Build the compliance path beside the product.
A Road Sentinel prototype is built. Formal audits and product certifications have not been completed. This register shows what buyers and public agencies may require and the current state of each item.
A glyph and a word carry the state of each row. ! means we need it before we can sell. ~ means it's coming and we know roughly when. · means it doesn't apply to us today.
| The thing | Where we are | What it actually means |
|---|---|---|
| SOC 2 Type II Almost any buyer with a security team | Needed to sell | An auditor watches how we actually run for three to twelve months, then writes a report about it. We can't start until there is a running system to watch. This is the one buyers ask for by name. |
| NIST Cybersecurity Framework 2.0 Nobody demands it | Starting now | A free checklist with no auditor and no fee. Working through it first makes the SOC 2 shorter, cheaper and less of a scramble, and we can do it today with no product. |
| GovRAMP, called StateRAMP until February 2025 State, city, county and school buyers | When a state asks | Built on the NIST 800-53 control list. Some states already make it a condition of buying, and one authorization is meant to be reusable across the states that take part. Worth real money to us, and far too early. |
| ISO/IEC 27001 Buyers outside the United States | Not yet | Covers much the same ground as SOC 2 for a different audience. No sense paying for both until somebody abroad asks, and nobody has. |
| FedRAMP Federal agencies only | Not yet | Slow and expensive. Only worth starting if a federal agency is actually buying, and none is close. |
Apply privacy law to each data type.
Structured movement records have no names, face matches, plate numbers, or identity index. Separate imagery may still identify someone and must be assessed under its own purpose, access, and retention terms. Legal classification requires counsel review.
| The law | Where we are | What it actually means |
|---|---|---|
| CCPA and CPRA | Little to attach to | Structured movement records omit names, face matches, plate numbers, and identity indexes. Separately governed imagery and contact data still require a full privacy review. |
| The Delete Act | Our answer must hold | Whether Forge Core falls within this definition depends on the data offered and how the law applies to structured records and any separately governed imagery. Counsel must confirm the answer before it supports a contract. |
| GDPR | Not yet | Only if we ever measure a street in Europe. We don't, and there is no plan to. |
Radio, enclosure, sourcing, road-device, and funding rules can determine whether production hardware may be sold or installed.
| The rule | Where we are | What it actually means |
|---|---|---|
| FCC Part 15 | Before the first sale | A pylon has radios in it. You can't legally sell that in the United States until it has been tested and labeled. |
| NDAA Section 889 | A sourcing rule | Federal money can't pay for certain Chinese made cameras and radio parts. It covers what a supplier puts inside our box, not just what we assemble. So we have to know our own parts list before a city using federal funds can buy. |
| Build America, Buy America | When federal road money pays | Most city road work leans on federal highway funds. Those funds carry a rule about how much of the installed metal and manufactured goods must be made here. |
| NTCIP 1200 series | Asked for by DOTs | The agreed way traffic devices talk to a traffic management center. Not a law. A DOT will still ask whether we speak it, and the answer today is no. |
| A listed enclosure and a weather rating | Before anything goes up | Outdoor electrical equipment on public property needs the safety listing and weather rating required by the installation authority. |
- 01 Work through the NIST checklist ourselves. No fee, no auditor, and it shapes how everything after it gets built.
- 02 Document policies and operating evidence for controls that will be tested.
- 03 Get the radio and enclosure testing done. Nothing goes on a pole before that, so it can't wait for a customer.
- 04 SOC 2 once a real system is running, because an auditor needs something to watch.
- 05 GovRAMP only when a state buyer needs it, then reuse it everywhere that takes it.
- 06 An accessibility report before the first public body signs anything.
Legal review status
This register is a planning view, not legal advice or a certification. Counsel must confirm privacy and procurement classifications before they support a customer contract.