UnityTechLabs
A live CMMC Level 2 reference network — built and operated in the open by DATAROSS LLCA network that is secure only while its design is secret is a network that will fail. UnityTechLabs publishes its topology, address plan, every one of its 110 NIST SP 800-171 controls with the system that implements it and the check that proves it, its scripts, its policies, its compliance score, and cryptographic proof that its audit trail is unbroken. You are invited to scrutinize all of it.
Live proof PUBLIC
These numbers are published snapshots generated by the one-way publish pipeline — this site has no live connection into the network and no server-side code.
The idea, in one table
| Principle | What it means here |
|---|---|
| Kerckhoffs's principle | Security may depend on keys, never on secrecy of the design. So the design is public. |
| Born compliant | Every server is created by one build path that assigns identity, certificates, guard, monitoring, backup, and its CMMC controls before it takes traffic. |
| Fail toward reachable | Every security control can revert itself. A control that can lock out its own operators is a bigger risk than the threat it mitigates. |
| Generated, not written | Inventory, the System Security Plan, the POA&M, and this site are rendered from live data. Hand-written truth drifts; generated truth is checked. |
| Withholding is published | If something is hidden, the fact that it is hidden — and who, what, when, where, why, how — is public. |
The design PUBLIC
- Network: a real enterprise topology run as dedicated VMs — core switch pair (VXLAN), edge firewall pair (VRRP, iptables-only, inline IDS/IPS), internal router, WLAN controller, on-site VPN servers, DHCP HA pair, DNS ×3, NTP. WAN uplinks arrive as tagged VLAN slots 301–305 so the ISP behind a slot can change at any time without a redesign.
- Segments: 314 infrastructure/management · 315 user LAN · 316 DMZ (this site's origin mirror lives here) · 317 guest · 318 IoT · 319 out-of-band. Three equal fabrics: LAN, WireGuard mesh, OpenVPN.
- Identity & trust: internal PKI issuing host, service, and SSH certificates; an AD-compatible directory; single sign-on with MFA; secrets in a vault with automatic unseal.
- Control plane: one small "authority" server that only builds, commands, and records — everything else is its own VM, and an always-on anchor stays up when the hypervisors do not.
- Observability: SIEM, host intrusion detection with CIS benchmarks as compliance evidence, metrics, availability monitors auto-registered at birth, and an append-only audit ledger where every record carries the hash of the one before it.
Full blueprints: DR-FOUNDATION-BLUEPRINT · DR-WAN-EDGE · DR-SAFE-OPS · the 110-control matrix (links activate at first publish)
Hidden by design SECRET RESTRICTED
Transparency does not mean publishing the keys. The line is a single question: does disclosure hand an attacker a capability they did not already have? Everything below is withheld — and this register is generated from the same classification data that gates publishing, so it is always current.
| What | Who decides | When | Where it lives | Why | How enforced |
|---|---|---|---|---|---|
| Private keys, passwords, API tokens, MFA seeds, VPN private keys | classification rule, not a judgment call | always | vault only | possession = capability | secret scanner blocks publish; rotation on exposure |
| Open findings on a named host (unpatched CVE, failed control) | classification rule; operator verifies the fix | until remediation is verified (≤30 days; critical ≤7) | internal docs | disclosure before the fix opens a window | auto-declassifies to a public post-mortem on verified fix |
| People's personal data, physical location, rack/camera/UPS placement | privacy law + physical-security controls | always | physical records | transparency cannot protect a door | never inventoried in public objects |
| Raw audit-log rows (full commands, operator source IPs) | classification rule | always | SIEM (authenticated) | mixed content | the site shows ledger roots and counts, never rows |
| Alerting phone numbers, inboxes, webhooks | classification rule | always | configuration | abuse vector | published as "SMS ×2, email ×3, chat" |
Verify it yourself
- This site is authentic: every release ships
SHA256SUMSand a signature; the signing public key is published here. (key publishes at first release) - The audit trail is unbroken: the daily ledger root above is the SHA-256 head of a hash chain; a changed or deleted record changes every root after it.
- The compliance score is real: the score JSON lists each of the 110 controls, its implementing system, its automated check, and the last result.
Found something? Good.
Researchers, auditors, students, and adversaries are welcome. Report via /.well-known/security.txt (RFC 9116). Confirmed findings are fixed, then published as post-mortems with dates, and reporters are credited on the Hall of Fame. (security.txt and Hall of Fame publish with the first release)
Where this is going
UnityTechLabs is being established as its own IT-services company. The reference network above is the first proof; the rest is being built in this order, and nothing below is live until it says so here.
Status line, kept honest: reference network — documented · library — planned · services — planned · live query — planned
Why this exists
UnityTechLabs is DATAROSS LLC's working demonstration that a small organization can run a CMMC Level 2–aligned network with a continuously self-assessed score, generated documentation, and an audit trail anyone can verify — and can do it in the open. It is the reference model for the compliance work we deliver to defense-contractor clients. It is assessment-ready and continuously self-assessed; formal CMMC Level 2 certification is conferred only by a third-party assessment, and we say so plainly.