Stratus GRCITSM Marketplace
Copyright 2026 Stratus Cyber LLC

This product's code, prompts, and documentation are licensed under the
Apache License, Version 2.0 (see LICENSE).

Vendored government reference corpora
-------------------------------------

The following directories contain reference material produced by the
United States Government, redistributed unmodified for use by the
plugin's compliance lookups. Works of the US Government are generally
not subject to domestic copyright (17 U.S.C. § 105). They are NOT
covered by this product's Apache-2.0 grant and retain their own status:

  plugins/grcitsm-analyst/reference-docs/fedramp-rules/
      FedRAMP Consolidated Rules (FedRAMP PMO / GSA)
  plugins/grcitsm-analyst/reference-docs/fedramp-2026-markdown/
      FedRAMP 2026 narrative documentation (FedRAMP PMO / GSA)
  plugins/grcitsm-analyst/reference-docs/fedramp-rev5/
      FedRAMP Rev5 baselines (FedRAMP PMO / GSA; derived from NIST SP 800-53)
  plugins/grcitsm-analyst/reference-docs/fedramp-schemas/
      FedRAMP machine-readable submission schemas (FedRAMP PMO / GSA)
  plugins/grcitsm-analyst/reference-docs/cmmc/
      CMMC practice reference (US Department of Defense; derived from
      NIST SP 800-171 and SP 800-172)

Per-directory provenance notes (source, retrieval date, refresh
procedure) live in each directory's VENDORED.md where present.
