scuttle/profiles/government.profile.toml

35 lines
1.1 KiB
TOML
Executable File

# Government profile — FIPS-mode, per-policy, every-pass verify.
[meta]
name = "Government"
version = 1
description = "Federal / regulated: FIPS-mode operation with every-pass verification and signed PDF certificate. Uses FIPS-eligible PRNGs (AES-256-CTR, ChaCha20)."
nist_class = "purge"
audience = "Federal, FIPS-regulated workflows"
[defaults]
prng_pool = ["AES-256-CTR (CSPRNG)", "ChaCha20 (CSPRNG)"]
hash = "SHA-256"
verify = "every"
certificate = "both"
report = ["summary", "detailed", "compliance"]
[policy_map]
hdd_cmr = "hdd_overwrite"
hdd_smr = "hdd_overwrite"
ssd_sata = "ssd_purge_then_overwrite"
ssd_sas = "ssd_purge_then_overwrite"
ssd_usb = "ssd_purge_then_overwrite"
ssd_nvme = "nvme_sanitize_then_overwrite"
pmem = "pmem_crypto_erase"
mmc = "embedded_overwrite"
sd = "embedded_overwrite"
ufs = "embedded_overwrite"
virtual = "virtual_overwrite"
[constraints]
require_secure_erase_capable = false
abort_on_verify_failure = true
require_signed_certificate = true
minimum_passes = 3