What's Inside a DigVel Software Approval Report
Last updated: September 9, 2026
1. Overview
Every engagement ends in a written report your team can act on and your C3PAO auditor can trust — not a dashboard or an abstract risk score. The exact structure depends on which tier you order; see our pricing and methodology for how each report is produced, and the control mapping for how findings tie back to NIST SP 800-171.
2. Tier 1 Report — OSINT Screening
A Tier 1 report is built for a fast Go/No-Go decision and includes:
- A clear Go / Conditional Go / No-Go decision banner.
- Sanctions and FOCI (Foreign Ownership, Control, or Influence) screening results.
- Vulnerability Disclosure Program (VDP) status and historical CVE remediation speed.
- Accreditation and infrastructure hygiene findings (certifications, download integrity).
- Where relevant, compensating controls to consider if you proceed despite a flagged risk.
3. Tier 2 Report — Full Evaluation
A Tier 2 report includes everything in Tier 1, plus the results of sandbox dynamic analysis:
- Network telemetry — every outbound/inbound connection the software made, with IPs, domains, and ports.
- Filesystem & persistence findings — installation paths, dropped files, scheduled tasks, and registry changes.
- Execution environment findings — whether the software required elevated privileges it didn't need.
- Trust chain validation — certificate and signature status for the installer and its dependencies.
- A hardening blueprint — concrete allowlist, firewall, and privilege recommendations for your deployment.
- A table mapping every finding to the specific NIST SP 800-171 control it supports, ready to attach to your System Security Plan (SSP).
4. Request a Sample Report
Leave your work email and we'll follow up with a redacted, white-label sample report so your team can see the format before ordering.