https://wishknish.com/_nuxt/BV7bXKIi2.js

1import{r as e}from"./DpqVPqCK.js";var t={"supply-chain":{slug:`supply-chain`,seoTitle:`Supply Chain Provenance — Evidence for defense supply chains`,seoDescription:`NIST SP 800-171 and DFARS 252.204-7012 provenance for defense supply chains. Post-quantum-signed SBOM/HBOM and control evidence that survives adversarial assessment.`,breadcrumbLabel:`Supply Chain Provenance`,badge:`NIST SP 800-171 · DFARS 7012`,badgeClass:`border-wk-magenta/30 bg-wk-magenta/5 text-wk-magenta`,headingLead:`Cryptographic provenance for`,headingAccent:`defense supply chains.`,lede:`When an assessor asks you to prove a component’s origin and your CUI-handling controls across a multi-tier supplier base, can you produce evidence that survives adversarial review? Knish.IO signs SBOM/HBOM provenance and control attestations at the source.`,overviewHeading:`What the substrate provides`,overviewIntro:`Defense suppliers must demonstrate component provenance and protection of Controlled Unclassified Information across every tier — and as of July 2026 the SBOM baseline itself asks for a hash per component and a signature over the document, not a bare list of ingredients. Knish.IO maps each requirement to a signed, append-only attestation produced at the moment work happens.`,capabilities:[{arrow:`text-wk-pink`,title:`SBOM / HBOM provenance`,note:`Signed bill-of-materials at every tier`},{arrow:`text-wk-magenta`,title:`NIST SP 800-171 evidence`,note:`Per-control attestation, append-only`},{arrow:`text-wk-purple`,title:`Multi-tier supplier coordination`,note:`Cross-organization evidence, no shared system`},{arrow:`text-wk-blue`,title:`Post-quantum signing`,note:`Survives multi-decade contract retention`},{arrow:`text-wk-cyan`,title:`Cell-isolated by program`,note:`Protocol-level separation per 

1contract`}],problemHeading:`What current supply-chain systems can’t produce`,gaps:[{title:`Provenance you can’t independently verify`,body:`Spreadsheets and PDFs of component origin can be edited after the fact. An assessor needs evidence that’s tamper-evident by construction, not by policy.`},{title:`Control attestation without proof`,body:`Self-attested scores and plans of action assert compliance. They don’t produce cryptographic evidence that the controls were actually in force at a given time.`},{title:`Trust that doesn’t cross org boundaries`,body:`A prime can’t verify a sub-tier supplier’s records without trusting that supplier’s systems. Evidence needs to be verifiable independent of who produced it.`}],framework:{heading:`NIST SP 800-171, DFARS 7012 & CMMC`,intro:`Covered contractors must protect Controlled Unclassified Information under NIST SP 800-171 Rev. 2, assessed against DFARS 252.204-7012 — obligations that are in force today and unaffected by the CMMC phase-in. CMMC ties contract eligibility to the same control set: Phase I self-assessment applies, while Phase II third-party Level 2 certification — scheduled for November 10, 2026 — was suspended by the Department of War in July 2026 pending a CMMC Reform Task Force review. The controls being assessed do not change with the schedule, which is why the evidence layer is worth building now rather than at certification. Provenance expectations are reinforced by software bill-of-materials guidance from Executive Order 14028.`,requirementsLabel:`What an assessment looks for`,requirements:[{num:`/01`,color:`text-wk-pink`,title:`Demonstrated control implementation`,desc:`Evidence the NIST SP 800-171 controls are in force — not just documented.`},{num:`/02`,color:`text-wk-magenta`,title:`Component provenance`,desc:`Traceable origin for hardware and software across supplier tiers.`},{num:`/03`,color:`text-wk-purple`,title:`Flow-down to subcontractors`,desc:`The same protections enforced down the supply chain.`},{num:`/04`,color:`text-wk-cyan`,title:`Retention through contract life`,desc:`Records preserved and verifiable for the full retention period.`}],note:`The SBOM baseline moved in July 2026: the CISA/NSA/FBI minimum elements replaced the NTIA 2021 list and now expect a component hash value and hash algorithm for every component, plus a digital signature attributable to the SBOM author and a record of the lifecycle phase the document was generated in. Those are custody fields rather than inventory fields. It is guidance rather than a rule (${e.citation}; verified ${e.verifiedOn}), but it is what a buyer now knows to ask for. Summary is interpretive — confirm scope and obligations with your DFARS / CMMC counsel and assessor.`},architecture:{heading:`How it sits in your supply chain`,intro:`Knish.IO sits beneath the tools your suppliers already use, signing each provenance and control event, and emits evidence your primes, assessors, and auditors can verify independently.`,operationalLabel:`Your supplier tooling`,operational:[{cat:`SBOM`,name:`SBOM generators`},{cat:`PLM`,name:`PLM systems`},{cat:`Security`,name:`SIEM / EDR`},{cat:`GRC`,name:`GRC platforms`}],verificationLabel:`Who reads the evidence`,verification:[{cat:`Primes`,name:`Prime contractors`},{cat:`Assessors`,name:`C3PAO / DIBCAC`},{cat:`Oversight`,name:`DCMA`},{cat:`Legal`,name:`e-Discovery`}]},stakes:{heading:`What’s at stake`,cards:[{kicker:`Contract eligibility`,color:`text-wk-magenta`,value:`No evidence, no award`,note:`DFARS 252.204-7012 conditions eligibility on demonstrated CUI protection, and CMMC ties certification to the same control set once Phase II resumes.`},{kicker:`False Claims Act`,color:`text-wk-pink`,value:`Treble damages`,gradient:!0,note:`Misrepresenting compliance can expose contractors to False Claims Act liability — including treble damages and penalties.`}],note:`Reference: DFARS 252.204-7012; NIST SP 800-171. Not legal advice — confirm exposure with your compliance counsel.`},related:[{kicker:`/01 · EU AI Act`,title:`AI Audit Trail`,desc:`Cryptographic evidence for AI-driven decisions under Article 12.`,to:`/solutions/ai-audit-trail`},{kicker:`/04 · Federal`,title:`Compliance Attestation`,desc:`Court-defensible evidence for federal funding & contractor compliance.`,to:`/solutions/compliance-attestation`}

1,{kicker:`/07 · Flagship`,title:`Resilient Infrastructure`,desc:`Multi-zone, multi-regime evidence at state scale.`,to:`/solutions/resilient-infrastructure`}]},"healthcare-consent":{slug:`healthcare-consent`,seoTitle:`Healthcare Consent — PHI-neutral consent attestation`,seoDescription:`HIPAA and HITECH-aligned consent attestation. Hash-only (PHI-neutral) evidence with cryptoshredding for erasure, across TPA, payer, and employer routes.`,breadcrumbLabel:`Healthcare Consent`,badge:`HIPAA · HITECH`,badgeClass:`border-wk-purple/30 bg-wk-purple/5 text-wk-purple`,headingLead:`Tamper-evident attestation for`,headingAccent:`patient consent.`,lede:`Consent is the hinge of every downstream disclosure — and the record most often disputed. Knish.IO attests consent events without putting protected health information on the chain, and supports cryptographic erasure when a record must be retired.`,overviewHeading:`What the substrate provides`,overviewIntro:`Consent records must be defensible without becoming a new PHI liability. Knish.IO signs a hash of each consent event — proving what was agreed, when, and by whom — while the PHI itself stays in your systems of record.`,capabilities:[{arrow:`text-wk-pink`,title:`Hash-only mode`,note:`No PHI on chain — only signed hashes`},{arrow:`text-wk-magenta`,title:`Cryptoshredding for erasure`,note:`Retire a record by destroying its key`},{arrow:`text-wk-purple`,title:`Append-only consent history`,note:`Grant, scope, and revocation, in order`},{arrow:`text-wk-blue`,title:`TPA / payer / employer routes`,note:`Cell-isolated per covered entity`},{arrow:`text-wk-cyan`,title:`Post-quantum signing`,note:`Verifiable across patient-lifetime retention`}],problemHeading:`What current consent systems can’t produce`,gaps:[{title:`Consent logs that can be back-dated`,body:`A consent timestamp in a mutable database can be changed. When a disclosure is challenged, "we have a record" is weaker than "the record is tamper-evident."`},{title:`Evidence that becomes a liability`,body:`Putting consent detail in a new ledger can create another store of regulated data. Evidence should prove the event without duplicating the PHI.`},{title:`Erasure vs. immutability`,body:`Append-only integrity seems to conflict with the right to have records retired. Cryptographic erasure resolves it: destroy the key, and the signed hash is permanently unreadable.`}],framework:{heading:`HIPAA & HITECH`,intro:`The HIPAA Privacy and Security Rules govern the use, disclosure, and protection of protected health information; HITECH strengthened enforcement and breach notification. Several states add a private right of action for individuals.`,requirementsLabel:`What the rules expect`,requirements:[{num:`/01`,color:`text-wk-pink`,title:`Valid authorization`,desc:`Disclosures beyond treatment, payment, and operations generally require documented patient authorization.`},{num:`/02`,color:`text-wk-magenta`,title:`Integrity of records`,desc:`Safeguards against improper alteration or destruction of electronic PHI.`},{num:`/03`,color:`text-wk-purple`,title:`Accounting of disclosures`,desc:`The ability to show what was disclosed, to whom, and on what basis.`},{num:`/04`,color:`text-wk-cyan`,title:`Breach notification`,desc:`Timely notification when unsecured PHI is compromised.`}],note:`Summary is interpretive — confirm obligations with your HIPAA privacy officer and counsel.`},architecture:{heading:`How it sits under your stack`,intro:`Knish.IO sits beside your EHR and consent-management tools, signing a hash of each consent event so the PHI never leaves your systems of record — and emits evidence auditors and regulators can verify.`,operationalLabel:`Your clinical & consent tooling`,operational:[{cat:`EHR`,name:`EHR systems`},{cat:`Consent`,name:`Consent management`},{cat:`Identity`,name:`Patient identity`},{cat:`Audit`,name:`Access logs`}],verificationLabel:`Who reads the evidence`,verification:[{cat:`Compliance`,name:`Privacy / HIM`},{cat:`Audit`,name:`External auditors`},{cat:`Legal`,name:`e-Discovery`},{cat:`Regulators`,name:`OCR inquiries`}]},stakes:{heading:`What’s at stake`,cards:[{kicker:`HITECH penalties`,color:`text-wk-purple`,value:`Tiered fines`,note:`Civil monetary penalties scale with culpability and the number of records affected.`},{kicker:`Private right of action`,color:`text-wk-pink`,value:`State litigation`,gradient:!0,note:`Several states let individuals sue directly over mishandled consent and disclosures — independent of federal enforcement.`}],note:`Reference: HIPAA Privacy & Security Rules; HITECH Act. Not legal advice — confirm with your compliance counsel.`},related:[{kicker:`/01 · EU AI Act`,title:`AI Audit Trail`,desc:`Cryptographic evidence for AI-driven decisions under Article 12.`,to:`/solutions/ai-audit-trail`},{kicker:`/02 · NIST 800-171`,title:`Supply Chain Provenance`,desc:`Post-quantum-signed evidence for defense supply chains.`,to:`/solutions/supply-chain`}

1,{kicker:`/07 · Flagship`,title:`Resilient Infrastructure`,desc:`Multi-zone, multi-regime evidence at state scale.`,to:`/solutions/resilient-infrastructure`}]},"compliance-attestation":{slug:`compliance-attestation`,seoTitle:`Compliance Attestation — Evidence for federal-grant compliance`,seoDescription:`Court-defensible attestation for federal funding and contractor compliance: Build America Buy America domestic content, Davis-Bacon prevailing wage, and OFCCP labor-standards obligations under IIJA and IRA funding.`,breadcrumbLabel:`Compliance Attestation`,badge:`IIJA · IRA · OFCCP`,badgeClass:`border-wk-blue/30 bg-wk-blue/5 text-wk-blue`,headingLead:`Court-defensible evidence for`,headingAccent:`federal-grant compliance.`,lede:`Federal infrastructure and clean-energy funding carries conditions — domestic content, prevailing wage, workforce — that are audited years after the work is done. Knish.IO signs compliance evidence as it happens, so the record isn’t reconstructed under audit pressure.`,overviewHeading:`What the substrate provides`,overviewIntro:`Grant and contract conditions are easy to assert and hard to prove later. Knish.IO turns each condition into a signed, append-only attestation captured at the point of performance.`,capabilities:[{arrow:`text-wk-pink`,title:`Domestic-content provenance`,note:`Build America Buy America evidence`},{arrow:`text-wk-magenta`,title:`Prevailing-wage records`,note:`Davis-Bacon certified payroll, signed`},{arrow:`text-wk-purple`,title:`Workforce & labor-standards attestation`,note:`OFCCP-relevant evidence, append-only`},{arrow:`text-wk-blue`,title:`Per-grant cell isolation`,note:`Protocol-level separation by award`},{arrow:`text-wk-cyan`,title:`Post-quantum signing`,note:`Verifiable across grant audit windows`}],problemHeading:`What current compliance systems can’t produce`,gaps:[{title:`Records assembled at audit time`,body:`When an auditor arrives, evidence is often reconstructed from scattered systems. Reconstruction invites disputes; contemporaneous signing avoids them.`},{title:`Attestation without backing`,body:`A signed certification asserts compliance. It doesn’t prove the underlying facts — domestic content, hours, wages — were what the certification claims.`},{title:`Conditions across many subrecipients`,body:`Pass-through entities must show subrecipients met the same conditions, without trusting each subrecipient’s spreadsheets.`}],framework:{heading:`Federal funding conditions`,intro:`Funding under the Infrastructure Investment and Jobs Act and the Inflation Reduction Act carries distinct statutory conditions — Build America Buy America domestic content, Davis-Bacon prevailing wage, and OFCCP labor-standards obligations for covered contractors.`,requirementsLabel:`What an audit looks for`,requirements:[{num:`/01`,color:`text-wk-pink`,title:`Domestic content`,desc:`Evidence that iron, steel, manufactured products, and materials meet BABA thresholds.`},{num:`/02`,color:`text-wk-magenta`,title:`Prevailing wage`,desc:`Certified payroll demonstrating Davis-Bacon compliance over the project.`},{num:`/03`,color:`text-wk-purple`,title:`Workforce & labor standards`,desc:`OFCCP-relevant labor-standards records for covered federal contractors.`},{num:`/04`,color:`text-wk-cyan`,title:`Subrecipient flow-down`,desc:`The same conditions demonstrated by pass-through subrecipients.`}],note:`Summary is interpretive — confirm grant terms and obligations with your grants-management counsel.`},architecture:{heading:`How it sits under your stack`,intro:`Knish.IO sits beneath the systems that already capture project data, signing each compliance event, and emits evidence your agency, auditors, and oversight bodies can verify independently.`,operationalLabel:`Your project tooling`,operational:[{cat:`ERP`,name:`ERP / accounting`},{cat:`Payroll`,name:`Certified payroll`},{cat:`Procurement`,name:`Procurement`}

1,{cat:`Project`,name:`Project management`}],verificationLabel:`Who reads the evidence`,verification:[{cat:`Agency`,name:`Awarding agency`},{cat:`Audit`,name:`Single Audit`},{cat:`Oversight`,name:`Inspectors General`},{cat:`Legal`,name:`e-Discovery`}]},stakes:{heading:`What’s at stake`,cards:[{kicker:`Clawback`,color:`text-wk-blue`,value:`Funds de-obligated`,note:`Failure to substantiate conditions can lead to disallowed costs and repayment of federal funds.`},{kicker:`False Claims Act`,color:`text-wk-pink`,value:`Treble damages`,gradient:!0,note:`Inaccurate certifications can trigger False Claims Act liability and, in serious cases, debarment.`}],note:`Reference: IIJA / IRA grant terms; BABA; Davis-Bacon Act. Not legal advice — confirm with your counsel.`},related:[{kicker:`/02 · NIST 800-171`,title:`Supply Chain Provenance`,desc:`Post-quantum-signed evidence for defense supply chains.`,to:`/solutions/supply-chain`},{kicker:`/05 · FEMA`,title:`Volunteer & Benefits`,desc:`Independently verifiable self-reported data for cost-share audits.`,to:`/solutions/volunteer-benefits`},{kicker:`/07 · Flagship`,title:`Resilient Infrastructure`,desc:`Multi-zone, multi-regime evidence at state scale.`,to:`/solutions/resilient-infrastructure`}]},"volunteer-benefits":{slug:`volunteer-benefits`,seoTitle:`Volunteer & Benefits — Verifiable cost-share evidence`,seoDescription:`Independently verifiable self-reported data for FEMA cost-share and in-kind documentation under 2 CFR 200. Tamper-evident volunteer-hour and donation records with fraud detection.`,breadcrumbLabel:`Volunteer & Benefits`,badge:`FEMA · 2 CFR 200`,badgeClass:`border-wk-cyan/30 bg-wk-cyan/5 text-wk-cyan`,headingLead:`Verifiable evidence for`,headingAccent:`cost-share and in-kind.`,lede:`Volunteer hours and in-kind contributions can offset the non-federal cost share of a disaster recovery — but only if they survive audit. Knish.IO makes self-reported contributions independently verifiable at the moment they’re logged.`,overviewHeading:`What the substrate provides`,overviewIntro:`Self-reported data is the weakest link in cost-share documentation. Knish.IO signs each volunteer-hour and in-kind record at submission, producing tamper-evident evidence that holds up under federal audit.`,capabilities:[{arrow:`text-wk-pink`,title:`Independently verifiable submissions`,note:`Signed at the moment of logging`},{arrow:`text-wk-magenta`,title:`Tamper-evident hour logs`,note:`Append-only volunteer & in-kind records`},{arrow:`text-wk-purple`,title:`Fraud detection posture`,note:`Duplicate and back-dating resistant`},{arrow:`text-wk-blue`,title:`Per-program cell isolation`,note:`Separation by grant and applicant`},{arrow:`text-wk-cyan`,title:`Post-quantum signing`,note:`Verifiable across federal retention windows`}],problemHeading:`What current tracking systems can’t produce`,gaps:[{title:`Sign-in sheets and spreadsheets`,body:`Paper logs and editable spreadsheets are the norm for volunteer hours. They’re trivial to alter and hard to defend when a reviewer questions a claimed cost share.`},{title:`Valuation without provenance`,body:`In-kind contributions are assigned a dollar value. Without tamper-evident provenance, the valuation rests on records that can’t be independently checked.`},{title:`Audit reconstruction`,body:`Months later, applicants reconstruct who did what. Reconstruction is exactly what triggers findings and de-obligation.`}],framework:{heading:`FEMA cost-share & 2 CFR 200`,intro:`For many FEMA Public Assistance projects, applicants must fund a non-federal cost share, which volunteer labor and donated resources can offset. Federal cost principles under 2 CFR 200 govern how those contributions are documented and valued.`,requirementsLabel:`What documentation must show`,requirements:[{num:`/01`,color:`text-wk-pink`,title:`Verifiable records`,desc:`Contributions supported by records that can be independently verified.`},{num:`/02`,color:`text-wk-magenta`,title:`Reasonable valuation`,desc:`In-kind and volunteer time valued on a defensible, documented basis.`},{num:`/03`,color:`text-wk-purple`,title:`No double counting`,desc:`The same contribution not applied to more than one award.`},{num:`/04`,color:`text-wk-cyan`,title:`Retention`,desc:`Records preserved and available for the federal retention period.`}],note:`Summary is interpretive — confirm cost-share rules with your grants administrator and counsel.`},architecture:{heading:`How it sits under your stack`,intro:`Knish.IO sits beneath your volunteer and grants tooling, signing each submitted contribution, and emits evidence your agency and auditors can verify without trusting the source spreadsheet.`,operationalLabel:`Your program tooling`,operational:[{cat:`Volunteer`,name:`Volunteer management`},{cat:`Grants`,name:`Grants tracking`},{cat:`Finance`,name:`Fund accounting`},{cat:`Intake`,name:`Field intake`}],verificationLabel:`Who reads the evidence`,verification:[{cat:`Agency`,name:`FEMA / recipient`},{cat:`Audit`,name:`Single Audit`},{cat:`Oversight`,name:`OIG`},{cat:`Legal`,name:`e-Discovery`}]},stakes:{heading:`What’s at stake`,cards:[{kicker:`De-obligation`,color:`text-wk-cyan`,value:`Funds withdrawn`,note:`Unsupported cost-share contributions can be disallowed, reducing or withdrawing federal funding.`},{kicker:`Audit findings`,color:`text-wk-pink`,value:`OIG exposure`,gradient:!0,note:`Weak documentation is a common driver of audit findings and improper-payment determinations.`}],note:`Reference: FEMA Public Assistance program; 2 CFR Part 200. Not legal advice — confirm with your grants counsel.`},related:[{kicker:`/04 · Federal`,title:`Compliance Attestation`,desc:`Court-defensible evidence for federal-grant compliance.`,to:`/solutions/compliance-attestation`},{kicker:`/03 · HIPAA`,title:`Healthcare Consent`,desc:`PHI-neutral consent attestation with cryptoshredding.`,to:`/solutions/healthcare-consent`}

1,{kicker:`/07 · Flagship`,title:`Resilient Infrastructure`,desc:`Multi-zone, multi-regime evidence at state scale.`,to:`/solutions/resilient-infrastructure`}]},ecommerce:{slug:`ecommerce`,seoTitle:`E-Commerce Provenance — Digital Product Passport evidence`,seoDescription:`Marketplace and product provenance for the EU Digital Product Passport (ESPR). Tamper-evident product data, counterfeit defense, and chargeback evidence.`,breadcrumbLabel:`E-Commerce Provenance`,badge:`EU DPP · ESPR`,badgeClass:`border-wk-ice/30 bg-wk-ice/5 text-wk-ice`,headingLead:`Tamper-evident provenance for`,headingAccent:`regulated marketplaces.`,lede:`The EU’s Digital Product Passport will require verifiable product data across categories of goods sold into Europe. Knish.IO signs product provenance and passport data so it can be trusted by marketplaces, regulators, and buyers alike.`,overviewHeading:`What the substrate provides`,overviewIntro:`Product claims — origin, materials, recyclability, authenticity — are only as good as the data behind them. Knish.IO signs each product event at the source, turning passport data and marketplace provenance into verifiable evidence.`,capabilities:[{arrow:`text-wk-pink`,title:`Product provenance signing`,note:`Origin and lifecycle events, signed`},{arrow:`text-wk-magenta`,title:`Digital Product Passport data`,note:`Tamper-evident passport attributes`},{arrow:`text-wk-purple`,title:`Counterfeit defense`,note:`Authenticity verifiable by anyone`},{arrow:`text-wk-blue`,title:`Chargeback evidence`,note:`Append-only fulfillment record`},{arrow:`text-wk-cyan`,title:`Per-brand cell isolation`,note:`Protocol-level separation by seller`}],problemHeading:`What current marketplace systems can’t produce`,gaps:[{title:`Self-declared product data`,body:`Passport and sustainability attributes are typically self-declared. Without tamper-evidence, a regulator or buyer has no way to tell a real claim from an edited one.`},{title:`Counterfeits that copy the label`,body:`A counterfeit can copy a QR code or a static record. Authenticity needs cryptographic signing that a copy can’t reproduce.`},{title:`Disputes without a fixed record`,body:`When a chargeback or counterfeit claim lands, the fulfillment record is often mutable — exactly when an immutable one is needed.`}],framework:{heading:`EU Digital Product Passport (ESPR)`,intro:`The Ecodesign for Sustainable Products Regulation introduces a Digital Product Passport for categories of products placed on the EU market, requiring verifiable data on origin, composition, and lifecycle. Requirements phase in by product category over the coming years.`,requirementsLabel:`What the passport expects`,requirements:[{num:`/01`,color:`text-wk-pink`,title:`Verifiable product data`,desc:`Passport attributes traceable to a credible, tamper-evident source.`},{num:`/02`,color:`text-wk-magenta`,title:`Lifecycle traceability`,desc:`Evidence spanning sourcing, manufacture, and end-of-life.`},{num:`/03`,color:`text-wk-purple`,title:`Accessibility`,desc:`Passport data accessible to authorities and buyers as required.`},{num:`/04`,color:`text-wk-cyan`,title:`Integrity over time`,desc:`Data that remains verifiable across the product’s market life.`}],note:`Summary is interpretive and timelines phase in by category — confirm applicability with your regulatory counsel.`},architecture:{heading:`How it sits under your stack`,intro:`Knish.IO sits beneath your commerce and PIM systems, signing each product and fulfillment event, and emits evidence marketplaces, regulators, and buyers can verify independently.`,operationalLabel:`Your commerce tooling`,operational:[{cat:`Commerce`,name:`Storefront platform`},{cat:`PIM`,name:`Product information`}

1,{cat:`Supply`,name:`Supplier data`},{cat:`Fulfillment`,name:`Order / logistics`}],verificationLabel:`Who reads the evidence`,verification:[{cat:`Market`,name:`Marketplaces`},{cat:`Regulators`,name:`EU authorities`},{cat:`Buyers`,name:`Consumers`},{cat:`Disputes`,name:`Payment networks`}]},stakes:{heading:`What’s at stake`,cards:[{kicker:`Market access`,color:`text-wk-ice`,value:`EU eligibility`,note:`Where a Digital Product Passport is required, products without compliant data may not be placed on the EU market.`},{kicker:`Liability`,color:`text-wk-pink`,value:`Counterfeit & chargeback`,gradient:!0,note:`Weak provenance raises exposure to counterfeit claims and undefendable chargebacks.`}],note:`Reference: Ecodesign for Sustainable Products Regulation (ESPR). Not legal advice — confirm applicability with counsel.`},related:[{kicker:`/02 · NIST 800-171`,title:`Supply Chain Provenance`,desc:`Post-quantum-signed evidence for defense supply chains.`,to:`/solutions/supply-chain`},{kicker:`/01 · EU AI Act`,title:`AI Audit Trail`,desc:`Cryptographic evidence for AI-driven decisions under Article 12.`,to:`/solutions/ai-audit-trail`},{kicker:`/07 · Flagship`,title:`Resilient Infrastructure`,desc:`Multi-zone, multi-regime evidence at state scale.`,to:`/solutions/resilient-infrastructure`}]},"resilient-infrastructure":{slug:`resilient-infrastructure`,seoTitle:`Resilient Infrastructure — Multi-zone evidence at state scale`,seoDescription:`State-scale cryptographic-evidence infrastructure across HIPAA, FERPA, CJIS, and records-retention regimes. Five-tier validator topology from home-edge to sovereign anchor.`,breadcrumbLabel:`Resilient Infrastructure`,badge:`Multi-zone · 2026 → 2030`,badgeClass:`border-wk-pink/30 bg-wk-pink/5 text-wk-pink`,headingLead:`Cryptographic-evidence infrastructure`,headingAccent:`at state scale.`,lede:`A state or county doesn’t face one compliance regime — it faces all of them at once, across agencies that don’t share systems. Knish.IO provides a multi-zone substrate with a five-tier validator topology, isolating each agency and regime at the protocol level.`,overviewHeading:`What the substrate provides`,overviewIntro:`Government evidence spans overlapping regimes and jurisdictions. Knish.IO gives each agency a cryptographically isolated cell on shared infrastructure, with a validator topology that scales from a single edge node to a sovereign anchor.`,capabilities:[{arrow:`text-wk-pink`,title:`Multi-zone cell isolation`,note:`HIPAA + FERPA + CJIS, separated by protocol`},{arrow:`text-wk-magenta`,title:`Five-tier validator topology`,note:`Edge → region → state → sovereign`},{arrow:`text-wk-purple`,title:`Federal grant audit posture`,note:`Evidence ready for cross-program audit`},{arrow:`text-wk-blue`,title:`Runs on modest hardware`,note:`Edge nodes on commodity / single-board compute`},{arrow:`text-wk-cyan`,title:`Post-quantum signing`,note:`Verifiable across statutory retention`}],problemHeading:`What single-regime systems can’t produce`,gaps:[{title:`One system per regime`,body:`Agencies stand up separate compliance systems for health, education, and justice data. Overlapping obligations turn into duplicated, inconsistent evidence.`},{title:`Isolation by configuration`,body:`Sharing infrastructure across agencies usually means application-level separation — a configuration a misstep can cross. Government data demands protocol-level isolation.`},{title:`Scale without re-architecture`,body:`Evidence needs grow from a pilot to state scale. Most systems re-architect to get there; the substrate scales by adding validator tiers.`}],framework:{heading:`Overlapping compliance regimes`,intro:`State and county operations touch protected health information (HIPAA), education records (FERPA), criminal-justice information (CJIS), and statutory records-retention requirements — often within the same program and the same infrastru

1cture.`,requirementsLabel:`What multi-regime evidence must show`,requirements:[{num:`/01`,color:`text-wk-pink`,title:`Per-regime isolation`,desc:`Cryptographic separation between datasets governed by different regimes.`},{num:`/02`,color:`text-wk-magenta`,title:`Cross-agency verifiability`,desc:`Evidence one agency can verify without access to another’s systems.`},{num:`/03`,color:`text-wk-purple`,title:`Retention by statute`,desc:`Records preserved and verifiable across multi-decade statutory windows.`},{num:`/04`,color:`text-wk-cyan`,title:`Audit readiness`,desc:`Evidence prepared for federal grant and program audits.`}],note:`Summary is interpretive — confirm the applicable regimes and obligations with your agency counsel.`},architecture:{heading:`A five-tier validator topology`,intro:`Evidence is signed at the edge, where it’s generated, and anchored upward through regional, state, and sovereign tiers — each agency isolated in its own cell, all on shared infrastructure.`,operationalLabel:`Agency systems`,operational:[{cat:`Health`,name:`Health agencies`},{cat:`Education`,name:`School districts`},{cat:`Justice`,name:`Criminal justice`},{cat:`Records`,name:`Records & archives`}],verificationLabel:`Who reads the evidence`,verification:[{cat:`State`,name:`State oversight`},{cat:`Federal`,name:`Grant auditors`},{cat:`Legal`,name:`e-Discovery`},{cat:`Public`,name:`Records requests`}]},stakes:{heading:`What’s at stake`,cards:[{kicker:`Multi-regime exposure`,color:`text-wk-pink`,value:`Compounding risk`,gradient:!0,note:`A single mishandled dataset can trigger obligations under several regimes at once.`},{kicker:`Deployment horizon`,color:`text-wk-cyan`,value:`2026 → 2030`,note:`A phased, multi-zone rollout designed for state-scale evidence over a multi-year horizon.`}],note:`Reference: HIPAA; FERPA; CJIS Security Policy. Not legal advice — confirm applicable regimes with your counsel.`},related:[{kicker:`/03 · HIPAA`,title:`Healthcare Consent`,desc:`PHI-neutral consent attestation with cryptoshredding.`,to:`/solutions/healthcare-consent`},{kicker:`/04 · Federal`,title:`Compliance Attestation`,desc:`Court-defensible evidence for federal-grant compliance.`,to:`/solutions/compliance-attestation`},{kicker:`/01 · EU AI Act`,title:`AI Audit Trail`,desc:`Cryptographic evidence for AI-driven decisions under Article 12.`,to:`/solutions/ai-audit-trail`}]}},n=Object.keys(t).length+1;export{t as n,n as t};