Zero Trust Posture

Ariana Nexus operates at the intersection of healthcare, artificial intelligence, government, and research, where a single unauthorized access event can compromise patient safety, national security, model integrity, or the physical safety of the Afghan diaspora scholars the firm serves. The firm has adopted zero trust as the foundational governance model for its systems, data, and operations. Zero trust is not a product or a feature. It is an operating discipline: assume breach, verify explicitly, enforce least privilege, and inspect continuously.

This document states that posture. It describes the controls the firm operates today, the frameworks its design is aligned to, and the maturity path it is following. It is a posture statement. Alignment to a framework is a statement of consistency with that framework; it is not a certification, and this document asserts none except where a control is stated to be implemented and operational.

Contents

• 1. Scope and applicability
• 2. Principles
• 3. Control planes
• 4. Identity and access
• 5. Device and endpoint management
• 6. Email and collaboration protection
• 7. Data classification and loss prevention
• 8. Framework alignment
• 9. Application by sector
• 10. Maturity roadmap
• 11. What this means for evaluators
• 12. Limitations, disclaimers, and liability
• 13. Version history

1. Scope and applicability

This document governs the identity, access, and data-handling controls Ariana Nexus applies across every engagement and all four sectors it serves: Healthcare Systems, Government and Public Sector, AI and Data Systems, and Research, Education and Institutional Partnerships. It applies to the firm's personnel, its contracted experts, and the platform services the firm operates.

Ariana Nexus is a Delaware limited liability company headquartered in Washington, D.C., with primary operations in Virginia and offices planned in London and Berlin. It maintains no operations inside Afghanistan and no office in Kabul, a deliberate legal-protection posture that bounds where data is handled. Controlled Unclassified Information, where processed, is handled within the United States.

This document describes a zero-trust operating discipline. Where it states that a control is implemented, that control is deployed and operational. Where it states alignment to a framework, the firm has designed its controls in accordance with that framework but has not undergone third-party certification against it unless expressly noted. Alignment is not certification.

2. Principles

The firm's architecture rests on four principles, consistent with NIST Special Publication 800-207 and the widely used formulation of zero trust. Every connection is untrusted until verified. Every device is unmanaged until enrolled. Every request is unauthorized until validated. Every session is monitored until terminated.

2.1 Verify explicitly

Every access request is authenticated and authorized on all available signals: identity, location, device health, workload, data classification, and anomaly detection. Access is never granted on network location alone. A user on the office network receives the same scrutiny as a user connecting from another country.

2.2 Least privilege

Access is granted on a just-enough and just-in-time basis. No user holds standing administrative access to production systems. Privileged roles are assigned through time-limited elevation with approval, and access reviews keep permissions matched to current function rather than historical accumulation.

2.3 Assume breach

The architecture is designed on the assumption that any component may already be compromised. That assumption drives segmentation, encryption, continuous monitoring, and automated response. The objective is not to prevent every breach, which no organization can guarantee, but to minimize blast radius, detect compromise quickly, and contain its reach.

2.4 Inspect continuously

Authentication and authorization are enforced per session and re-evaluated. Access events, authentication attempts, policy violations, and anomalous behaviors are logged and analyzed.

3. Control planes

The firm implements zero trust across six control planes, aligned with the NIST SP 800-207 architecture and the CISA Zero Trust Maturity Model.

The controls below are deployed within the Microsoft 365 Business Premium environment, which provides an integrated security stack for zero-trust enforcement across identity, endpoint, email, and data protection rather than a set of separate point tools.

4. Identity and access

Identity is the primary control plane. Access is governed through Microsoft Entra ID, the central identity plane for all organizational access. The following are enforced.

• Multi-factor authentication is required for all users, all devices, and all access scenarios, without exception. A password alone is never sufficient for access to any firm system.
• Conditional access policies evaluate each sign-in in real time against user identity and role, device compliance status, location and address reputation, sign-in risk, and application sensitivity. Sign-ins from untrusted locations, non-compliant devices, or anomalous patterns are blocked or escalated to step-up authentication.
• Role-based access control grants each user only the minimum permissions their function requires. Access is reviewed periodically and dormant accounts are disabled.
• Sessions are time-limited, expire automatically, and require re-authentication for sensitive operations.

5. Device and endpoint management

Devices are managed through Microsoft Intune, and endpoint compliance is a precondition of access rather than an assumption made after it.

• Enrollment is mandatory for every device that accesses firm systems, whether corporate or personal.
• Compliance policies require disk encryption, current operating-system and security patches, active anti-malware protection, screen lock with PIN or biometric authentication, and a device that is not jailbroken or rooted.
• Compliance status is linked to conditional access: non-compliant devices are blocked from email, file storage, collaboration, and all Microsoft 365 services until remediated.
• Remote wipe is available for lost, stolen, or compromised devices, and application-protection policies prevent movement of organizational data into unmanaged applications on mobile devices.

6. Email and collaboration protection

The primary communication surface is protected by Microsoft Defender for Office 365.

• Safe Attachments scans email attachments in a detonation sandbox before delivery.
• Safe Links rewrites and inspects URLs in email and documents at time of click, protecting against phishing, credential harvesting, and malware.
• Anti-phishing policies detect impersonation, domain spoofing, and business email compromise targeting firm personnel.
• Anti-malware and anti-spam filtering apply multi-layered scanning to inbound and outbound traffic.

7. Data classification and loss prevention

Data is classified, labeled, and protected through Microsoft Purview across the Microsoft 365 environment.

• Sensitivity labels applied to documents, email, and data stores govern encryption, access restrictions, and visual markings.
• Data loss prevention policies monitor and control the movement of sensitive information across email, file storage, collaboration, and endpoints, and are configured to block unauthorized transmission of personally identifiable information, Protected Health Information, and other regulated categories.
• Information protection applies persistent encryption and access controls so that protection follows the data wherever it travels.
• Audit logging captures policy matches, label changes, and access events for compliance reporting and incident investigation.

Where an engagement involves Protected Health Information, a Business Associate Agreement is executed before any such data touches any platform. This precondition is absolute and applies regardless of sector or urgency.

8. Framework alignment

The firm's zero-trust architecture is designed in alignment with the frameworks below. The status column uses the defined terms that follow the table.

8.1 Status definitions

9. Application by sector

9.1 Healthcare

When the firm provides interpretation, translation, or cultural-competency services involving Protected Health Information, access to that information is limited to credentialed personnel operating under executed Business Associate Agreements, authenticated through multi-factor authentication, on compliant devices, and governed by data-loss-prevention policy. No Protected Health Information is accessible to any user, device, or application that has not passed every control plane.

9.2 Government

For engagements involving Controlled Unclassified Information, the firm applies the requirements of NIST SP 800-171 within its zero-trust framework. Such information is isolated in dedicated environments with restricted access, sensitivity labels enforcing encryption and marking, and data-loss-prevention rules preventing exfiltration. All processing of Controlled Unclassified Information occurs within the United States.

9.3 AI and data systems

The AI Data Factory processes linguistic, cultural, and annotation data for model training and validation. Access to training datasets, annotation pipelines, and quality-assurance outputs is governed by the same controls. Human reviewers are authenticated individually, their device posture is verified, and their access is scoped to only the data elements a specific task requires.

9.4 Research and education

Academic research collaborations involving sensitive data are governed by data-use agreements and enforced through the same controls. External collaborators receive limited, time-bound access through guest policies in Microsoft Entra ID, with multi-factor authentication required and device compliance assessed.

10. Maturity roadmap

The firm treats zero trust as a multi-year path. The phases below describe its planned maturation. Roadmap items are forward-looking and are governed by the roadmap qualifier in section 12; they are plans, not commitments.

11. What this means for evaluators

For procurement officers: the firm can demonstrate, through configuration evidence and audit logs, that access to your data is governed by identity verification, device compliance, and least-privilege policy rather than perimeter assumptions.

For chief information security officers and security teams: the architecture is built on a recognized enterprise platform with native integration across identity, endpoint, email, and data protection rather than a patchwork of point tools.

For compliance officers: alignment with NIST SP 800-207, the CISA Zero Trust Maturity Model, the HIPAA Security Rule, and NIST SP 800-171 provides documented evidence of control implementation that maps to audit requirements.

For government contracting officers: the roadmap to CMMC Level 2, SOC 2 Type II, and FedRAMP describes a planned and resourced path to the certifications required for government engagements.

12. Limitations, disclaimers, and liability

12.1 No guarantee of absolute security

The firm implements commercially reasonable security measures aligned with recognized frameworks. No security architecture, including zero trust, can guarantee absolute protection against all threats. The firm expressly disclaims any warranty or guarantee that its systems, networks, or data will be immune from unauthorized access, cyberattack, data breach, or other security incident.

12.2 Framework alignment is not certification

Where this document states that the firm is aligned with a framework, it means the firm has designed its controls in accordance with that framework's principles and requirements but has not undergone third-party certification or audit against it unless expressly stated otherwise. Where certifications appear on the roadmap, target dates are provided in good faith and are subject to change based on business priorities, auditor availability, and regulatory developments.

12.3 Roadmap items

The maturity roadmap reflects the firm's plans and intentions as of the effective date. Roadmap items are forward-looking statements and are not commitments, guarantees, or obligations. The firm reserves the right to modify, defer, or reprioritize roadmap items at its sole discretion. No client, partner, or third party may rely on roadmap items as binding commitments. Specific security obligations for a client engagement are defined exclusively in the applicable Engagement Agreement.

12.4 Third-party platform dependency

The firm's zero-trust implementation relies on the Microsoft 365 Business Premium platform and its component services, including Entra ID, Defender, Intune, and Purview. The firm does not control the development, availability, security, or functionality of that platform and expressly disclaims liability for any security incident, service interruption, vulnerability, or data breach attributable to it or to any other third-party service.

12.5 Limitation of liability

To the maximum extent permitted by applicable law, the firm's total aggregate liability for all claims arising out of or related to the security architecture described in this document shall not exceed the amounts set forth in the applicable Engagement Agreement, or, where no Engagement Agreement exists, one hundred dollars (100 USD). The firm shall not be liable for any indirect, incidental, special, consequential, punitive, or exemplary damages arising from or related to any security incident, regardless of the theory of liability. Nothing in this section limits or excludes the firm's liability for fraud or fraudulent misrepresentation; for death or personal injury caused by negligence; or for any other liability that cannot be excluded or limited under applicable law, including under the UK Unfair Contract Terms Act 1977, the UK Consumer Rights Act 2015, or the General Data Protection Regulation.

12.6 Dispute resolution

Any dispute arising out of or relating to the contents of this document is subject to the dispute-resolution provisions of the Terms of Use, section 18.

13. Version history

Related documents in this register: Identity and Access Governance, Data Protection and Classification, Encryption and Key Management, Threat Monitoring and Response, and Incident Response and Resilience.

Evaluators requiring supporting documentation, configuration evidence, or a security architecture briefing may submit a formal inquiry. Observations regarding this register are reviewed by the firm.