Skip to content

Government & Defense: CNSA 2.0 Quantum Protection

Protect classified data with NSA-approved algorithms - 4 years ahead of 2030 deadline

🚀 Test CNSA 2.0 compliance in 5 minutes

Quick Start: Classified Data Encryption

Estimated time: 5 minutes What you'll achieve: Encrypt classified data with CNSA 2.0 approved algorithms Requirements: AnkaSecure API access or on-premise trial

Step 1/3: Generate CNSA 2.0 key (1 minute)

# Generate NSA-approved ML-KEM key for TOP SECRET
curl -X POST https://api.ankatech.co/keys \
  -H "Authorization: Bearer $TOKEN" \
  -d '{
    "algorithm": "ML_KEM_1024",
    "securityLevel": "CNSA_L5",
    "classification": "TOP_SECRET",
    "compartment": "SI",  # Sensitive Compartmented Information
    "hsmRequired": true
  }'

✅ Success: CNSA 2.0 compliant key created: 

{
  "keyId": "ts-si-001",
  "algorithm": "ML_KEM_1024",
  "cnsa2Compliant": true,
  "classification": "TOP_SECRET//SI",
  "nsaApproved": true,
  "deadline2030": "COMPLIANT_NOW"
}

NSA CNSA 2.0 requirement met: ✅ ML-KEM-1024 approved for TOP SECRET

Step 2/3: Encrypt classified document (2 minutes)

# Encrypt TOP SECRET intelligence report
curl -X POST https://api.ankatech.co/encrypt \
  -H "Authorization: Bearer $TOKEN" \
  -d '{
    "keyId": "ts-si-001",
    "plaintext": "TOP SECRET//SI//NOFORN - Intelligence Report #12345",
    "classification": "TOP_SECRET",
    "compartment": "SI",
    "releaseability": "USA_ONLY"
  }'

✅ Success: Classified data quantum-protected: 

{
  "ciphertext": "eyJhbGciOiJNTC1LRU0tMTAyNCIsInR5cCI6IkpXRSJ9...",
  "classification": "TOP_SECRET//SI//NOFORN",
  "quantumResistant": true,
  "cnsa2Compliant": true,
  "clearanceRequired": "TS_SCI",
  "auditLogged": true
}

Security guarantee: Quantum-resistant, NSA-approved algorithm

Step 3/3: Verify CNSA 2.0 compliance (2 minutes)

# Generate CNSA 2.0 compliance report
curl https://api.ankatech.co/compliance/cnsa-scorecard \
  -H "Authorization: Bearer $TOKEN"

✅ Verification: 

{
  "overallCompliance": "100%",
  "cnsa2Algorithms": {
    "ML_KEM_1024": "APPROVED",
    "ML_DSA_87": "APPROVED",
    "AES_256_GCM": "APPROVED"
  },
  "deadline": "2030-01-01",
  "daysAhead": 1454,  # 4 years early!
  "readyForNSS": true
}

NSA compliance: ✅ Ready for National Security Systems (NSS)

🎯 Verified: 4 years ahead of 2030 deadline

What's next? - Air-gapped deployment: SCIF environment setup - Multi-level security: SECRET + TOP SECRET isolation - DoD contractor: DFARS compliance

Government Challenges

Challenge 1: NSA CNSA 2.0 Deadline (2030)

Requirement: All NSS must use quantum-resistant algorithms by January 1, 2030

The timeline: 

2022: CNSA 2.0 announced (classical → PQC)
2025-2030: Transition period (5 years)
2030: Deadline (pure PQC required for classified)
2030+: Classical algorithms deprecated

The rush problem: - 2029: Agencies realize deadline approaching - Scramble to migrate (expensive, risky) - Vendor shortages (everyone needs PQC simultaneously)

AnkaSecure early adoption: 

2024: AnkaSecure PQC available
2026: Agencies can start migration (4 years before deadline)
2027-2029: Gradual rollout (low risk)
2030: Compliant (zero last-minute rush)

Benefit: Avoid 2029 panic, spread costs over 4 years

Challenge 2: Air-Gapped Networks (Classified)

Scenario: SCIF (Sensitive Compartmented Information Facility) with no internet

Requirements: - No internet connectivity (security policy) - Quantum-resistant cryptography - Offline license validation

AnkaSecure solution: Full air-gapped deployment 

# Download on internet-connected system
curl -O https://get.ankatech.co/ankasecure-offline-3.0.0.tar.gz

# Transfer via USB to classified network
# (after security review and authorization)

# Install in air-gapped environment (no internet)
sudo bash ankasecure-offline-3.0.0.tar.gz --mode airgapped

Offline operation: - ✅ All crypto operations work (no internet needed) - ✅ Offline license validation (cryptographic license files) - ✅ Manual updates (via secure file transfer)

No competitor supports this: AWS, Azure require internet

Air-gapped deployment guide

Challenge 3: Multi-Level Security (MLS)

Scenario: System processes both SECRET and TOP SECRET data (need separation)

Requirements: - Separate keys per classification level - Access controls (TOP SECRET users can't downgrade to SECRET) - Audit separation (SECRET logs != TOP SECRET logs)

AnkaSecure solution: Multi-tenant per classification 

# Tenant 1: SECRET classification
curl -X POST https://api.ankatech.co/tenants \
  -d '{"name":"DoD-SECRET","classification":"SECRET"}'

# Tenant 2: TOP SECRET classification
curl -X POST https://api.ankatech.co/tenants \
  -d '{"name":"DoD-TOP-SECRET","classification":"TOP_SECRET"}'

Isolation: SECRET tenant CANNOT access TOP SECRET keys (database + application separation)

CNSA 2.0 Compliance

Required Algorithms by Classification

SECRET (NIST Level 3 minimum): 

# Encryption: ML-KEM-768 or ML-KEM-1024
curl -X POST https://api.ankatech.co/encrypt \
  -d '{
    "algorithm": "ML_KEM_768",  # CNSA L3
    "plaintext": "SECRET//NOFORN document",
    "classification": "SECRET"
  }'

# Signature: ML-DSA-65 or ML-DSA-87
curl -X POST https://api.ankatech.co/sign \
  -d '{
    "algorithm": "ML_DSA_65",  # CNSA L3
    "document": "SECRET briefing...",
    "classification": "SECRET"
  }'

TOP SECRET (NIST Level 5 required): 

# Encryption: ML-KEM-1024 ONLY
curl -X POST https://api.ankatech.co/encrypt \
  -d '{
    "algorithm": "ML_KEM_1024",  # CNSA L5 REQUIRED
    "plaintext": "TOP SECRET//SI//TK document",
    "classification": "TOP_SECRET",
    "hsmRequired": true  # Luna HSM Level 3
  }'

# Signature: ML-DSA-87 ONLY
curl -X POST https://api.ankatech.co/sign \
  -d '{
    "algorithm": "ML_DSA_87",  # CNSA L5 REQUIRED
    "document": "TOP SECRET operations order",
    "classification": "TOP_SECRET"
  }'

Additional requirement: FIPS 140-3 Level 3 HSM (Luna, nShield)

DoD Contractor Requirements

DFARS 252.204-7012: Safeguarding CDI

Covered Defense Information (CDI): Unclassified but sensitive (CUI)

Requirement: NIST SP 800-171 compliance (110 security controls)

Key cryptographic controls:

Control Requirement AnkaSecure Compliance
3.13.11 FIPS-validated cryptography ✅ Certificate #4616
3.13.16 Protect confidentiality via encryption ✅ ML-KEM-1024
3.14.1 Cryptographic key management ✅ Lifecycle automation

Verification: 

curl https://api.ankatech.co/compliance/nist-sp-800-171 \
  -H "Authorization: Bearer $TOKEN"

Response: {"compliance": "100%", "controls": "3/3 crypto controls met"}

📥 Download NIST SP 800-171 compliance brief

CMMC (Cybersecurity Maturity Model Certification)

Level 3 requirement: Advanced cybersecurity practices

Cryptographic practices (AC.L3-3.1.12): - ✅ FIPS 140-2 validated algorithms - ✅ Multi-factor authentication (for key access) - ✅ Cryptographic key management

AnkaSecure CMMC support: - ✅ FIPS-validated (Certificate #4616) - ✅ MFA integration (OAuth2, OIDC) - ✅ Key lifecycle (automated rotation, revocation)

Contractor benefit: Check CMMC Level 3 crypto boxes

Use Cases by Agency Type

DoD (Department of Defense)

Challenge: Protect weapon systems data, operations plans (50-year retention)

Classification: TOP SECRET//SCI

AnkaSecure solution: 

# TOP SECRET encryption with Luna HSM
curl -X POST https://api.ankatech.co/keys \
  -d '{
    "algorithm": "ML_KEM_1024",  # CNSA 2.0 L5
    "classification": "TOP_SECRET",
    "compartment": "SCI",
    "hsmRequired": true,  # FIPS 140-3 Level 3
    "retention": "50_YEARS"
  }'

Deployment: Air-gapped on-premise in SCIF (no internet)

Compliance: CNSA 2.0, FIPS 140-3, ICD 503

Intelligence Community (IC)

Challenge: Encrypt SIGINT/HUMINT reports (compartmented access)

Requirements: - Compartmented information (SI, TK, G, HCS) - Need-to-know access control - Quantum resistance (intelligence value 30+ years)

AnkaSecure solution: Compartment-based multi-tenancy 

# Tenant per compartment
curl -X POST https://api.ankatech.co/tenants \
  -d '{"name":"NSA-SIGINT","classification":"TS","compartment":"SI"}'

# Encrypt SIGINT with compartment metadata
curl -X POST https://api.ankatech.co/encrypt \
  -H "Authorization: Bearer $SI_TOKEN" \
  -d '{
    "algorithm": "ML_KEM_1024",
    "plaintext": "SIGINT Report...",
    "classification": "TS//SI",
    "releaseability": "USA_FVEY"  # Five Eyes
  }'

Access control: Only users with TS clearance + SI access + FVEY releaseability can decrypt

Civilian Agencies (DHS, HHS, DOE, etc.)

Challenge: FISMA compliance for moderate/high impact systems

Requirements: - FIPS 140-2 validated cryptography - NIST SP 800-53 security controls - FedRAMP authorization (for cloud)

AnkaSecure solution: FISMA-compliant SaaS or on-premise 

# For moderate-impact system
curl -X POST https://api.ankatech.co/keys \
  -d '{
    "algorithm": "ML_KEM_1024",  # FIPS-validated (Q2 2026)
    "fismaImpact": "MODERATE",
    "nistControls": ["SC-13", "SC-28"]  # FIPS crypto, protection at rest
  }'

FedRAMP: ⏳ Moderate authorization in progress (Q4 2027)

Current option: On-premise (agency ATO responsibility)

Defense Contractors

Challenge: Safeguard CUI (Controlled Unclassified Information)

Requirements: - DFARS 252.204-7012 (safeguarding CDI) - NIST SP 800-171 (110 controls) - CMMC Level 3 (advanced cybersecurity)

AnkaSecure solution: CMMC Level 3 compliant 

# Encrypt CUI (unclassified but sensitive)
curl -X POST https://api.ankatech.co/encrypt \
  -d '{
    "algorithm": "ML_KEM_1024",
    "plaintext": "Technical specifications for F-35 component",
    "classification": "CUI",
    "compliance": "DFARS_252_204_7012"
  }'

Compliance: NIST SP 800-171 + quantum-resistant

Air-Gapped Deployment (SCIF)

SCIF Environment Setup

SCIF = Sensitive Compartmented Information Facility (no internet)

Deployment process:

Step 1: Download on internet-connected system (GREEN network) 

# Outside SCIF
curl -O https://get.ankatech.co/ankasecure-airgapped-3.0.0.tar.gz
curl -O https://get.ankatech.co/ankasecure-airgapped-3.0.0.tar.gz.sha256
curl -O https://get.ankatech.co/ankasecure-airgapped-3.0.0.tar.gz.sig

Step 2: Security review (required for classified networks) 

# Verify checksum
sha256sum -c ankasecure-airgapped-3.0.0.tar.gz.sha256

# Verify GPG signature
gpg --verify ankasecure-airgapped-3.0.0.tar.gz.sig

Step 3: Transfer to RED network (via approved method) - USB drive (approved for transfer) - OR: Secure file transfer system - After: Security officer approval

Step 4: Install in SCIF (air-gapped) 

# Inside SCIF (no internet)
sudo bash install-airgapped.sh \
  --mode airgapped \
  --domain classified.local \
  --license-file offline-license.lic

Step 5: Verify offline operation 

# All operations work without internet
curl -k https://classified.local/api/encrypt \
  -d '{"algorithm":"ML_KEM_1024","plaintext":"test"}'

✅ Success: Fully operational, zero internet connectivity

Offline License Validation

Cryptographic license file (no call-home):

# License file structure (example)
{
  "licensee": "DoD-Agency-XYZ",
  "validUntil": "2027-01-01",
  "features": ["ML_KEM","ML_DSA","COMPOSITE_KEYS"],
  "signature": "..." # Signed by AnkaSecure private key
}

Validation: AnkaSecure verifies signature using embedded public key (no internet)

Renewal: New license file via secure transfer (annual)

Use Cases by Classification Level

Unclassified (CUI)

Example: Procurement documents, technical specifications (FOUO)

Algorithm: ML-KEM-1024 (standard security) 

curl -X POST https://api.ankatech.co/encrypt \
  -d '{
    "algorithm": "ML_KEM_1024",
    "plaintext": "Unclassified technical specs",
    "classification": "CUI",
    "markings": "FOUO"  # For Official Use Only
  }'

Compliance: NIST SP 800-171 (for contractors)

SECRET (NIST Level 3)

Example: Operational plans, intelligence assessments

Algorithm: ML-KEM-768 (minimum), ML-KEM-1024 (recommended) 

curl -X POST https://api.ankatech.co/encrypt \
  -d '{
    "algorithm": "ML_KEM_1024",  # Exceed minimum (L3 → L5)
    "plaintext": "SECRET operations plan...",
    "classification": "SECRET",
    "releaseability": "USA_NATO"
  }'

Compliance: CNSA 2.0 (ML-KEM approved)

TOP SECRET (NIST Level 5)

Example: Weapons data, SIGINT, covert operations

Algorithm: ML-KEM-1024 (REQUIRED), HSM mandatory 

curl -X POST https://api.ankatech.co/encrypt \
  -d '{
    "algorithm": "ML_KEM_1024",  # REQUIRED for TS
    "plaintext": "TOP SECRET//SI//TK - SIGINT intercept",
    "classification": "TOP_SECRET",
    "compartments": ["SI", "TK"],
    "hsmRequired": true,  # Luna HSM Level 3
    "releaseability": "USA_FVEY"
  }'

Additional security: - ✅ Luna HSM (FIPS 140-3 Level 3) - ✅ Multi-factor authentication - ✅ Tamper-detection

SCI (Sensitive Compartmented Information)

Examples: HUMINT sources, satellite imagery (TALENT-KEYHOLE)

Requirements: - Compartment isolation (SI != TK != G != HCS) - Strict access controls (need-to-know) - Quantum resistance (intelligence value 50+ years)

AnkaSecure solution: Tenant per compartment 

# Separate tenants for compartments
Tenant 1: SI (Signals Intelligence)
Tenant 2: TK (Talent-Keyhole, satellite)
Tenant 3: G (Communications Intelligence)
Tenant 4: HCS (HUMINT Control System)

Guarantee: SI users CANNOT access TK data (database + application isolation)

Case Study: Defense Contractor (Classified)

Company: Top 10 defense contractor Challenge: CNSA 2.0 compliance for classified weapons data, air-gapped requirement Timeline: 3-month pilot + 6-month production

Before: - Encryption: RSA-4096 (not quantum-resistant) - Deployment: Legacy HSM (proprietary, expensive maintenance) - CNSA 2.0: ❌ Not compliant (deadline 2030) - Air-gapped: ✅ Yes (but no PQC solution available)

After (AnkaSecure on-premise + Luna HSM): - Encryption: ML-KEM-1024 (quantum-resistant) - Deployment: AnkaSecure + Luna HSM cluster (FIPS Level 3) - CNSA 2.0: ✅ Compliant (4 years early) - Air-gapped: ✅ Full offline operation

Results: - ✅ Compliance: CNSA 2.0 achieved by 2026 (4 years before deadline) - ✅ Classification: TOP SECRET//SCI processing - ✅ Air-gapped: Complete SCIF deployment (no internet) - ✅ Cost: $150K/year (vs $300K/year legacy HSM maintenance)

CTO quote: "Air-gapped PQC was critical for classified programs. AnkaSecure was the ONLY vendor who could deliver."

📥 Download defense contractor case study (PDF, 18 pages, requires NDA)

Federal Procurement

GSA Schedule 70 (Coming Q2 2026)

What it is: Pre-negotiated contract vehicle for IT solutions

Benefits for agencies: - ✅ Simplified procurement (no full RFP needed) - ✅ Pre-negotiated pricing (competitive) - ✅ Faster acquisition (weeks vs months)

AnkaSecure GSA status: - ⏳ Application in progress (Q1 2026) - ✅ GSA PQC compliant (100%) - ✅ FIPS validated (Certificate #4616) - ✅ Expected approval: Q2 2026

Agency benefit: Direct purchase via GSA Schedule (after Q2 2026)

FedRAMP Authorization

What it is: Federal cloud security authorization

AnkaSecure FedRAMP roadmap: - ✅ 2026: Achieve FIPS 140-2 (done) - ⏳ 2027: Submit FedRAMP Moderate package (Q1) - ⏳ 2027: Achieve FedRAMP Moderate ATO (Q4) - ⏳ 2028: FedRAMP High (if demand)

Current state: On-premise only (agencies obtain own ATO)

FedRAMP benefits (post-authorization): - ✅ Cloud deployment for federal (SaaS) - ✅ Inherited controls (agencies leverage AnkaSecure ATO) - ✅ Faster agency procurement

Intelligence Community Compliance

ICD 503: IC Cryptographic Requirements

Requirement: Type 1 (TOP SECRET/SCI) or Type 2 (SECRET) cryptography

AnkaSecure fit: - ✅ Type 2 equivalent: CNSA 2.0 algorithms (ML-KEM, ML-DSA) - ⚠️ Type 1: Not currently (requires NSA Suite A certification)

Use case: SECRET intelligence reports, SIGINT/HUMINT (non-compartmented)

Limitation: TOP SECRET/SCI may require Type 1 (contact NSA for certification)

What's Next?

Ready for federal deployment? - 🚀 Test CNSA 2.0 compliance (5-minute verification) - 📥 Download federal compliance brief (PDF, NIST + GSA + CNSA) - 📋 Request ATO support (Authority to Operate assistance) - 📧 Schedule federal consultation (specialized support)

Explore government use cases: - DoD classified data - Intelligence community - Civilian agencies - Defense contractors

Related compliance: - NSA CNSA 2.0 - 2030 deadline requirements - GSA PQC mandate - Federal procurement - FIPS 140-3 - Cryptographic module validation

Have questions? Email [email protected] or schedule consultation

Last updated: 2026-01-07 | CNSA 2.0 compliant | Classified data ready | Air-gapped supported