{"id":"FR2701857797","name":"9line","provider":"Optimal Labs","providerSlug":"optimal-labs","status":"Initial Implementation","impact":"Not yet listed","authType":"Program","serviceModel":["SaaS"],"deployment":"Government Community Cloud","businessFunctions":["Cybersecurity & Risk Management","Artificial Intelligence (AI)","Development Tools"],"smallBusiness":false,"website":"https://gooptimal.io/nineline","description":"9line tells agencies which vulnerabilities in their software and AI supply chain actually affect them, with evidence an assessor can re-check. A customer submits a repository or container image through the web application or API. 9line generates a CycloneDX SBOM, inventories the AI models and agents it contains, matches components against vulnerability data, and determines whether each vulnerable code path is reachable using a deterministic call-graph engine. It returns a VEX document in which every statement carries its evidence. An in-boundary model (Amazon Bedrock in AWS GovCloud) explains verdicts but cannot clear a finding.","logo":"https://gooptimal.io/optimal-logo.svg","inMarketplace":false,"agencies":[],"reuseCount":0,"leverages":[],"leveragedBy":[],"cr26":{"type":"20x","ocrOverdue":false,"valid":true,"findings":[{"level":"warning","message":"no trust center link; CR26 requires one with access instructions","rule":"CDS-CSO-UTC"},{"level":"warning","message":"no link to secure configuration guidance","rule":"SCG-CSO-RSC"},{"level":"warning","message":"no next Ongoing Certification Report date","rule":"CDS-CSO-PUB"},{"level":"warning","message":"no FedRAMP Recognized assessor listed","rule":"CDS-CSO-PUB"},{"level":"warning","message":"no service list; CR26 requires the services in scope","rule":"CDS-CSO-SVC"}]},"timeline":[{"date":"2026-10-19","to":"Initial Implementation","certType":"20x"}],"trustCenterCheck":null}