Eleven gates. Every push. Signed results.
Authorization packages go stale. Code changes daily. The gap between the system state described in the SSP and the system state in production is where authorization risk accumulates. RAMPART closes that gap by evaluating the connected repository against eleven compliance gates on every push to a protected branch — producing signed gate results that reflect the current state of the system, not the state it was in when the SSP was last updated.
What RAMPART evaluates on every push
| Gate | Evaluates | Decision criteria | NIST 800-53 | FedRAMP KSI | CMMC |
|---|---|---|---|---|---|
| VULNERABILITY | Open source dependency vulnerability status across the software dependency tree. | FAIL if CRITICAL severity CVE open >30 days. WARN if HIGH severity CVE open. | SI-2, RA-5 | KSI-VM-01, KSI-VM-02 | RA.3.144, RA.5.155 |
| IAC_COMPLIANCE | Infrastructure-as-Code files (Terraform, Bicep, CloudFormation, Kubernetes manifests, Helm charts, Dockerfiles) against security policy baselines including CIS benchmarks. | FAIL if CRITICAL misconfiguration present (public storage, root database access, unrestricted security group ingress). | CM-6, CM-7, SC-7 | — | — |
| SBOM_INTEGRITY | Software Bill of Materials currency and signature status. | FAIL if SBOM absent or unsigned. WARN if SBOM older than defined threshold. | SA-12, CM-8 | KSI-VM-03, KSI-SC-02 | — |
| IMAGE_DIGEST | Container image references in Dockerfiles and Kubernetes manifests for sha256 digest pinning. | FAIL if floating tag used (:latest, :main, unpinned). | CM-7, CM-8, SA-22 | — | — |
| SECRET_DETECTION | Repository content for embedded credentials, API keys, certificates, and high-entropy strings. | FAIL if confirmed secret detected. | IA-5, CM-6 | — | — |
| CODE_QUALITY | Static analysis results from connected analysis integration. | Decision criteria configured per program risk tolerance. | SI-10, SA-11 | — | — |
| SUPPLY_CHAIN | IaC and container security posture from infrastructure scanning tools. | FAIL if CRITICAL supply chain finding present. | SA-12, SR-4, SR-3 | — | — |
| ACAS_FINDINGS | Active IAVA compliance status from connected Nessus/ACAS integration. | FAIL if open IAVA with overdue remediation. | SI-2, RA-5 | — | — |
| SLCM_ASSESSMENT | Software lifecycle management artifacts including change control records and baseline documentation. | WARN if change control records absent or stale. | SA-3, CM-3 | — | — |
| PRIVACY_CONTROLS | PT family attestation status for programs handling Personally Identifiable Information. | FAIL if PT-2 (Authority to Process PII) not attested or expired. | PT-2, PT-5 | — | — |
| NETWORK_BOUNDARY | Authorization boundary diagram currency and scope accuracy. | WARN if network diagram older than defined staleness threshold. | SC-7, PL-8 | — | — |
What happens when a gate fails.
A gate failure produces a finding record with the specific control reference, the evidence that drove the failure decision, and the signed evaluation context.
The finding enters the remediation workflow. Remediation plans are generated based on the finding type, the affected code, and the control requirement. The resulting change request is routed through the Change Control Board workflow per NIST SP 800-53 CM-3 requirements. The initiator and approver must be different authorized individuals. Both actions are logged to CHRONICLE.
The gate that failed re-evaluates the remediated code before the finding is closed. A finding is not closed on the assertion that it was fixed. It is closed on the evidence that the gate now passes.
The evaluation record as ATO evidence.
Every RAMPART evaluation produces a record containing gate results, control references, affected findings, the commit SHA evaluated, and a timestamp. The record is signed using Cosign and anchored to Rekor.
The record satisfies multiple ATO evidence requirements simultaneously:
- CA-7Continuous monitoring — evidence that monitoring occurred at a specific time
- RA-5Vulnerability scanning — signed scan results with specific CVE references
- SI-2Flaw remediation — documented finding lifecycle from detection to closure
- CM-3Change control — change records linked to specific evaluation findings
Assessment objectives under NIST SP 800-53A specify that controls must be examined, tested, or both. Signed evaluation records satisfy the test method for controls within RAMPART's gate scope — and the examination method when the records are reviewed by the assessor.
Authorization is not a destination.
It is a system property.
REAEGIS is the infrastructure that maintains it — converting every commit, scan, and approval into evidence your Authorizing Official can act on.