generated: '2026-07-20'
method: searched
source: https://minimus.io/trust-center
description: >-
  Cross-cutting standards and compliance conformance for Minimus, asserted from
  the Trust Center and product documentation. Minimus is a hardened container
  image provider; conformance is framed around supply-chain and image-security
  standards rather than API interchange standards.
conformance:
- id: soc2
  conforms: true
  evidence: 'Trust Center: "Minimus is both SOC-2 and ISO 27001 certified."'
- id: iso27001
  conforms: true
  evidence: 'Trust Center: "Minimus is both SOC-2 and ISO 27001 certified."'
- id: fips
  conforms: true
  evidence: 'Product: FIPS-validated / FIPS-compliant images.'
- id: nist-800-190
  conforms: true
  evidence: 'Product: images built for NIST 800-190 container security.'
- id: cis-benchmark
  conforms: true
  evidence: 'Product: CIS-compliant hardened images.'
- id: stig
  conforms: true
  evidence: 'Product: STIG-compliant images.'
- id: fedramp
  conforms: true
  evidence: 'Product: images built to support FedRAMP-aligned deployments.'
- id: oci-image-spec
  conforms: true
  evidence: 'Minimus distributes standard OCI container images pulled with standard tooling (docker/crane); MinimOS uses apk repositories.'
- id: sbom
  conforms: true
  evidence: 'Supply-chain protection and audit-ready provenance are core marketed features of the hardened images.'
- id: slsa-l3
  conforms: true
  evidence: 'Docs (compliance/slsa): "Minimus adheres to the SLSA L3 standard for assuring software supply chain security."'
- id: fips-140-3
  conforms: true
  evidence: 'Docs (compliance/fips): FIPS 140-3 validated Minimus images (OpenSSL and Java FIPS modules).'
- id: oauth2
  conforms: false
  evidence: 'No documented OAuth2 API surface; minicli uses a static bearer token (MINICLI_TOKEN).'
- id: rfc9457
  conforms: false
  evidence: 'No public REST API / problem+json error catalog documented.'