From RAMPART gate failure to signed CCB change request.
The DoD NIST SP 800-171 Assessment Methodology assigns remediation timelines to findings based on severity. Critical findings require remediation within 30 days. High findings within 90 days. Missing a POA&M milestone is a compliance deficiency that extends the risk window and appears in every subsequent assessment. The Automated Remediation Engine compresses the time from detection to verified closure — while maintaining the CM-3 change control requirements that a CCB workflow requires.
The traditional path vs. the REAEGIS path.
The traditional path
Manual at every step. CM-3 gaps accumulate.
- 1Gate fails. Finding created.
- 2ISSO reads scan report.
- 3ISSO creates Jira ticket.
- 4Developer reads Jira ticket.
- 5Developer researches the vulnerability.
- 6Developer writes a fix.
- 7Fix reviewed in pull request.
- 8Fix deployed to staging.
- 9Scanner re-runs on schedule.
- 10ISSO verifies closure.
- 11POA&M item updated.
The REAEGIS path
CM-3 enforced. AC-5 enforced. Evidence at every step.
- 1Gate fails. Finding created.
- 2Remediation plan generated from the finding and the affected code.
- 3Change request routed to CCB.
- 4CCB reviewer (not initiator) approves. AC-5 separation enforced at data layer.
- 5Fix applied to isolated branch.
- 6Fix compiled and verified.
- 7Multi-stage verification: three independent scanner passes required.
- 8Gate that originally failed re-evaluates the remediated branch.
- 9If gate passes: PR created. If gate fails: pipeline stops. Finding remains open.
- 10POA&M item closed with evidence chain: finding → remediation → verification → CCB record → gate pass.
Why three verification stages.
A fix that resolves the targeted finding but introduces a new finding is not a fix — it is a trade. A fix that resolves the finding but does not compile is not deployable. A fix that passes local verification but fails the gate that originally triggered it has not demonstrated control compliance.
The remediation pipeline requires all three conditions to be satisfied before a finding is marked resolved:
- Stage 1The original finding is absent from the re-scan of the remediated code.
- Stage 2No new findings were introduced by the remediation (regression gate).
- Stage 3The RAMPART gate that originally failed now passes against the remediated branch in a live evaluation.
If any stage fails, the finding remains open, the failure is logged to CHRONICLE, and the pipeline stops. A finding is not closed on the belief that it was fixed. It is closed on the evidence that the gate passes.
Seven scanners. Every job. All three stages.
A finding is never marked resolved unless all three verification stages passed, the build succeeded, the RAMPART gate passed on the remediated branch, the CCB change request was approved, and the external PR was merged. The engine fails closed. No exceptions.
Authorization is not a destination.
It is a system property.
REAEGIS is the infrastructure that maintains it — converting every commit, scan, and approval into evidence your Authorizing Official can act on.