Skip to content

Elastic Dashboard: Compliance and Regulatory Posture

Maps observed cryptographic behavior directly to CNSA 2.0, FIPS, and related regulatory requirements, producing audit-ready evidence instead of manual compliance spreadsheets.

See Dashboards Overview for shared conventions, color palette, and data source details.

Purpose

Federal and regulated enterprise environments are subject to specific cryptographic standards, and at fleet scale the only realistic way to produce compliance evidence is to generate it automatically from observed network behavior. This dashboard exists to turn the sniffer's connection-level captures into posture reports that map directly to the frameworks a TYCHON customer is typically accountable to:

  • NSA CNSA 2.0 — requires ML-KEM-768/1024 for key establishment, ML-DSA for signatures, and TLS 1.3 as the minimum protocol version for National Security Systems.
  • NIST SP 800-208 / FIPS 203, 204, 205 — standardize ML-KEM, ML-DSA, and SLH-DSA as the approved PQC algorithms.
  • CMMC Level 2/3 — incorporates NIST SP 800-171/800-172 strong-encryption controls, with PQC migration increasingly expected.
  • OMB M-23-02 — requires federal agencies to complete crypto inventory and begin PQC migration planning against specific milestones.

This dashboard tracks compliance posture (what's actually on the wire right now) — it does not track OMB M-23-02 milestone schedules directly.

Panels

Panel Type What It Shows
CNSA 2.0 Compliance Rate KPI Percentage of connections meeting the dashboard's CNSA 2.0 definition (pqc.quantum_safety: "Secure" AND tls.version_protocol: "TLSv1.3").
Deprecated Protocol Violations KPI Count of connections using tls.version_protocol of TLSv1.0, TLSv1.1, or SSLv3 — an immediate, unambiguous compliance violation indicator.
FIPS-Approved Cipher Rate KPI Percentage of connections using a FIPS 140-3 approved TLS 1.3 cipher (TLS_AES_128_GCM_SHA256, TLS_AES_256_GCM_SHA384, TLS_CHACHA20_POLY1305_SHA256).
TLS Version Compliance Distribution Donut chart tls.version_protocol breakdown across all connections, colored from compliant (TLS 1.3, green) to violation (TLS 1.0/SSLv3, red).
Compliance Trend Over Time Line chart CNSA 2.0 compliance rate over the last 90 days, with reference lines at 50% ("Interim Target") and 80% ("Full CNSA 2.0 Target") — evidence of continuous improvement for auditors.
Non-Compliant Connection Inventory Data table Most recent 100 connections failing compliance (Vulnerable OR TLS 1.0/1.1), sorted newest first, with full context. CSV-exportable.
Compliance by Destination Port Stacked bar chart Top 15 destination ports, split into compliant vs. non-compliant connection counts — identifies which services or enclaves have the worst posture.
Cipher Compliance Breakdown Horizontal bar chart Top 20 tls.cipher values, categorized as FIPS-approved (green), deprecated (red — RC4, DES, NULL, EXPORT, 3DES), or other (yellow).

Data Schema

Field Description
pqc.quantum_safety Combined with tls.version_protocol to define CNSA 2.0 compliance; also drives the Non-Compliant Connection Inventory filter.
tls.version_protocol Drives the CNSA 2.0 Compliance Rate, Deprecated Protocol Violations, TLS Version Compliance Distribution, and Compliance Trend panels.
tls.cipher Drives the FIPS-Approved Cipher Rate and Cipher Compliance Breakdown panels.
pqc.assessment.remediation_priority Appears as a column in the Non-Compliant Connection Inventory table.
destination.port Drives the Compliance by Destination Port panel.
source.ip / destination.ip Appear as columns in the Non-Compliant Connection Inventory table for identifying specific offending connections.
@timestamp Drives the Compliance Trend chart and sorts the Non-Compliant Connection Inventory table.

Compliance Definitions Used on This Dashboard

These are the dashboard's built-in definitions — they represent a strict common baseline and may need adjusting to match your organization's specific compliance policy:

Term Definition
CNSA 2.0 Compliant pqc.quantum_safety: "Secure" AND tls.version_protocol: "TLSv1.3"
Deprecated Protocol Violation tls.version_protocol in TLSv1.0, TLSv1.1, or SSLv3
FIPS-Approved Cipher TLS_AES_128_GCM_SHA256, TLS_AES_256_GCM_SHA384, or TLS_CHACHA20_POLY1305_SHA256
Non-Compliant pqc.quantum_safety: "Vulnerable" OR tls.version_protocol in TLSv1.0/TLSv1.1

Reading the Dashboard

  • Compliance rate KPIs are computed over the full dataset, not a sample — they're safe to cite directly in audit evidence packages.
  • The Non-Compliant Connection Inventory table is a triage view, not the full audit record. It shows the most recent 100 violations. For complete enumeration across a large fleet, use the CSV export or a scheduled Elasticsearch reporting job rather than relying on the on-screen table alone.
  • Deprecated Protocol Violations should be treated as a hard zero target. Unlike the Vulnerable KPI (which can have a phased remediation plan), any nonzero TLS 1.0/1.1/SSLv3 usage is a direct, immediate compliance violation with no ambiguity.

Back to Elastic Dashboards Overview