Truenote's security controls are mapped to, and self-assessed against, the NIST SP 800-53 Rev. 5 Moderate baseline, as of October 11, 2026. Open items are tracked in a plan of action and milestones with dated milestones.
This is a self-assessment by the system owner. It is not an assessment by an independent assessor, and it is not an authorization. NIST does not certify systems against a baseline, so Truenote makes no certification or compliance claim.
What is public and what is not
The summaries below describe what each document covers and where it stands. They leave out details that would help someone attack the service: individual weaknesses, their locations and their remediation dates.
The detailed documents are the full system security plan, the plan of action and milestones, the assessment results, the vulnerability management program, the policies and procedures, and the PCI DSS readiness analysis. They are not published on this site or in its source repository. Authorized reviewers can read them after signing in.
Standards used
- NIST SP 800-53 Rev. 5 (controls) and SP 800-53B (Moderate baseline, 287 controls and enhancements)
- NIST SP 800-53A Rev. 5 (assessment procedures)
- NIST SP 800-37 Rev. 2 (risk management framework) and SP 800-18 Rev. 2 (system security plan structure)
- PCI DSS v4.0.1, for the scope analysis and the service provider readiness self-assessment
Public summaries
- PCI DSS scope summaryWhether Truenote touches payment card data, when a customer's assessment may include it, and what Truenote has prepared.
- Plan of action and milestones summaryHow Truenote tracks its open security items, how they are rated and approved, and how many are open, without the item details.
- Secure development and change control summaryHow a change reaches Truenote production, and which checks it must pass on the way.
- System security plan summaryWhat Truenote is, where it runs, how it is categorized, and how its controls map to the NIST SP 800-53 Rev. 5 Moderate baseline.
- Vulnerability management summaryWhat Truenote scans, how often, and how quickly findings are fixed.
Detailed documents
The full system security plan, the plan of action and milestones, and assessment results describe specific security weaknesses. They are not published here. Authorized reviewers can read them after signing in to Truenote.