When a customer publishes a FedRAMP Authorization to Operate (ATO) package that names your product as an underlying cloud-service-offering component, a subservice-organization dependency, or a leveraged-authorization reference, ships a FedRAMP Joint Authorization Board (JAB) Provisional Authorization disclosure that names your product among the cited cloud-infrastructure dependencies, releases a FedRAMP Agency ATO letter that names your product among the leveraged-authorization scope, maintains a StateRAMP Authorization at the Moderate or High impact level that names your product among the in-scope subservice-organization disclosures, holds a Department of Defense (DoD) Impact Level 4, 5, or 6 Provisional Authorization that names your product among the cited cloud-infrastructure-and-cybersecurity dependencies, or publishes a Cybersecurity Maturity Model Certification (CMMC) Level 2 or Level 3 certification disclosure that names your product among the System Security Plan (SSP) component scope, they have left a category of endorsement that almost no marketing-elicited testimonial can replicate. The US government cloud-security authorization disclosure has been written under the cloud-security-authorization commitment of a FedRAMP Program Management Office (PMO) review pathway, a FedRAMP JAB Provisional Authorization process, a FedRAMP Agency ATO process, a StateRAMP Program Management Office review, a DoD DISA Cloud Computing Security Requirements Guide (SRG) framework, and a CMMC Accreditation Body framework, archived permanently in agency public-disclosure databases like the FedRAMP Marketplace, the StateRAMP Authorized Product List (APL), the DoD DISA Cloud Service Catalog, and the Cyber AB CMMC Marketplace where any future federal information system security officer, federal contracting officer, federal authorizing official, customer, competing vendor, or DoD CIO can retrieve it, scrutinized by independent Third-Party Assessment Organizations (3PAOs) and CMMC Third-Party Assessment Organizations (C3PAOs) who have direct FedRAMP-accreditation-renewal and Cyber-AB-authorization incentives to dispute any inaccuracy, and frequently re-referenced in subsequent FedRAMP continuous-monitoring (ConMon) monthly POA&M submissions, FedRAMP annual assessment reports, DoD Continuous Authorization to Operate (cATO) re-assessments, and CMMC affirmation submissions for years after the original authorization. The cloud-security authorization carries the customer's cloud-security testimony, the 3PAO and JAB or Agency authorizing-official signature carries the government-authorization ratification, and the surrounding context establishes that the disclosure entry was written under one of the most procedurally constrained public-federal-authorization environments any customer-facing organization encounters.
Almost no developer-tools, security-platform, observability, infrastructure-platform, or B2B SaaS vendor with federal-and-defense-contractor customers systematically extracts product mentions from public FedRAMP, StateRAMP, DoD Impact Level, and CMMC cloud-security authorization archives. The omission is the natural extension of the same blind spots we documented in our FDA 510(k) and CE marking extraction guide, our SBOM and VEX extraction guide, our SOC 2 and ISO 27001 extraction guide, our bug bounty extraction guide, our SEC filing extraction guide, and our government tender and public bid disclosure extraction guide. FDA 510(k) and CE marking disclosures cover medical-device-regulator-cleared product mentions. SBOM and VEX attestations cover supply-chain-security-attested cryptographic-component mentions. SOC 2 and ISO 27001 attestations cover trust-services-attested compliance mentions. Bug bounty disclosures cover researcher-attested security-program mentions. SEC filings cover Sarbanes-Oxley-attested risk-factor mentions. Government tender disclosures cover procurement-officer-attested bid-evaluation mentions. US government cloud-security authorization content covers 3PAO-assessed, JAB-or-Agency-authorizing-official-ratified, federal-archive-permanent, continuous-monitoring-load-bearing, federal-contract-anchored product mentions made under the most procedurally constrained public-federal-cloud-authorization environment any customer-facing organization publishes into — a pillar of the structurally durable public corpus that no other extraction surface can replicate, and the only one where the customer's testimony has been tied specifically to a federal authorizing official's risk-acceptance decision under FedRAMP NIST SP 800-53 Rev. 5 control baselines and FedRAMP Continuous Monitoring requirements that the customer's federal-contract revenue actively depends on as a continuing cloud-security-authorization contract.
This guide describes the extraction workflow for the FedRAMP ATO, FedRAMP JAB Provisional Authorization, FedRAMP Agency ATO, StateRAMP Authorization, DoD Impact Level Provisional Authorization, and CMMC Level 2/3 certification disclosure corpus.
Why a FedRAMP ATO or StateRAMP authorization mention beats almost every marketing-elicited testimonial
A FedRAMP ATO, FedRAMP JAB Provisional Authorization, FedRAMP Agency ATO, StateRAMP Authorization, DoD Impact Level Provisional Authorization, or CMMC Level 2/3 certification mention is a category of endorsement that has passed through filters no marketing-elicited testimonial encounters. Seven properties stack to make it one of the most adversarially credible cloud-security-authorization endorsement formats in modern B2B marketing.
First, the disclosure has been written under a cloud-security-authorization framework the customer has committed to follow. Public US government cloud-security authorization disclosures are governed by published statutes and frameworks — the FedRAMP authorization program under OMB Memorandum M-22-09 and the FedRAMP Authorization Act of 2022, the FedRAMP NIST SP 800-53 Rev. 5 control baselines (Low, Moderate, High), the FedRAMP Continuous Monitoring Strategy Guide, the StateRAMP framework operated by the StateRAMP Program Management Office, the DoD DISA Cloud Computing Security Requirements Guide (SRG) Version 1 Release 4, the DoD Risk Management Framework (RMF) under DoDI 8510.01, the CMMC 2.0 framework under 32 CFR Part 170, and the NIST SP 800-171 Rev. 2 protecting controlled unclassified information (CUI) framework. A product mention in a disclosure published under any of these frameworks is being made under a process that the customer has publicly committed to follow as a continuing cloud-security-authorization commitment. The cloud-security-authorization-framework property is what makes disclosure mentions more credible than mentions in any format that does not pass through a comparable procedural commitment.
Second, the disclosure is archived permanently in agency disclosure databases. Disclosure entries are preserved in the FedRAMP Marketplace (marketplace.fedramp.gov), the FedRAMP PMO authorization-package repository, the StateRAMP Authorized Product List (APL), the DoD DISA Cloud Service Catalog, the DoD eMASS (Enterprise Mission Assurance Support Service) registry, the Cyber AB CMMC Marketplace, and a long tail of agency archives operated under the customer's federal-contract-compliance obligations. A product mention in a disclosure publication is therefore preserved across multiple independent federal archives where any future federal information system security officer, federal contracting officer, federal authorizing official, customer, or competing vendor can retrieve the disclosure entry and compare it against the customer's current federal-authorization posture. The cross-agency-permanence property is what makes disclosure mentions more durable than mentions in any format without comparable multi-agency preservation.
Third, the disclosure has been scrutinized by 3PAOs, C3PAOs, and authorizing officials. The FedRAMP Third-Party Assessment Organization (3PAO) community accredited under FedRAMP PMO 3PAO accreditation, the CMMC Third-Party Assessment Organization (C3PAO) community accredited under the Cyber AB, the FedRAMP Joint Authorization Board comprising the CIOs of the General Services Administration (GSA), the Department of Homeland Security (DHS), and the Department of Defense (DoD), the FedRAMP Agency authorizing officials, the StateRAMP Program Management Office, the DoD DISA authorizing officials, and the DoD Service-component authorizing officials operate an active scrutiny culture in which authorization packages are reviewed under statutory authorization-decision authority, examined in continuous-monitoring and annual-assessment audits, and challenged in authorization-revocation actions, in FedRAMP Significant Change Requests, in FedRAMP Plans of Action and Milestones (POA&M) submissions, on FedRAMP and StateRAMP public-revocation pipelines, and in subsequent CMMC affirmation-dispute pipelines. A product mention in a disclosure publication is being read by authorizing officials and 3PAOs who have direct FedRAMP-accreditation-renewal and Cyber-AB-authorization incentives to surface any inaccuracy. The authorizing-official-and-3PAO-scrutiny property is what makes disclosure mentions more adversarially tested than mentions in any format without comparable authorizing-community exposure.
Fourth, the disclosure is anchored to a FedRAMP Package ID, a StateRAMP authorization ID, a DoD eMASS ID, and a CMMC certification ID. Disclosure entries are routinely tied to a specific FedRAMP Package ID (FR-prefixed numeric identifier visible on the FedRAMP Marketplace), a specific StateRAMP authorization ID, a specific DoD eMASS Authorization-Package ID, and a specific CMMC certification ID issued by a C3PAO — and the authorization-identifier becomes a stable reference that the customer's federal-contract-eligibility posture depends on as a federal-authorization contract. A product mention in a disclosure publication therefore inherits an authorization-identifier-anchored authority that establishes the mention was made at a precise, government-authorized point in the customer's cloud-security-authorization history. The authorization-identifier-anchor property is materially stronger than the equivalent on any format without comparable immutable-identifier coverage.
Fifth, the disclosure is cross-referenced by federal continuous-monitoring infrastructure. Continuous-monitoring tools — the FedRAMP Continuous Monitoring (ConMon) monthly deliverable pipeline, the FedRAMP Plans of Action and Milestones (POA&M) submission pipeline, the FedRAMP annual security assessment pipeline, the StateRAMP continuous-monitoring pipeline, the DoD eMASS continuous-monitoring module, and the DoD Continuous Authorization to Operate (cATO) re-assessment pipeline — and federal procurement tools — the GSA Federal Acquisition Service (FAS) cloud-procurement schedules, the DoD General Services Administration Federal Supply Schedule, the SAM.gov contract registry, the FPDS-NG federal procurement data system — routinely cross-reference disclosure entries against the customer's continuous-monitoring history and against the customer's federal-contract-eligibility posture. A product mention in a disclosure publication therefore inherits a continuous-monitoring cross-reference that establishes the mention's authenticity at the highest level of public federal cloud-security infrastructure. The continuous-monitoring-cross-reference property is what makes disclosure mentions more authority-anchored than mentions in any format without comparable federally indexed continuous-monitoring coverage.
Sixth, the disclosure is required by federal acquisition regulation. FedRAMP ATOs are mandated for federal cloud procurements under OMB Memorandum M-22-09. DoD Impact Level Provisional Authorizations are mandated for DoD cloud procurements under the DoD CIO Cloud Strategy and the DoD DISA Cloud SRG. CMMC Level 2/3 certifications will be mandated for DoD prime-and-subcontractor procurements under 32 CFR Part 170 (CMMC 2.0 Final Rule). StateRAMP authorizations are mandated for state-and-local-government cloud procurements in participating states. A product mention in a federal-acquisition-required disclosure is being made under statutory rules the customer cannot opt out of without losing federal-contract-eligibility in the corresponding procurement scope. The federal-acquisition-mandate property is what makes disclosure mentions more federal-revenue-load-bearing than mentions in any format without comparable federal-acquisition-pathway exposure.
Seventh, the disclosure is actively referenced by the customer's federal-contract pipeline. Subsequent federal Statement of Work (SOW) responses, federal contract task-order awards, federal Request for Proposal (RFP) responses, DoD Other Transaction Authority (OTA) responses, GSA Schedule modifications, and federal CSP-marketplace-listing renewals continuously re-read the disclosure entry as the source-of-truth for the customer's federal-authorization scope. A product mention in a disclosure publication is therefore not a one-time authorization but a continuously referenced authorization contract that the customer's federal-contract pipeline is actively responsible for maintaining. The federal-contract-pipeline-reference property is what makes disclosure mentions more operationally load-bearing than mentions in any format without comparable federal-procurement-pipeline coverage.
The corpus you should be extracting
The FedRAMP ATO, FedRAMP JAB Provisional Authorization, FedRAMP Agency ATO, StateRAMP Authorization, DoD Impact Level Provisional Authorization, and CMMC Level 2/3 certification corpus spans seven primary surfaces. Each surface produces a different authorization register, a different vocabulary register, and a different testimonial-extraction workflow.
First, the FedRAMP Joint Authorization Board (JAB) Provisional Authorization corpus — the FedRAMP authorization pathway where the JAB (CIOs of GSA, DHS, and DoD) issues a Provisional Authorization (P-ATO) for a Cloud Service Offering (CSO) after a FedRAMP PMO-coordinated 3PAO assessment. JAB P-ATO summaries are published on the FedRAMP Marketplace. A typical JAB P-ATO listing contains a FedRAMP Package ID, a Cloud Service Provider (CSP) name, a Cloud Service Offering (CSO) name, an impact level (Low, Moderate, or High), a Service Model classification (SaaS, PaaS, IaaS), a Deployment Model classification (Public, Private, Hybrid, Government Community), a Continuous Monitoring (ConMon) Status indicator, a list of leveraged-authorizations indicating which underlying CSOs the offering depends on, and the 3PAO of record. The leveraged-authorizations list and the System Security Plan (SSP) component descriptions are the primary product-mention extraction points.
Second, the FedRAMP Agency Authorization to Operate (ATO) corpus — the FedRAMP authorization pathway where a federal Agency authorizing official issues an ATO letter for a Cloud Service Offering after a FedRAMP PMO-coordinated 3PAO assessment. FedRAMP Agency ATO summaries are published on the FedRAMP Marketplace and on the sponsoring agency's authorization-disclosure pages. A typical Agency ATO listing contains a FedRAMP Package ID, a sponsoring-agency identification, a Cloud Service Provider name, a Cloud Service Offering name, an impact level (Low, Moderate, or High), a sponsoring-Agency authorizing official identification, an ATO letter date and ATO duration, an ATO Reuse Status indicator (Authorization Reuse status), and a list of leveraged-authorizations. The ATO Reuse Status and the leveraged-authorizations list are the primary product-mention extraction points. The FedRAMP Authorization Reuse pipeline (where one Agency's ATO can be reused by another Agency) is a particularly rich extraction surface where the customer's authorization-package references your product as an underlying CSO component.
Third, the FedRAMP Tailored Low-Impact SaaS (LI-SaaS) corpus — the FedRAMP-PMO-operated tailored low-impact pathway for SaaS offerings that handle low-impact federal data. FedRAMP LI-SaaS attestations are published on the FedRAMP Marketplace under the Tailored authorization-pathway category. A typical LI-SaaS attestation listing contains a FedRAMP Package ID, a Cloud Service Provider name, a Cloud Service Offering name, the LI-SaaS attestation date, the leveraged-authorizations list, and the 3PAO of record. The leveraged-authorizations list is the primary product-mention extraction point.
Fourth, the StateRAMP Authorized Product List (APL) corpus — the StateRAMP Program Management Office-operated state-and-local-government cloud-authorization pathway. StateRAMP authorizations are published on the StateRAMP APL (stateramp.org). A typical StateRAMP APL listing contains a StateRAMP authorization ID, a Cloud Service Provider name, a Cloud Service Offering name, an impact level (Low, Moderate, or High), a Verified or Authorized status, a sponsoring-state-or-locality identification, the 3PAO of record, and a list of leveraged-authorizations. The leveraged-authorizations list and the SSP component descriptions are the primary product-mention extraction points.
Fifth, the DoD Impact Level Provisional Authorization corpus — the DoD DISA cloud-authorization pathway operated under the DoD DISA Cloud Computing Security Requirements Guide (SRG). DoD Impact Level 2, 4, 5, and 6 Provisional Authorizations are published on the DoD DISA Cloud Service Catalog and tied to eMASS authorization-package records. A typical DoD IL Provisional Authorization listing contains an eMASS Authorization-Package ID, an Impact Level designation (IL2, IL4, IL5, or IL6), a Cloud Service Provider name, a Cloud Service Offering name, a DISA-issued Provisional Authorization date, a DISA authorizing-official identification, and a list of leveraged-authorizations. The leveraged-authorizations list and the SSP component descriptions are the primary product-mention extraction points. The IL5 and IL6 levels (which authorize DoD CUI and Classified data respectively) are particularly rich extraction surfaces.
Sixth, the CMMC Level 2 and Level 3 certification corpus — the CMMC Accreditation Body (Cyber AB)-operated cybersecurity-maturity-certification pathway under 32 CFR Part 170. CMMC Level 2 certifications are issued by C3PAOs and published on the Cyber AB CMMC Marketplace. CMMC Level 3 certifications are issued by the DoD Defense Industrial Base Cybersecurity Assessment Center (DIBCAC) and published in DoD CMMC certification registries. A typical CMMC Level 2 certification listing contains a CMMC certification ID, a C3PAO identification, a Cyber AB-Assessment date, an Organization Seeking Certification (OSC) identification, a CMMC Assessment Scope description, and the System Security Plan (SSP) component scope. The SSP component scope, the in-scope contractor information system, and the in-scope Controlled Unclassified Information (CUI) Asset list are the primary product-mention extraction points.
Seventh, the FedRAMP and StateRAMP Significant Change Request corpus — the post-authorization change-management pathway that requires CSPs to submit Significant Change Requests for any architectural changes that affect the authorization boundary. FedRAMP Significant Change Requests are documented in FedRAMP continuous-monitoring deliverables, and StateRAMP Significant Change Requests are documented in StateRAMP continuous-monitoring deliverables. A typical Significant Change Request includes a Package ID reference, a Change description, an updated SSP-component diagram, an updated leveraged-authorizations list, an updated POA&M (Plan of Action and Milestones), and a 3PAO-issued Significant Change Assessment. The updated SSP-component diagram and the updated leveraged-authorizations list are the primary product-mention extraction points.
The extraction workflow
The workflow has five stages. Each stage is operated by a separate team with separate tooling and separate output-format requirements. The workflow is designed to convert a customer's US government cloud-security authorization disclosure-archive history into a deployable testimonial library in approximately forty-eight hours per disclosure, with full audit-trail anchoring to the 3PAO and JAB-or-Agency authorizing-official engagement-reference infrastructure.
Stage one: corpus identification. Identify every FedRAMP JAB P-ATO, FedRAMP Agency ATO, FedRAMP LI-SaaS attestation, StateRAMP Authorization, DoD Impact Level Provisional Authorization, and CMMC Level 2/3 certification in which the customer has named your product as an underlying Cloud Service Offering component, a leveraged-authorization reference, a System Security Plan component, or an SSP-control-implementation dependency. Search the FedRAMP Marketplace for the customer's CSP name. Search the StateRAMP Authorized Product List for the customer's CSP name. Search the DoD DISA Cloud Service Catalog for the customer's CSP name. Search the Cyber AB CMMC Marketplace for the customer's CMMC certification holdings. The corpus-identification stage typically surfaces between five and fifty cloud-security-authorization disclosure artifacts per established federal-cloud-active customer. Store each artifact with its authorization-identifier (FedRAMP Package ID, StateRAMP authorization ID, eMASS Authorization-Package ID, or CMMC certification ID), its authorization-date, its authorization-scope (impact level, deployment model, service model), and its full archived disclosure content.
Stage two: product-mention extraction. Extract every mention of your product from the identified cloud-security-authorization disclosure artifacts. The extraction pattern depends on the disclosure format. For FedRAMP JAB P-ATO listings, scan the leveraged-authorizations list, the SSP component descriptions, and the 3PAO-of-record assessment notes for underlying-CSO-component matches. For FedRAMP Agency ATO listings, scan the ATO Reuse Status indicator and the leveraged-authorizations list for underlying-CSO-component matches. For FedRAMP LI-SaaS attestations, scan the leveraged-authorizations list for underlying-CSO-component matches. For StateRAMP APL listings, scan the leveraged-authorizations list and the SSP component descriptions for underlying-CSO-component matches. For DoD Impact Level Provisional Authorization listings, scan the leveraged-authorizations list and the SSP component descriptions for underlying-CSO-component matches. For CMMC Level 2/3 certification listings, scan the SSP component scope and the in-scope CUI Asset list for cybersecurity-control-implementation matches. For FedRAMP and StateRAMP Significant Change Requests, scan the updated leveraged-authorizations list and the updated SSP-component diagram for new-or-modified component matches. Record the authorization-identifier, the authorization-date, the authorization-scope, the 3PAO or C3PAO of record, the JAB-or-Agency authorizing-official identification, the surrounding disclosure context, and the published archive URL for each extracted mention.
Stage three: authorization-identifier-anchor verification. Verify the authorization-identifier anchor for every extracted mention. Confirm the FedRAMP Package ID against the FedRAMP Marketplace. Confirm the StateRAMP authorization ID against the StateRAMP APL. Confirm the eMASS Authorization-Package ID against the DoD DISA Cloud Service Catalog. Confirm the CMMC certification ID against the Cyber AB CMMC Marketplace. Confirm the 3PAO accreditation against the FedRAMP PMO 3PAO accreditation list. Confirm the C3PAO accreditation against the Cyber AB C3PAO registry. Document the authorization-identifier-anchor verification for each mention. Mentions without verified authorization-identifier anchors are downgraded to lower-credibility tier and excluded from federal-acquisition-pathway-specific testimonials.
Stage four: federal-acquisition-pathway classification. Classify each extracted mention by the federal-acquisition pathway it supports. Mentions that appear in FedRAMP JAB P-ATO, FedRAMP Agency ATO, or FedRAMP LI-SaaS attestations are classified as federal-civilian-cloud-procurement-load-bearing. Mentions that appear in StateRAMP Authorizations are classified as state-and-local-government-cloud-procurement-load-bearing. Mentions that appear in DoD Impact Level Provisional Authorizations are classified as DoD-cloud-procurement-load-bearing, with sub-classifications by impact level (IL2 for unclassified, IL4 for CUI, IL5 for CUI-with-NSS-restrictions, IL6 for Classified). Mentions that appear in CMMC Level 2/3 certifications are classified as DoD-DIB-contractor-procurement-load-bearing. The classification determines the appropriate testimonial-deployment surface.
Stage five: testimonial-asset packaging. Package each verified, classified product-mention into a deployable testimonial asset. The testimonial asset contains the customer-CSP attribution, the customer-CSO-name reference, the disclosure-format reference (FedRAMP JAB P-ATO, FedRAMP Agency ATO, FedRAMP LI-SaaS, StateRAMP Authorization, DoD IL2/IL4/IL5/IL6 Provisional Authorization, or CMMC Level 2/3 certification), the authorization-identifier anchor (FedRAMP Package ID, StateRAMP authorization ID, eMASS Authorization-Package ID, or CMMC certification ID), the authorization-date, the 3PAO or C3PAO of record, the JAB-or-Agency authorizing-official identification, the authorization-scope (impact level, deployment model, service model), the published archive URL, the federal-acquisition-pathway classification, and the authorization-identifier-anchor verification record. The packaged asset is then released through the proof-deployment pipeline.
Where to deploy US-government-cloud-security-authorization-extracted testimonials
US-government-cloud-security-authorization-extracted testimonials deploy most effectively in five surfaces. First, on the federal-civilian-cloud-customer-acquisition page — where federal civilian agency cloud procurement officers explicitly look for FedRAMP-authorization evidence and where a FedRAMP-JAB-P-ATO-or-Agency-ATO-archived testimonial proves the FedRAMP-authorization-compatibility claim. Second, on the DoD-cloud-customer-acquisition page — where DoD cloud procurement officers explicitly look for DoD Impact Level Provisional Authorization evidence and where a DoD-IL5-or-IL6-archived testimonial proves the DoD-cloud-authorization-program-maturity claim. Third, on the state-and-local-government-customer-acquisition page — where state-and-local-government cloud procurement officers explicitly look for StateRAMP-authorization evidence and where a StateRAMP-Authorized-Product-List-archived testimonial proves the StateRAMP-authorization-compatibility claim. Fourth, on the DoD-DIB-contractor-customer-acquisition page — where DoD Defense Industrial Base contractors explicitly look for CMMC-certification evidence and where a CMMC-Level-2-or-Level-3-certification-archived testimonial proves the CMMC-certification-program-maturity claim. Fifth, on the federal-continuous-monitoring page — where federal-continuous-monitoring buyers look for ConMon-pipeline evidence and where a FedRAMP-Continuous-Monitoring-archived testimonial proves the continuous-monitoring-program-maturity claim.
The asset-packaging stage produces the same artifact for all five surfaces. The deployment stage decides which surface each asset is most credibility-load-bearing for, and applies the corresponding presentation pattern.
What ProofShow automates
ProofShow operates the corpus-identification, the product-mention extraction, the authorization-identifier-anchor verification, the federal-acquisition-pathway classification, and the testimonial-asset packaging stages as a single end-to-end pipeline. Customers connect their FedRAMP Marketplace, StateRAMP APL, DoD DISA Cloud Service Catalog, and Cyber AB CMMC Marketplace query scope, and ProofShow operates the pipeline continuously, surfacing newly published US government cloud-security authorization disclosure entries as they are issued and committed to the federal-disclosure infrastructure. The customer's marketing team receives a continuously refreshed library of authorization-identifier-anchored, federal-acquisition-pathway-classified, US-government-cloud-security-cleared product mentions that no marketing-elicited testimonial-collection program could ever match.
For the structural-format guidance that informs the testimonial-asset packaging stage, see the FDA 510(k) and CE marking extraction guide, the SOC 2 and ISO 27001 extraction guide, the SBOM and VEX extraction guide, the bug bounty extraction guide, and the SEC filing extraction guide.