Skip to main content

Now accepting design partners.

Request a demo
Request a demo

Gates

Eleven gates.
Every push.
Signed results.

RAMPART evaluates each push to a protected branch and records the result as evidence, tied to the controls it supports.

Request a demoSee how evidence is verified

ORION-1 / Gates

1 gate failed
3b7f2a9mainapi-gateway

2026-10-08 14:02:11Z

  1. VULNERABILITY FAIL
  2. SECRET_DETECTION PASS
  3. CODE_QUALITY PASS
  4. SBOM_INTEGRITY WARN
  5. IMAGE_DIGEST PASS
  6. SUPPLY_CHAIN PASS
  7. IAC_COMPLIANCE PASS
  8. ACAS_FINDINGS PASS
  9. NETWORK_BOUNDARY PASS
  10. SLCM_ASSESSMENT PASS
  11. PRIVACY_CONTROLS PASS

9 pass, 1 warn, 1 fail

  • VULNERABILITYFinding 0482 openedFAIL
  • SBOM_INTEGRITYSBOM older than thresholdWARN
  • IMAGE_DIGEST + 8 MOREPASS
Signed, anchoredCHRONICLE

What is checked
on every push.

Eleven gates in four families. Every card reads the same way: the check, when it fails, when it warns, and the controls it supports.Eleven gates in four families. Every row reads the same way: the check, when it fails, when it warns, and the controls it supports.

No.GateWhat it checksFails whenWarns whenControls
CODE3 GATES
01VULNERABILITYOpen source dependency vulnerabilitiesCritical CVE open over 30 daysHigh CVE openSI-2RA-5
02SECRET_DETECTIONEmbedded credentials, keys, certificates and high-entropy stringsConfirmed secretNo warn conditionIA-5CM-6
03CODE_QUALITYStatic analysis results
from a connected integration		Set per program risk toleranceSI-10SA-11
SUPPLY CHAIN3 GATES
04SBOM_INTEGRITYSBOM currency and signatureSBOM absent or unsignedSBOM older than thresholdCM-8SR-4
05IMAGE_DIGESTContainer image references
pinned by sha256 digest		Floating tag, such as latestNo warn conditionCM-7SA-22
06SUPPLY_CHAINInfrastructure and container posture from infrastructure scannersCritical supply chain findingNo warn conditionSR-3SR-4
INFRASTRUCTURE3 GATES
07IAC_COMPLIANCETerraform, Bicep, CloudFormation, Kubernetes, Helm and Dockerfiles against baselines including CISCritical misconfiguration, such as public storage, root database access or unrestricted ingressNo warn conditionCM-6CM-7SC-7
08ACAS_FINDINGSActive IAVA status from ACASOpen IAVA with overdue remediationNo warn conditionSI-2RA-5
09NETWORK_BOUNDARYAuthorization boundary diagram
currency and scope		No fail conditionDiagram older than thresholdSC-7PL-8
GOVERNANCE2 GATES
10SLCM_ASSESSMENTChange control records
and baseline documentation		No fail conditionRecords absent or staleSA-3CM-3
11PRIVACY_CONTROLSPrivacy attestation for programs handling PIIPT-2 not attested or expiredNo warn conditionPT-2PT-5
RAMPARTRAMPART evaluates all eleven on every push to a protected branch.CONTROL IDS: NIST SP 800-53 REV 5
CODE3 GATES

  • 01VULNERABILITY

    Open source dependency vulnerabilities

    Fails whenCritical CVE open over 30 days
    Warns whenHigh CVE open

    Controls: SI-2RA-5

  • 02SECRET_DETECTION

    Embedded credentials, keys, certificates and high-entropy strings

    Fails whenConfirmed secret
    Warns whenNo warn condition

    Controls: IA-5CM-6

  • 03CODE_QUALITY

    Static analysis results
    from a connected integration

    Set per program risk tolerance

    Controls: SI-10SA-11

SUPPLY CHAIN3 GATES

  • 04SBOM_INTEGRITY

    SBOM currency and signature

    Fails whenSBOM absent or unsigned
    Warns whenSBOM older than threshold

    Controls: CM-8SR-4

  • 05IMAGE_DIGEST

    Container image references
    pinned by sha256 digest

    Fails whenFloating tag, such as latest
    Warns whenNo warn condition

    Controls: CM-7SA-22

  • 06SUPPLY_CHAIN

    Infrastructure and container posture from infrastructure scanners

    Fails whenCritical supply chain finding
    Warns whenNo warn condition

    Controls: SR-3SR-4

INFRASTRUCTURE3 GATES

  • 07IAC_COMPLIANCE

    Terraform, Bicep, CloudFormation, Kubernetes, Helm and Dockerfiles against baselines including CIS

    Fails whenCritical misconfiguration, such as public storage, root database access or unrestricted ingress
    Warns whenNo warn condition

    Controls: CM-6CM-7SC-7

  • 08ACAS_FINDINGS

    Active IAVA status from ACAS

    Fails whenOpen IAVA with overdue remediation
    Warns whenNo warn condition

    Controls: SI-2RA-5

  • 09NETWORK_BOUNDARY

    Authorization boundary diagram
    currency and scope

    Fails whenNo fail condition
    Warns whenDiagram older than threshold

    Controls: SC-7PL-8

GOVERNANCE2 GATES

  • 10SLCM_ASSESSMENT

    Change control records
    and baseline documentation

    Fails whenNo fail condition
    Warns whenRecords absent or stale

    Controls: SA-3CM-3

  • 11PRIVACY_CONTROLS

    Privacy attestation for programs handling PII

    Fails whenPT-2 not attested or expired
    Warns whenNo warn condition

    Controls: PT-2PT-5

RAMPART

RAMPART evaluates all eleven on every push to a protected branch.

CONTROL IDS: NIST SP 800-53 REV 5

Every result
is one of four.

Each gate returns one result per push. The result decides what happens next.

  • PASS

    The check met its criteria.

    WHAT HAPPENS NEXT

    Recorded as evidence.

    ORION-1, 14:029 OF 11IMAGE_DIGEST + 8 MORE

  • FAIL

    A fail criterion was met.

    WHAT HAPPENS NEXT

    A finding opens with the control reference and the evidence that caused it. Remediation starts.

    ORION-1, 14:021 OF 11VULNERABILITY

  • WARN

    A warn criterion was met.

    WHAT HAPPENS NEXT

    Recorded and raised for attention.

    ORION-1, 14:021 OF 11SBOM_INTEGRITY

  • SKIP

    The gate does not apply to this push.

    WHAT HAPPENS NEXT

    The reason is recorded.

    ORION-1, 14:020 OF 11NONE ON THIS PUSH
CHRONICLE

Every result is signed with Cosign and anchored in Rekor.

From a failed gate
to a closed finding.

A failed gate starts a tracked change.
A different person approves it, and the same gate has to pass on the fix.

  1. Gate failsA fail criterion is met
    on a push.    FAILRAMPART
  2. Finding record
    opens    Control reference, evidence
    and signed context.    ADVERSARIUS
  3. GitHubRemediation plan
    and pull request    From the finding,
    on an isolated branch.    ARE
  4. Maya Reyes, reviewerA different
    person approves    Maya Reyes, reviewer.
    Never the initiator.    AC-5CM-3
  5. The same gate is
    evaluated again    On the fix.
    It has to pass.    PASSRAMPART
  6. Finding closesPOA&M item updated.CHRONICLEPHAROS

ORION-1 / VULNERABILITY

FAIL 14:02PASS 14:31

Finding0482

Pull requestGitHub#482

POA&M item0117Closed 15:04

See how remediation works

One record per push,
usable as evidence.

Each evaluation is stored as one signed record.
The same record serves four control families.

Evaluation record

Signature valid
Commit
3b7f2a9orion-1/api-gateway
Branch
mainprotected
Evaluated
2026-10-08 14:02:11Z
Gate results
9 PASS1 WARN1 FAIL0 SKIP
Controls
SI-2RA-5CM-8SR-4and 13 more
Finding
0482Vulnerability in container base image
Signed
Cosign signature valid
Anchored
Rekor transparency log, index 142906884Rekor transparency logindex 142906884

sha256:e3f1…92c62026-10-08 14:02Z

SERVES AS EVIDENCE FOR

  • CA-7Continuous monitoringAssessment, authorization
    and monitoring    Assessment, authorization and monitoring
  • RA-5Vulnerability scanningRisk assessmentRisk assessment
  • SI-2Flaw remediationSystem and information integritySystem and information integrity
  • CM-3Change controlConfiguration managementConfiguration management
NIST SP 800-53AAn assessor can examine the record and re-run the test.ExamineTest
See how evidence is verified

Each gate reads
from tools you
already run.Each gate reads from tools
you already run.

Results come from connected scanners and your own records, grouped here by gate family.

  • Code

    VULNERABILITYSECRET_DETECTIONCODE_QUALITY

    Tools it reads from

    • Grype
    • Trivy
    • Semgrep
    • SonarQube
    • OSV-Scanner
    • Trufflehog

  • Supply chain

    SBOM_INTEGRITYIMAGE_DIGESTSUPPLY_CHAIN

    Tools it reads from

    • Syft
    • Sigstore
    • Chainguard

  • Infrastructure

    IAC_COMPLIANCEACAS_FINDINGSNETWORK_BOUNDARY

    Tools it reads from

    • Checkov
    • Terraform
    • Kubernetes
    • Helm
    • Tenable ACAS
    • OpenSCAP

  • Governance

    SLCM_ASSESSMENTPRIVACY_CONTROLS

    Tools it reads from

    • Your change records and attestations
See every integration

Thresholds follow
your program.

The gates are fixed. Where a gate uses a threshold, your program sets it.

Request a demo

ORION-1 / SettingsORION-1 / Settings / gate thresholds

Program settings
  • CODE_QUALITYFail and warn criteriaSet per program
  • SBOM_INTEGRITYSBOM age thresholdSet per program
  • NETWORK_BOUNDARYBoundary diagram age thresholdSet per program

The eleven gates are fixed.

Authorization is not a destination. It is a system property.

Request a demo and we will walk one finding from detection to signed evidence.

Request a demoSee the platform

  • Federal programs

    Invitation only, with CAC and PIV.

    Request access

  • Commercial teams

    Self-register with single sign-on.

    Create a workspace

  • Pricing

    Plans start at $2,500 per month. In-boundary and air-gapped deployments are scoped per program.

    See pricing