From the AWS edition of November 9, 2026
Anthropic's Cyber Verification Program page: on Amazon Bedrock, CVP access is limited to organizations with a data retention exemption until Enterprise Frontier Safeguards is available
Anthropic · Model provider access policy (affects AWS GovCloud and Bedrock customers) · Global (applies to Amazon Bedrock including GovCloud availability)
- Publisher
- Claude Help Center
- Original publication
- 2026-10-06
- Source retrieved
- 2026-11-10
- Event date
- 2026-11-09
What happened
Anthropic's help article on the Cyber Verification Program (stating an October 6, 2026 update and showing 'Updated today' at retrieval) says that Bedrock does not yet support human review of automated safety flags, which CVP requires by default. For now, CVP on Bedrock is available only to organizations with a data retention exemption; once Enterprise Frontier Safeguards (EFS) is available, Bedrock organizations in EFS can apply. The page lists Amazon Bedrock as requiring EFS and advises contacting the account team about an exemption. Why now: AWS's November 9 GovCloud Mythos 5.2 announcement directs eligible customers to this program.
Why it matters
Explains a practical gate for public-sector security teams expecting to use Mythos 5.2 in GovCloud: approval depends on Anthropic's program, and Bedrock-specific conditions (retention exemption or future EFS) apply. This is the main access constraint behind the AWS announcement.
Evidence and measured results
Model provider's own policy documentation; authoritative for Anthropic's program terms but not independent of the AWS/Anthropic partnership.
Limitations and uncertainty
Help-center article that can change without notice; it is not GovCloud-specific and does not say how the GovCloud offering maps to EFS or exemptions. Publication date reflects the stated October 6 update; page showed 'Updated today' at retrieval.
Put this evidence to work
Lighthouse Advisory interpretation, grounded in this source. Enriched 2026-11-10; this does not change the original publication date. Each role follows the same checklist so takeaways compare across sources.
Sales
Role takeaway
- Customer problem
- GovCloud security teams cannot use the announced Mythos 5.2 model until a separate Anthropic verification and Bedrock-specific conditions are met.
- Stakeholders
- CISO
- AWS account team
- Legal / procurement (data retention terms)
- Discovery questions
- Does the organization hold a data retention exemption?
- Will it enroll in Enterprise Frontier Safeguards when available?
- Who will own the Anthropic program relationship?
- Value hypothesis
- Clarifying the access path early avoids stalled pilots and mismatched expectations.
- Potential engagement
- Access-readiness assessment covering CVP eligibility, retention status and account linking.
- Unsupported claims
- Guaranteed access through AWS purchase
- Approval timelines
- GovCloud-specific procedures
Pre-sales engineering
Role takeaway
- Fit
- Prerequisite check rather than a solution fit.
- Architecture and integration
- Anthropic Verification Portal links AWS accounts; tier activation on Bedrock depends on exemption or EFS.
- Prerequisites
- Anthropic organization account
- Linked AWS accounts
- Retention exemption or EFS enrollment
- Constraints
- EFS availability date unknown
- No GovCloud-specific instructions
- Up to 10 linked accounts
- Security
- Retention required for enrolled users unless exempt; prohibited activities must be enforced in rules of engagement.
- Proof of value
- Confirm tier activation in a test account
- Verify retention status matches policy
- Document approved users against tier limits
Delivery
Role takeaway
- Work
- Prepare and track CVP access for an approved security use case.
- Dependencies
- Anthropic approval
- AWS account team
- Agency legal review
- Ownership
- Security program office.
- Skills and adoption
- Staff need to understand program tiers, limits and prohibited uses.
- Governance checkpoints
- Approved tier recorded
- Retention status confirmed
- Rules of engagement updated
- Acceptance criteria
- Proposed: approval documented before pilot
- Proposed: accounts linked and tier visible
- Proposed: user count within tier limit
- Risks
- Approval delays
- Assumed access not granted
- Terms change without notice
Implementation considerations
Lighthouse Advisory interpretation across the operating dimensions a public-sector buyer must settle before this evidence becomes a design. Each note answers the question under its heading for this specific source.
Architecture and integration
What must connect, and where does the AI sit in the workflow?
Access is linked through the Anthropic Verification Portal to AWS accounts (up to 10 linked accounts), separate from AWS IAM. Bedrock tier activation depends on EFS once available.
Governance
Who approves, reviews and stays accountable for outcomes?
Introduces a second governance relationship (Anthropic) alongside the AWS contract. Agencies must track program tiers, approved-user limits and prohibited activities.
Security and privacy
What data, permissions and controls need testing?
Program prohibits activities such as denial-of-service and data destruction; data retention is required for enrolled users unless exempt.
Accessibility and workforce
Who is affected, and what skills or accommodations follow?
Not addressed.
Procurement
What should contracts, pricing and exit terms secure?
Eligibility and exemptions are handled with Anthropic and account teams, not through standard Bedrock procurement.
Operating model
Which teams own the service once it runs?
Approval timelines are not stated. Teams should plan for a lead time before any Mythos-based pilot.
Publication history
- 2026-11-09AWS · Issue 118 resources
Stable resource ID: anthropic-cvp-bedrock-access-limited-retention-exemption-20261006