{"resourceId":"anthropic-cvp-bedrock-access-limited-retention-exemption-20261006","versions":[{"version":"external-634640bbc8712dafeacf4eee6047847aef8330cd501be10a6a2368479df5cd16","resource":{"id":"anthropic-cvp-bedrock-access-limited-retention-exemption-20261006","title":"Anthropic's Cyber Verification Program page: on Amazon Bedrock, CVP access is limited to organizations with a data retention exemption until Enterprise Frontier Safeguards is available","organization":"Anthropic","sector":"Model provider access policy (affects AWS GovCloud and Bedrock customers)","geography":"Global (applies to Amazon Bedrock including GovCloud availability)","publishedAt":"2026-10-06","publicationDate":"2026-10-06","eventDate":"2026-11-09","sourceName":"Claude Help Center","sourceLabel":"Cyber Verification Program","sourceUrl":"https://support.claude.com/en/articles/14604842-cyber-verification-program","evidenceClass":"vendor-claim","outcomeClass":"cautionary","topics":["governance-procurement","data-security"],"finding":"Anthropic's help article on the Cyber Verification Program (stating an October 6, 2026 update and showing 'Updated today' at retrieval) says that Bedrock does not yet support human review of automated safety flags, which CVP requires by default. For now, CVP on Bedrock is available only to organizations with a data retention exemption; once Enterprise Frontier Safeguards (EFS) is available, Bedrock organizations in EFS can apply. The page lists Amazon Bedrock as requiring EFS and advises contacting the account team about an exemption. Why now: AWS's November 9 GovCloud Mythos 5.2 announcement directs eligible customers to this program.","sledRelevance":"Explains a practical gate for public-sector security teams expecting to use Mythos 5.2 in GovCloud: approval depends on Anthropic's program, and Bedrock-specific conditions (retention exemption or future EFS) apply. This is the main access constraint behind the AWS announcement.","evidence":"Model provider's own policy documentation; authoritative for Anthropic's program terms but not independent of the AWS/Anthropic partnership.","architectureImplications":"Access is linked through the Anthropic Verification Portal to AWS accounts (up to 10 linked accounts), separate from AWS IAM. Bedrock tier activation depends on EFS once available.","governanceImplications":"Introduces a second governance relationship (Anthropic) alongside the AWS contract. Agencies must track program tiers, approved-user limits and prohibited activities.","securityPrivacyImplications":"Program prohibits activities such as denial-of-service and data destruction; data retention is required for enrolled users unless exempt.","caveats":"Help-center article that can change without notice; it is not GovCloud-specific and does not say how the GovCloud offering maps to EFS or exemptions. Publication date reflects the stated October 6 update; page showed 'Updated today' at retrieval.","streamIds":["aws"],"roles":{"sales":"Interpretation: use this to set expectations before anyone promises Mythos access. The customer problem is that a GovCloud security team sees the AWS announcement but cannot simply enable the model. Stakeholders include the CISO, the AWS account team and legal or procurement staff who manage data-retention terms. Discovery should establish whether the organization holds a retention exemption, whether it plans to join EFS, and who will own the Anthropic relationship. Do not imply that buying through AWS guarantees eligibility or a timeline.","engineering":"Interpretation: engineers should treat CVP as an external dependency layered on Bedrock. Linking accounts happens through Anthropic's portal, separate from AWS IAM, so account inventory and admin roles matter. Prerequisites are an Anthropic organization, linked AWS accounts and either a retention exemption or EFS enrollment. Constraints include unknown EFS timing and the absence of GovCloud-specific instructions. A proof of value is simply confirming, in a test account, that the tier activates and that retention settings match policy before any code is analyzed.","delivery":"Interpretation: delivery work is access readiness. Dependencies are Anthropic program approval, the AWS account team for exemptions and the agency's legal review of program terms. Ownership should sit with the security program office. Governance checkpoints include recording the approved tier and user limit, confirming retention status and documenting prohibited activities in rules of engagement. Proposed acceptance criteria: approval documented, accounts linked and tier visible before pilot start. Risks are delays and staff assuming access that has not been granted."},"roleDetails":{"sales":{"customerProblem":"GovCloud security teams cannot use the announced Mythos 5.2 model until a separate Anthropic verification and Bedrock-specific conditions are met.","stakeholders":["CISO","AWS account team","Legal / procurement (data retention terms)"],"discoveryQuestions":["Does the organization hold a data retention exemption?","Will it enroll in Enterprise Frontier Safeguards when available?","Who will own the Anthropic program relationship?"],"valueHypothesis":"Clarifying the access path early avoids stalled pilots and mismatched expectations.","potentialEngagement":"Access-readiness assessment covering CVP eligibility, retention status and account linking.","unsupportedClaims":["Guaranteed access through AWS purchase","Approval timelines","GovCloud-specific procedures"]},"engineering":{"fit":"Prerequisite check rather than a solution fit.","architectureIntegration":"Anthropic Verification Portal links AWS accounts; tier activation on Bedrock depends on exemption or EFS.","prerequisites":["Anthropic organization account","Linked AWS accounts","Retention exemption or EFS enrollment"],"constraints":["EFS availability date unknown","No GovCloud-specific instructions","Up to 10 linked accounts"],"security":"Retention required for enrolled users unless exempt; prohibited activities must be enforced in rules of engagement.","proofOfValue":["Confirm tier activation in a test account","Verify retention status matches policy","Document approved users against tier limits"]},"delivery":{"work":"Prepare and track CVP access for an approved security use case.","dependencies":["Anthropic approval","AWS account team","Agency legal review"],"ownership":"Security program office.","skillsAdoption":"Staff need to understand program tiers, limits and prohibited uses.","governanceCheckpoints":["Approved tier recorded","Retention status confirmed","Rules of engagement updated"],"acceptanceCriteria":["Proposed: approval documented before pilot","Proposed: accounts linked and tier visible","Proposed: user count within tier limit"],"risks":["Approval delays","Assumed access not granted","Terms change without notice"]}},"retrievedAt":"2026-11-10T04:05:40Z","enrichedAt":"2026-11-10T04:11:25Z","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"Not addressed.","procurementImplications":"Eligibility and exemptions are handled with Anthropic and account teams, not through standard Bedrock procurement.","operatingModelImplications":"Approval timelines are not stated. Teams should plan for a lead time before any Mythos-based pilot.","sourceVerification":{"openedUrl":"https://support.claude.com/en/articles/14604842-cyber-verification-program","referenceExcerpt":"Bedrock doesn’t yet support human review of automated safety flags, which CVP requires by default.","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}}]}