Platform component
Alchemi Compliance Enclave (ACE)
A governed environment for controlled unclassified information, built on infrastructure that inherits a documented set of controls rather than reimplementing them.
For an adjacent operational perspective, read more explains the topic in a practical workplace context.
For an independent reference point, see OWASP Top Ten.
What it is
A place for covered information to live
An environment scoped to controlled unclassified information, built on infrastructure whose controls are documented and inherited rather than reimplemented for each customer.
The point of an enclave is that the boundary is small and stateable. Everything inside is in scope and everything outside is not, and both halves of that are defensible to an assessor.
What it does not do
An enclave is not the whole requirement
It addresses the systems inside it. It does not address the machine on the floor, the engineer's laptop, or the file somebody emailed to a supplier last March.
Vendors who present an enclave as certification are selling a component as a programme. It is a substantial component.
An enclave can reduce the systems in scope and support inherited controls, but no specific authorisation, certification or inherited control set is claimed in this static edition.
Elsewhere
The other components
AXE
Alchemi Execution Environment
Control over what runs, where, and against which files, applied at the machine on the shop floor rather than at the network edge.
Also
ShieldCRS
Detection of insider activity: who touched which file, when, and whether that pattern is consistent with the work they do.