Skip to main content

Now accepting design partners.

Request a demo
Request a demo

Federal agencies

Keep the package current between assessments.

Your authorization package is generated from the running system, so the Authorizing Official always reviews today, not last quarter.

Request a demoSee the platform

ORION-1 / Monitoring

Assembled and signed

Monthly monitoring package

October 2026, prepared for the Authorizing Official

4 of 4current

  • POA&M

    17 items, 1 closed this month

    Updated

  • Scan results

    41 open findings, scanned 04:00 UTC

    Current

  • Change report

    6 changes, each approved under CM-3

    Current

  • Inventory from the SBOM

    212 components, 3 added

    Updated

Signed with Cosign, anchored in Rekor

2026-10-01 04:12Z

The system moves. The package stands still.

Three pressures every federal program carries between assessments.

  • The package ages once it is signed

    The system keeps changing. The SSP, the assessment report and the POA&M describe it as it was.

  • Evidence is moved by hand
    every cycle

    Scan exports and spreadsheets are collected, renamed and uploaded for each monitoring period.

    NIST SP 800-137 · CONTINUOUS MONITORING

  • STEPS 1 TO 3 · DECISIONS

    • 1PREPARE
    • 2CATEGORIZE
    • 3SELECT

    STEPS 4 TO 7 · WAIT ON EVIDENCE

    • 4IMPLEMENT
    • 5ASSESS
    • 6AUTHORIZE
    • 7MONITOR

    RMF slows down in its
    last four steps

    Prepare, Categorize and Select are decisions. Implement, Assess, Authorize and Monitor wait on evidence.

    NIST SP 800-37 REV 2 · SEVEN STEPS

How REAEGIS answers

The package becomes a view of the running system, rebuilt each time the system changes.

  • The SSP is generated
    from live state

    Each control narrative is tied to the evidence that proves it, and rewritten when that evidence changes.

    • AXIOM
    • CHRONICLE

    ORION-1 / SSP / AC-2

    Evidence current
    AC-2Implemented

    Account management

    IMPLEMENTATION STATEMENT

    Accounts are provisioned through the identity provider, reviewed quarterly, and disabled on separation.

    Responsibility
    Customer,
    identity provider inherited
    Assessment methods
    Examine, test

    Evidence behind this narrative

    • Identity provider configurationsha256:41ab…9c02 · 2026-10-08
    • Quarterly access reviewsha256:7d10…44f1 · 2026-09-30
    • Account disable eventssha256:c3f8…0b7e · 2026-10-07

    3 records, signed and anchored

    Regenerated 2026-10-08 04:00Z from live state

  • The monthly package
    assembles itself

    POA&M, scan results, change report and inventory are collected from the pipeline, bundled and signed.

    • PHAROS
    • CHRONICLE
    Scan results, the change report, the inventory and the POA&M are bundled into the signed October package, which is delivered to the Authorizing Official, who reviews the current month.

  • FISMA metrics in
    CyberScope format

    The numbers you report are computed from the same signed records as the package.

    • AXIOM

    ORION-1 / FISMA metrics

    CyberScope format

    Fiscal year 2026, quarter 4

    Computed from signed records, 2026-10-08 04:00Z

    • IdentifySBOM · CM-8

      14 of 14

      Systems with a current hardware and software inventory

    • ProtectIA-2

      38 of 38

      Privileged users signing in with CAC or PIV

    • DetectRA-5

      212 of 212

      Assets covered by vulnerability scanning

    • RespondSI-2

      38 of 41

      Findings remediated inside the required time

    • RecoverCP-4

      Yes

      Contingency plan tested this fiscal year

    fisma-metrics-fy2026-q4

    Export
    Signed and anchored

  • A decision view for the
    Authorizing Official

    Readiness, open risk and the evidence behind them on one screen, for the person who signs.

    • AXIOM
    • PHAROS

    ORION-1 / Decision view

    Decision pending

    Authorization readiness

    82of 100

    Open risk41 findings, 3 past SLA

    • 2 critical
    • 9 high
    • 18 moderate
    • 12 low
    POA&M items
    17
    Evidence freshness
    96% current
    Package generated
    2026-10-08 04:00Z

    Authorizing Official

    Makes the authorization decision

    • Issue authorization
    • Authorize with conditions
    • Return for remediation

    REAEGIS prepares the view. A person decides, and the decision is recorded as a signed event.

What you hand over

The files your assessor and Authorizing Official already expect, generated from live state and signed.

  • OSCAL SSP

    ssp.oscal.json

    System security plan with every control narrative linked to its evidence.

    • OSCAL
    • JSON

  • Assessment plan and results

    sap.oscal.json, sar.oscal.json

    What was examined and tested, and what was found.

    • OSCAL
    • JSON

  • POA&M with closure evidence

    poam.oscal.json

    Each closed item carries its finding, fix, verification and approval.

    • OSCAL
    • EVIDENCE CHAIN

  • Monthly monitoring package

    monitoring-2026-10.zip

    Updated POA&M, scan results, change report and inventory from the SBOM.

    • MONTHLY
    • SIGNED

  • FISMA metrics

    fisma-metrics-fy2026-q4

    Computed from the same signed records as the package.

    • CYBERSCOPE FORMAT

  • EVERY FILE IS

    • Signed with Cosign
    • Anchored in Sigstore Rekor
    • Checkable with public tools

Frameworks

  • NIST SP 800-53 Rev 5
  • NIST SP 800-37
  • NIST SP 800-137
  • FISMA

Where it runs

In REAEGIS cloud or inside your own boundary. Federal access is by invitation, with CAC and PIV.

  • REAEGIS cloud sits outside the authorization boundary and exchanges findings and pull requests with GitHub, Tenable and ServiceNow inside it.

    REAEGIS cloud

    Runs outside and connects to your pipeline.

    Crosses the boundary
    Findings and pull requests
  • REAEGIS runs inside the authorization boundary next to GitHub and Grype, with no outside link needed.

    In your boundary

    Runs inside, next to your pipeline.

    Crosses the boundary
    Nothing

HOW PEOPLE SIGN IN

Invitation only
  1. ISSO, assessor or Authorizing OfficialInvited by the program
  2. CAC or PIVPresented at sign-in
  3. Your identity providerChecks the credential
  4. REAEGISTenant isolation enforced on each request

Authorization is not a destination. It is a system property.

Request a demo and we will walk one finding from detection to signed evidence.

Request a demoSee the platform

  • Federal programs

    Invitation only, with CAC and PIV.

    Request access

  • Commercial teams

    Self-register with single sign-on.

    Create a workspace

  • Pricing

    Plans start at $2,500 per month. In-boundary and air-gapped deployments are scoped per program.

    See pricing