The problem is that it can't really be guaranteed because there is no knowing what you are going to do with it. I could give you a hardened AMI and then you could totally open in up in the course of your development. So it would have to be something like "Here is what has been done to it. Here is how it currently satisfies X accreditation. It is your responsibility to keep it secure"

Given that is this still worthwhile?