation
• Software Approval Recommendation Memo

---

CVE management

All applications must meet Second Front's Acceptance Baseline Criteria for vulnerabilities (CVEs):

• You must remediate all CVE vulnerabilities. When remediation is impossible, submit a written justification or mitigation plan with a proposed timeline.
• Second Front's security team must review and approve justifications before deployment to development or production.
• If you cannot remediate a Critical or High CVE, the security team must sign a risk acceptance memo before deployment.

---

External Data Connections (EDCs)

You must document all external data connections in the BoE and include them in the Authorization Boundary Diagram. Second Front's security team must review and approve each EDC before you use it in the application.

---

Authorization Boundary Diagram (ABD)

An Authorization Boundary Diagram visually maps your system's components, data flows, and security boundaries. It ensures your system integrates securely with Game Warden and meets DOW deployment standards.

All customers must submit an Authorization Boundary Diagram to meet DOW deployment standards. This diagram should include:

• All containers
• Communication flows
• Ports and protocols
• External data connections

For submission requirements, see Authorization Boundary Diagram.

---

Image hardening

Second Front engineers harden all container images using Game Warden's official image hardening scripts. The security team verifies this process as part of the security review. Only hardened images qualify for promotion to staging or production environments.

---

DAST and SAST requirements

---

FAQs

How do I get started?

Create an account at https://login.secondfront.com/. When prompted, register your organization and add users.

Can I deploy to cloud regions other than AWS US East (us-east-1)?

Currently, no. However, you may submit region requests to the product team for future consideration.

Do I need to complete a BoE?

Yes. While some DOW-specific sections are optional, the majority of the BoE must be completed before deploying to production.

Will my app be reviewed for security before going live?

Yes. All production deployments require a security review, even in the commercial environment.

Is this a FedRAMP-authorized environment?

No. The commercial environment is separate from FedRAMP and ATO boundaries, though it mimics IL2/IL4 practices for development and security posture.

---

Second Front maintains strong security practices across all deployment environments. Adhering to the policies in this document ensures your applications are production-ready, defensible, and aligned with federal cybersecurity expectations—even without a formal government authorization boundary.

Got a question? Submit a support ticket today!