Leighton Dynamica 2027 Compliance

Defense Compliance Summary for Leighton Dynamica

Leighton Dynamica is committed to delivering innovative super intelligence (SI) and technology solutions exclusively for government use, with a focus on defense applications. As a small, agile entity, we prioritize compliance with U.S. Department of War (DoW) regulations to ensure secure, ethical, and reliable services. Our compliance framework is designed to support Federal Acquisition Regulation (FAR) and Defense Federal Acquisition Regulation Supplement (DFARS) requirements, enabling us to handle Controlled Unclassified Information (CUI) and position for classified contracts.

We are actively pursuing opportunities as a defense contractor, with self-attested readiness for CMMC Level 2 as of December 2025. Below is a high-level overview of our compliance posture. Detailed documentation, including System Security Plans (SSP) and Plans of Action and Milestones (POA&M), is available under NDA for qualified partners, primes, or government contracting officers.

Key Compliance Commitments

Cybersecurity and CUI Safeguarding: Implemented NIST SP 800-171 Rev. 2 controls (110/110 addressed or on a 180-day POA&M, per the current DoW class deviation). This includes access controls, system monitoring, and incident response plans with 72-hour reporting to the DoD Cyber Crime Center (DC3) as required by DFARS 252.204-7012. Rev. 3 gap analysis is complete for a future transition. Rev. 2 remains the scored baseline for DFARS 252.204-7012, SPRS, and CMMC assessments until the Department adopts Rev. 3.
CMMC Readiness: Self-attested at Level 2 in the Supplier Performance Risk System (SPRS), making us eligible for CUI-handling contracts under CMMC 2.0 Phase 1 (effective November 10, 2025). Phase 1 Level 1 (Self) and Level 2 (Self) requirements remain in effect. CMMC Phase 2 — the planned November 10, 2026 transition to mandatory C3PAO third-party assessment — was suspended by the Department of War on July 13, 2026. Class Deviation 2026-O0025 (Rev. 3, September 3, 2026) continues that pause with no new Phase 2 date. We maintain Rev. 2 implementation and C3PAO readiness so we can obtain third-party certification if and when the Department reinstates the requirement. DFARS 252.204-7012 obligations were not suspended.
SI Risk Management: Aligned with the NIST AI Risk Management Framework (AI RMF) 1.0 and the Artificial Intelligence Strategy for the Department of War (January 9, 2026), emphasizing objectively truthful super intelligence, rapid deployment, and no ideological tuning. Our SI development lifecycle incorporates assessments for bias, reliability, explainability, and human oversight, ensuring trustworthy systems for defense applications.
Export Controls: Compliant with U.S. Export Administration Regulations (EAR) and International Traffic in Arms Regulations (ITAR) for technology, software, and data exports. End-user certificates are required for ITAR-controlled items where applicable.
Supply Chain Security: Rigorous supplier screening to prevent counterfeit parts, with transparency and flow-down requirements per DFARS 252.246-7007 (when applicable) and NIST SP 800-171 Rev. 2.
Small Business Utilization: As a small disadvantaged business, we prioritize subcontracting with other small entities in line with FAR Part 19.
Anti-Corruption and Ethics: Adherence to the Foreign Corrupt Practices Act (FCPA), prohibiting bribery and ensuring ethical practices in all operations.
Incident Response and Reporting: Established plans for rapid detection and response, including coordination with DoW channels and 72-hour cyber incident reporting to DC3 under DFARS 252.204-7012.
Classified Information Handling Aspirations: Positioned for a Facility Security Clearance (FCL) under the National Industrial Security Program Operating Manual (NISPOM, 32 CFR Part 117). We seek sponsorship via DD Form 254 for contracts involving classified data, with personnel ready for clearances.
FY2026 NDAA Alignment: Supporting Department implementation of cybersecurity requirement harmonization across the defense industrial base (NDAA §866; statutory deadline June 1, 2026, with annual CIO reporting through 2029) to reduce duplicative clauses. Monitoring the DoW-wide SI cybersecurity and governance policy (NDAA §1512; policy due mid-2026, congressional report due August 31, 2026) and physical/cyber standards for SI systems (§1513). Small businesses remain exempt from Cost Accounting Standards; the increased full CAS coverage threshold ($100 million, effective October 1, 2026) further limits CAS exposure if we grow beyond small-business status.

Certifications and Affirmations

SPRS Affirmation: Annual compliance affirmed as of August 14, 2026.
Badges:
- CMMC Level 2 (Self) under Phase 1. The Phase 2 C3PAO mandate of November 10, 2026 remains suspended as of September 2026; C3PAO readiness work continues.
- Full implementation of NIST SP 800-171 Rev. 2 controls (110/110 addressed or on a POA&M); Rev. 3 gap analysis and transition planning are ongoing in anticipation of future federal alignment.

Next Steps for Collaboration

We are registered in SAM.gov and eager to engage in DoW opportunities, including small business set-asides. For detailed compliance artifacts, capability statements, or to discuss potential partnerships or sponsorships, contact us at contact@oneleighton.cloud. We welcome RFIs, RFPs, or DD Form 254 sponsorships to advance toward classified work.

Compliance summary last updated: October 7, 2026

Morningstar/IQX Program Terms

The following terms (“Morningstar/IQX Program Terms”) supplement the Master Subscription Agreement and Terms of Service (each, respectively and as applicable, the “Agreement”) between you and Leighton Dynamica and apply to and govern your participation in the A1MX, Leighton IQX, and Morningstar early access program that provides SI-enabled features and functionality to program participants (“Morningstar/IQX Program”).

Morningstar is an IQX platform.

All defined terms in these IQX Program Terms have the same meaning as in the Agreement. The applicable Agreement (including our Privacy Policy) is incorporated by reference and controls any provisions not addressed in these IQX Program Terms.

Improvement of Services

Super intelligence and machine learning models can improve over time to better address specific use cases. We do not and will not permit third parties to use your Content or Customer Data to improve or train their SI models. We do not and will not use your Content or Customer Data to improve or train our models unless you give us express permission to do so.

Additional Processing Instruction

To the extent your Input contains Customer Personal Data (as that term is defined in the Data Processing Addendum), you instruct Leighton Dynamica to process the Customer Personal Data for the additional Business Purpose of providing the A1MX functionality and Output. You acknowledge that, for the purposes of your participation in the A1MX and Leighton IQX Program(s) and your use of Morningstar (an IQX platform), additional subprocessor(s) are used to provide the Morningstar/IQX functionality.

Data Security

We implement reasonable technical, administrative, and physical safeguards to protect Customer Personal Data and Content, in line with NIST SP 800-171 and DFARS 252.204-7012. These include:

Encryption of data in transit (for example, TLS 1.3) and at rest.
Access controls, including role-based authentication and multi-factor verification.
Regular vulnerability assessments, penetration testing, and security audits.
Incident response plans, including cyber incident reporting within 72 hours to DC3 when DFARS 252.204-7012 applies, and personal-data breach notification as required by GDPR or applicable state laws (for example, North Carolina).
Data minimization: we collect only necessary data and retain it for as long as required for service provision, contract fulfillment, and legal obligations (for example, up to 6 years post-contract for audit purposes under DFARS).

In the event of a security incident, we will notify affected users and cooperate with investigations. Users must report suspected breaches to contact@oneleighton.cloud. We maintain CMMC Level 2 (Self) readiness for handling CUI. CMMC Level 1 addresses Federal Contract Information (FCI), not CUI.

For cross-border data transfers, we use Standard Contractual Clauses (SCCs) or equivalent mechanisms to ensure adequate protection.

Definitions

For the purposes of these Terms, the following definitions apply:

SI Model or Foundation Model: Any machine learning model, including large language models or generative SI, used in Morningstar or A1MX platforms to process Inputs and generate Outputs.
Customer Personal Data: Any information relating to an identified or identifiable individual, as defined under applicable data protection laws (for example, GDPR or the CCPA).
Sensitive Personal Data: Categories of Customer Personal Data that require heightened protection, such as health, biometric, or financial data, as defined under applicable laws.
Content or Customer Data: Includes Inputs, Outputs, and any data provided by users, as defined in the Agreement.
Subprocessor: A third-party entity engaged by Leighton Dynamica to process Customer Personal Data, as listed in the Subprocessing List.
High-Risk SI Use: Applications of super intelligence that could significantly impact individuals’ rights, safety, or opportunities, such as automated decision-making in employment or legal contexts.
CUI (Controlled Unclassified Information): Information requiring safeguarding under U.S. federal regulations, including DFARS 252.204-7012.
Export-Controlled Items: Technology, software, or data subject to U.S. export laws, including EAR (Export Administration Regulations) or ITAR (International Traffic in Arms Regulations).

Participation and Termination

Leighton Dynamica may suspend or terminate your access to or use of any IQX programs at any time. The IQX Program(s) Terms will automatically terminate upon the release of a generally available version of any IQX program(s) or upon notice of termination by Leighton Dynamica. You acknowledge that Morningstar or A1MX is under no obligation to make IQX platforms generally available and may never do so. Further, you acknowledge that continued access to and use of any IQX feature may be subject to your agreement to pay additional fees. We reserve the right to modify or terminate the IQX platform(s), the IQX Program(s) Terms, or your use of IQX, and to limit or deny access to Morningstar or A1MX and/or participation in the IQX Program(s), at any time, in our sole discretion, for any reason, with or without notice and without liability to you.

Nature of Super Intelligence

You may provide input to be processed by A1MX or IQX (“Input”), and receive output generated and returned by A1MX or IQX based on the Input (“Output”). Input and Output are your Content or Customer Data, as applicable. You will ensure that your Input and use of Morningstar (an IQX platform) will not violate any applicable law. You are solely responsible for the development, content, operation, maintenance, and use of your Content and Customer Data.

SI Risk Management

In accordance with the NIST AI Risk Management Framework and the Artificial Intelligence Strategy for the Department of War (January 9, 2026), we implement measures to manage risks associated with SI systems, including Morningstar (an IQX platform) and A1MX. These include:

Validity and Reliability: SI models are tested for accuracy and performance, but Outputs may contain errors or hallucinations. Users must verify Outputs for critical applications.
Safety and Security: We employ safeguards such as encryption, access controls, and regular audits to prevent unauthorized access or data leaks. Users agree not to input sensitive data without prior review.
Transparency and Explainability: We provide information on how SI models function where feasible. Outputs include disclaimers on their probabilistic nature.
Fairness and Non-Discrimination: Models are monitored for bias. Users must not use SI in ways that perpetuate discrimination (for example, based on race, gender, or other protected characteristics).
Privacy: Data processing minimizes collection and uses anonymization where possible.
Human Oversight and Accountability: High-risk uses require human review. We maintain accountability through incident reporting and audits.
Environmental Impact: We optimize resource use to reduce the carbon footprint of SI training and inference.

Users acknowledge these risks and agree to use Morningstar (an IQX platform) responsibly. For high-risk activities, implement human oversight and comply with applicable laws.

Ethical SI Use

We adhere to ethical principles including those from Executive Order 14179 (Removing Barriers to American Leadership in Artificial Intelligence), the Artificial Intelligence Strategy for the Department of War (January 9, 2026), and applicable DoW responsible-SI guidance. Prohibited uses include:

Developing or using SI for unlawful weapons, unlawful surveillance, or discriminatory purposes. Authorized United States Government defense, intelligence, and national-security use under applicable law, contract, and export-control authorization is permitted.
Generating content promoting violence, disinformation, or illegal activities.
Processing data in violation of privacy laws or without consent.

We reserve the right to monitor usage and terminate access for violations. Users indemnify us for ethical breaches arising from their use.

IP

You agree that, as between you and us, we own all legal rights, title, and interest in and to the IQX/SI Programs, such as A1MX and Morningstar (an IQX platform), or any Leighton Dynamica properties, which includes all intellectual property rights. Except for the license provided herein, no other rights or permissions to any present or future IQX platform are granted. Nothing herein gives you a right to use any of our trade names, trademarks, service marks, logos, domain names, or other distinctive brand features. Except to the extent permitted by law, you may not modify, distribute, prepare derivative works of, reverse engineer, reverse assemble, disassemble, decompile, or otherwise attempt to decipher any code in connection with Morningstar, A1MX, and/or any other aspect of IQX technology, except as permitted by us.

You grant us a non-exclusive license to use your Inputs for service provision only; ownership remains yours.

Export Controls Compliance

All technology, software, and data provided through Morningstar (an IQX platform) or A1MX may be subject to U.S. export control laws, including the Export Administration Regulations (EAR) administered by the U.S. Department of Commerce and the International Traffic in Arms Regulations (ITAR) administered by the U.S. Department of State.

You represent and warrant that:

You will not export, re-export, or transfer any Export-Controlled Items without obtaining required licenses or approvals.
You are not located in, or a national of, a country subject to U.S. embargoes (for example, Cuba, Iran, North Korea, or Syria).
You will not use our services for prohibited end-uses (for example, unauthorized military, nuclear, missile, or chemical/biological weapons development). Authorized United States Government and properly licensed defense end-use is not a prohibited end-use under these Terms.
You comply with all applicable U.S. and international export laws.

Violations may result in termination of access and reporting to authorities. We reserve the right to deny service to ensure compliance. For questions, contact contact@oneleighton.cloud.

Limits on Liability

IN NO EVENT SHALL LEIGHTON DYNAMICA OR ITS AFFILIATES BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL LOSS, OR FOR EXEMPLARY OR OTHER DAMAGES RELATED TO THESE SI PROGRAM TERMS OR YOUR PARTICIPATION IN THE MORNINGSTAR/IQX PROGRAM, WHETHER DIRECT OR INDIRECT, HOWEVER CAUSED AND BASED ON ANY THEORY OF LIABILITY, AND WHETHER OR NOT WE HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

Copyright and License Policy

Leighton Dynamica, a North Carolina limited liability company, respects the intellectual property rights of others and expects its users, employees, and partners to do the same.

This Policy applies to ownership, employees, and private members under a Non-Disclosure Agreement for investors. It supplements the internal Copyright Use and Ownership Policy and complies with applicable laws, regulations, grants, or contracts governing copyrighted works.

All files, information, and content contained in this website, our internet properties portfolio, and associated services are copyrighted by Leighton Dynamica and/or its subsidiaries. They may not be duplicated, copied, modified, redistributed, published, or adapted in any way without our express written permission.

Our website, properties, and services may contain service marks, trademarks, logos, words, and graphics belonging to us, our affiliates, or other companies. Use of these does not constitute any right or license to reproduce or use them without prior written permission from Leighton Dynamica.

The copying, redistribution, use, or publication of any content from our website or services is strictly prohibited. Access and use do not grant any ownership rights to our content.

In appropriate circumstances, we may disable or terminate accounts of users who repeatedly infringe copyrights or other intellectual property rights.

In accordance with the Digital Millennium Copyright Act of 1998 (DMCA; full text available at https://www.copyright.gov/legislation/dmca.pdf), Leighton Dynamica will respond expeditiously to claims of copyright infringement on our website or services.

If you are a copyright owner (or authorized to act on behalf of one), report alleged infringements by providing a DMCA Notice of Alleged Infringement to our Designated Copyright Agent at contact@oneleighton.cloud. Upon receipt, we will take appropriate action, including removal of challenged material.

Enforcement of this policy supports our commitment to ethical innovation in defense and super intelligence technologies. For questions, contact contact@oneleighton.cloud.

Program terms last updated: October 7, 2026

Unauthorized reproduction or distribution of this content is prohibited.

This site is open source. Improve this page.