Command Center
Every system in
the boundary,
on one screen.
Readiness, findings, POA&M and evidence freshness, drawn from the running system and current as of the last push.
ORION-1 / Command
Audit chain intactCommand Center
Authorization posture for ORION-1,
4 systems in boundary
Authorization readiness
+6 in 30 days82of 100
- Continuous monitoring88
- Active cyber defense74
- Secure software supply chain84
Command / Open findings
3 past SLAOpen findings
41
- Critical2
- High9
- Moderate18
- Low12
Command / POA&M and evidence
POA&M items
175 awaiting production confirmation
- Remediating
- Confirming
- Accepted
Evidence freshness
96%current, signed, attributed
- Current 1,208
- Aging 38
- Stale 12
Command / Live remediation
Stage 6 of 8Critical vulnerability in base image
- Find
- Fix
- Build
- Push
- Verify
- Deploy
- Confirm
- ATO
Fix merged by pull request #482.
Verification passed. POA&M closes
after production confirmation.
Command Center
Authorization posture for ORION-1, 4 systems in boundary
Authorization readiness
+6 in 30 days82of 100
- Continuous monitoring88
- Active cyber defense74
- Secure software supply chain84
Open findings
3 past SLA41
- Critical2
- High9
- Moderate18
- Low12
POA&M items
175 awaiting production confirmation
- Remediating
- Confirming
- Accepted
Evidence freshness
96%current, signed, attributed
- Current 1,208
- Aging 38
- Stale 12
Command
Work
Findings41
Remediation3
POA&M17
Assurance
Evidence
Controls
Risk register
Connect
Sync
Audit chain intact
Verified 2 minutes ago
Command Center
Authorization posture for ORION-1, 4 systems in boundary
Authorization readiness
+6 in 30 days82of 100
- Continuous monitoring88
- Active cyber defense74
- Secure software supply chain84
Open findings
3 past SLA41
- Critical2
- High9
- Moderate18
- Low12
POA&M items
175 awaiting production confirmation
- Remediating
- Confirming
- Accepted
Evidence freshness
96%current, signed, attributed
- Current 1,208
- Aging 38
- Stale 12
Live remediation
Stage 6 of 8Critical vulnerability in base image
api-gateway
SI-2RA-5- Find
- Fix
- Build
- Push
- Verify
- Deploy
- Confirm
- ATO
Fix merged by pull request #482. Verification passed. POA&M closes after production confirmation.
Needs attention
- TLS 1.0 enabled at ingressSC-812 days to SLA
- Access review evidence agingAC-2 CA-7Refresh due
- Change approval pendingCM-3 CM-5Needs approver
One score.
Three competencies you can defend.
Each competency is measured from what the pipeline and monitoring did, so the score moves when the system does.
Authorization readiness
+6 in 30 days82of 100
Last 30 days
+6 in 30 days- Program
- ORION-1, FedRAMP High
- Systems in boundary
- 4
- Daily sync
- 04:00 UTC
Continuous monitoring
88of 100
MEASURED FROM
- Evaluation frequency
- Every push
- Finding age
- Median 11 days
- Monitoring package delivery
- Monthly, on time
- Produced by
- PHAROS
Produced by
PHAROSActive cyber defense
74of 100
MEASURED FROM
- Finding-to-remediation cycle time
- 3.2 days
- Gate pass rates
- 91% of pushes
- Produced by
- ARE
Produced by
ARESecure software supply chain
84of 100
MEASURED FROM
- Pipeline integration depth
- 4 of 4 systems
- Signed artifact coverage
- 92% of artifacts
- Produced by
- RAMPART
Produced by
RAMPART
Source: DoD CIO, continuous ATO competencies
Scores and measures shown for ORION-1 are illustrative.
From a number to its proof
in four steps.
Every figure opens to the control, the finding and the signed record behind it.
01READINESS
Authorization readiness
82of 100
- Continuous monitoring88
- Active cyber defense74
- Secure software supply chain84
By control family
02CONTROL FAMILY
- ACAccess control
- CMConfiguration management
- RARisk assessment
- SCSystem and communications protection
SISystem and information integrity
03CONTROL
SI-2Flaw remediation
- Implementation
- Automated
- Evidence
- Current
- Last gate result
- PASS
Finding 0482
04FINDING AND EVIDENCE
FINDING 0482
Vulnerability in container base image
api-gatewaySI-2RA-5
Evidence record
Verified
sha256:9f2c41d07be3…a41e
Rekor index 142907113
2026-10-08 15:04:20Z
The last step is a signed record. An assessor can check it with public tools.
The same record,
read three ways.
Each person reads the part of the screen that answers their question. The data underneath is the same signed record.
ISSO
Information system security officer
Watches POA&M and evidence freshness.
POA&M items
175 awaiting production confirmation
- Remediating
- Confirming
- Accepted
Evidence freshness
96%current, signed, attributed
- Current 1,208
- Aging 38
- Stale 12
POA&M closures to validate
1 waitingPANELS ON THE COMMAND CENTER
- POA&M items
- Evidence freshness
Authorizing Official
Makes the authorization decision
Reads readiness and open risk.
Authorization readiness
+6 in 30 days82of 100
- Continuous monitoring88
- Active cyber defense74
- Secure software supply chain84
Open findings
3 past SLA41open across 4 systems
- Critical 2
- High 9
- Moderate 18
- Low 12
PANELS ON THE COMMAND CENTER
- Authorization readiness
- Open findings
Engineering lead
Maya Reyes
Watches live remediation and approvals.
Live remediation
Stage 6 of 8Vulnerability in container base image
api-gatewaySI-2RA-5
FindDeployingATO- Find
- Fix
- Build
- Push
- Verify
- Deploy
- Confirm
- ATO
Approved
Pull request #482
Maya Reyes approvedReviewer is not the authorAC-5PANELS ON THE COMMAND CENTER
- Live remediation
- Needs attention
Know what needs
a person today.
Items that need a decision are queued with their control, their owner and the time remaining.
ORION-1 / needs attentionORION-1 / Command / needs attention
6 items- All 6
- Findings 1
- Evidence 2
- Decisions 3
Sorted by time remaining
Boundary diagram past annual review
EVIDENCE · MANUAL UPLOAD
Time remaining: Overdue
Controls: SC-7PL-8
ISSOStale evidenceChange approval pending
CHANGE REQUEST · platform-config
Time remaining: 2 days
Controls: CM-3CM-5
Change control boardNeeds approverPOA&M item 0109 closure to validate
POA&M · auth-service
Time remaining: 5 days
Controls: SI-2CA-5
ISSONeeds validationAccess review evidence aging
EVIDENCE · QUARTERLY EXPORT
Time remaining: 6 days
Controls: AC-2CA-7
ISSORefresh dueRisk acceptance requested
FINDING 0467 · reporting-db
Time remaining: 9 days
Controls: RA-7CA-5
Authorizing OfficialNeeds decisionTLS 1.0 enabled at ingress
FINDING 0519 · platform-config
Time remaining: 12 days
Controls: SC-8
Change control boardOpen finding
| Item | Controls | Owner | SLA remaining | Status |
|---|---|---|---|---|
| Boundary diagram past annual reviewEVIDENCE · MANUAL UPLOAD | SC-7PL-8 | ISSO | Overdue | Stale evidence |
| Change approval pendingCHANGE REQUEST · platform-config | CM-3CM-5 | Change control board | 2 days | Needs approver |
| POA&M item 0109 closure to validatePOA&M · auth-service | SI-2CA-5 | ISSO | 5 days | Needs validation |
| Access review evidence agingEVIDENCE · QUARTERLY EXPORT | AC-2CA-7 | ISSO | 6 days | Refresh due |
| Risk acceptance requestedFINDING 0467 · reporting-db | RA-7CA-5 | Authorizing Official | 9 days | Needs decision |
| TLS 1.0 enabled at ingressFINDING 0519 · platform-config | SC-8 | Change control board | 12 days | Open finding |
Export
The same record leaves as the files your process expects.
- OSCAL packageoscal_ORION-1.zipSSP, plan, results, POA&M
- eMASS exportPOAM_ORION-1.xlsxeMASS import format
- Monthly monitoring reportconmon_2026-10_ORION-1.zipPOA&M, scans, changes, inventory
Authorization is not a destination. It is a system property.
Request a demo and we will walk one finding from detection to signed evidence.
- Request access
Federal programs
Invitation only, with CAC and PIV.
- Create a workspace
Commercial teams
Self-register with single sign-on.
- See pricing
Pricing
Plans start at $2,500 per month. In-boundary and air-gapped deployments are scoped per program.