Skip to main content

Now accepting design partners.

Request a demo
Request a demo

Evidence

Evidence an assessor can check without you.

Every gate result, approval and closure is signed with Cosign and anchored in the Sigstore Rekor transparency log.

Request a demoSee how evidence is verified

Evidence record

Verified
Control
SI-2 Flaw remediation
Change
Pull request #482, approved by a second reviewer
Checks
Finding absent. No regressions. Gate passes.
Signed
Cosign signature valid
Anchored
Rekor transparency log, index 142907098

sha256:07ad3c91e2f4…5b192026-10-08 14:31Z

SigstoreAnchored in Sigstore RekorINDEX 142907098

What one record holds.

Each field answers a question an assessor asks. This is the record written when POA&M item 0117 closed.

Evidence record

Verified

  1. Which requirement

    The control this event is evidence for.

    Control
    SI-2 Flaw remediation

  2. What changed

    The pull request, and that a second person approved it.

    Change
    Pull request #482, approved by a second reviewer

  3. What was tested

    The three verification checks and their results.

    Checks
    Finding absent. No regressions. Gate passes.

  4. Whether it was altered

    A signature that fails if the record changes.

    Signed
    Cosign signature valid

  5. Where to find it

    Its entry in the public transparency log.

    Anchored
    Rekor transparency log, index 142907113

  6. What exactly was signed

    The SHA-256 digest of the record contents.

    Digest
    sha256:9f2c41d07be3…a41e

  7. When

    The time the record was written, in UTC.

    Recorded
    2026-10-08 15:04:20Z

A closed POA&M item carries its whole history.

Five signed records, from the finding to the gate that passed.

  1. 14:0201

    Finding 0482

    Vulnerability in a container base image

    ADVERSARIUS

    sha256:4be1…c07a

  2. 14:1202

    GitHub

    Remediation

    Pull request #482 on an isolated branch

    ARE

    sha256:a93d…2e61

  3. 14:1903

    Maya Reyes

    Approval record

    Maya Reyes, not the author

    AC-5Approved

    sha256:e2f8…90b3

  4. 14:3104

    GrypeTrivy

    Verification

    Re-scan, regression check, original gate

    3 of 3 checks

    sha256:07ad…5b19

  5. 14:3105

    Gate pass

    The gate that failed now passes

    RAMPART

    sha256:5d0e…77c2

  6. 15:04

    POA&M item 0117 closed

    15:04 · FIX VERIFIED, THEN PRODUCTION CONFIRMED

    Five records signedAnchored in Rekorsha256:9f2c…a41e

Built for how assessors work.

NIST SP 800-53A names three assessment methods. REAEGIS gives each one something concrete to start from.

Examine

Signed records an assessor can read.

SIGNED RECORDS

  • Verification, pull request #482sha256:07ad…5b19Signed
  • Approval, pull request #482sha256:e2f8…90b3Signed
  • POA&M closure, item 0117sha256:9f2c…a41eSigned

Test

Gate results that can be run again on the current system.

RAMPART GATES

Run again
  • VULNERABILITYSI-2 · RA-5PASS
  • IAC_COMPLIANCECM-6 · CM-7 · SC-7PASS
  • SBOM_INTEGRITYCM-8 · SR-4PASS

Interview

Records name who approved what, so interviews start from facts.

NAMED APPROVALS

  • Maya ReyesApproved pull request #48214:19
  • Change control boardApproved a boundary change11:40
  • ISSOValidated closure of item 011715:04

Source: NIST SP 800-53A, assessment methods

The interview itself stays with the assessor.

CHRONICLE

Do not take our word for it. Verify it.

Every compliance event is signed with Cosign and anchored to the Sigstore Rekor transparency log. An assessor or Inspector General can check any record with public tooling, without access to REAEGIS.

Verify an evidence record

cosign verify-blob finding-0482.json \

--key reaegis.pub \

--bundle finding-0482.bundle

Verified OK

rekor-cli get --log-index 142907113

Index:142907113

IntegratedTime:2026-10-08T15:04:20Z

Body:hashedrekord sha256:9f2c41d0…a41e

# control SI-2, change #482, approved by a second reviewer

Public tools. No REAEGIS account required.

270,525

records anchored to the public transparency log so far

SigstoreRekorpublic transparency log

Evidence has a shelf life.
REAEGIS tracks it.

Each evidence type has a source and a cadence. Past its cadence, a record shows as aging, then stale.

ORION-1 / Evidence

96% current

Evidence freshness

96%current, signed, attributed

  • Current1,208
  • Aging38
  • Stale12

  • Vulnerability scan

    SI-2 · RA-5

    Current
    Source
    GrypeTrivyGrype, Trivy
    Cadence
    Every push
    Last collected
    Oct 8, 09:12
    Age against cadence
    Today

  • Configuration scan

    CM-6 · CM-7

    Current
    Source
    CheckovCheckov
    Cadence
    Every push
    Last collected
    Oct 8, 09:12
    Age against cadence
    Today

  • STIG check

    CM-6

    Current
    Source
    OpenSCAPOpenSCAP
    Cadence
    Daily
    Last collected
    Oct 8, 04:00
    Age against cadence
    5 hours

  • Access review

    AC-2 · CA-7

    Aging
    Source
    Identity provider export
    Cadence
    Quarterly
    Last collected
    Jul 14
    Age against cadence
    86 of 90 days

  • Boundary diagram

    SC-7 · PL-8

    Stale
    Source
    Manual upload
    Cadence
    Annual
    Last collected
    Sep 22, 2025
    Age against cadence
    381 of 365 days
  • Currentinside its cadence
  • Agingclose to the end of its cadence
  • Stalepast its cadence

Authorization is not a destination. It is a system property.

Request a demo and we will walk one finding from detection to signed evidence.

Request a demoSee the platform

  • Federal programs

    Invitation only, with CAC and PIV.

    Request access

  • Commercial teams

    Self-register with single sign-on.

    Create a workspace

  • Pricing

    Plans start at $2,500 per month. In-boundary and air-gapped deployments are scoped per program.

    See pricing