Skip to main content

Now accepting design partners.

Request a demo
Request a demo

Cloud service providers

FedRAMP evidence,
generated
in machine-
readable form.

OSCAL packages and monthly monitoring deliverables come from your pipeline, not from a document.

Request a demoSee the platform

ORION-1 / Package

Signed

OSCAL package

FedRAMP High, Rev 5 baseline

Download

FileSize · Generated

  • ssp.oscal.jsonSignedSystem security plan4.8 MB · 04:02Z
  • sap.oscal.jsonSignedAssessment plan612 KB · 04:02Z
  • sar.oscal.jsonSignedAssessment results2.1 MB · 04:03Z
  • poam.oscal.jsonSignedPOA&M184 KB · 04:03Z

Generated from live state, 2026-10-08

sha256:d4a7…61be

The assessor tests
the system,
not the document.

Three pressures on every FedRAMP provider.

  • 01

    Assessors examine
    and test the system

    A narrative written months ago is stale before the assessment starts.

    NIST SP 800-53A · EXAMINE, INTERVIEW, TEST

  • 02

    Monitoring is due every month

    An updated POA&M, current scans, change reporting and an updated inventory are a condition of authorization.

    FEDRAMP CONTINUOUS MONITORING · MONTHLY

  • 03

    Packages are going
    machine-readable

    FedRAMP is replacing Word and Excel templates with machine-readable data. JSON is the default, OSCAL optional in some cases.

    FEDRAMP CONSOLIDATED RULES FOR 2026

How REAEGIS answers

The package is data, written from the system the assessor is about to test.

01

OSCAL written from
live state

Each control in the package is written from its current implementation and linked to its evidence.

  • AXIOM
  • CHRONICLE

SI-2

Implemented

Flaw remediation

Findings are fixed by pull request, scanned again, and closed with an evidence chain.

Latest evidence
Finding 0482
Anchored
Rekor 142907113

ssp.oscal.json

"implemented-requirements":[{"control-id":"si-2","props":[{"name":"implementation-status","value":"implemented"}],"links":[{"rel":"evidence","href":"#rekor-142907113"}]}]

02

Key Security Indicators
for FedRAMP 20x

Each indicator is evaluated from live evidence and shows its state without a narrative.

  • AXIOM
  • PHAROS

ORION-1 / FedRAMP 20x / Key Security Indicators

Evaluated 04:00 UTC

IndicatorState

  • Identity and access managementKSI-IAM12 records · 04:00ZMet
  • Change managementKSI-CMT31 records · 04:00ZMet
  • Monitoring, logging and auditingKSI-MLA18 records · 04:00ZMet
  • Service configurationKSI-SVCfinding 0519 openAttention
  • Cloud native architectureKSI-CNA9 records · 04:00ZMet
  • Third-party information resourcesKSI-TPR7 records · 04:00ZMet

Finding 0519, TLS 1.0 enabled at ingress,
holds KSI-SVC at attention

03

The monthly package,
assembled and signed

The four monthly deliverables are collected from the pipeline and signed, month after month.

  • PHAROS
  • CHRONICLE

ORION-1 / Monitoring / Deliveries

October assembled

MonthSignature

  • July 2026sha256:1c9e…f20aPOA&M, deliveredScans, deliveredChanges, deliveredInventory, delivered
  • August 2026sha256:83b4…0d17POA&M, deliveredScans, deliveredChanges, deliveredInventory, delivered
  • September 2026sha256:a2f0…c5e9POA&M, deliveredScans, deliveredChanges, deliveredInventory, delivered
  • October 2026sha256:d4a7…61bePOA&M, deliveredScans, deliveredChanges, deliveredInventory, delivered

Each month

  • Updated POA&M
  • Current scan results
  • Change reporting
  • Updated inventory

04

An assessor verifies
with public tools

A 3PAO can check any record against the public transparency log, without a REAEGIS account.

  • CHRONICLE
Assessor (3PAO)No REAEGIS account needed
  • Sigstore
  • Cosign
  • Rekor

Verify an evidence record

$cosign verify-blob finding-0482.json \--key reaegis.pub \--bundle finding-0482.bundleVerified OK$rekor-cli get --log-index 142907113Index:142907113IntegratedTime:2026-10-08T15:04:20ZBody:hashedrekordsha256:9f2c41d07be3…a41e
  • Signature valid
  • Entry found in Rekor
  • Timestamp matches the record

What you hand over

What goes to your 3PAO, your agency customers and the monthly monitoring review.

  • OSCAL SSP

    ssp.oscal.json

    The system security plan, written from live state.

    • OSCAL
    • JSON

  • Assessment plan

    sap.oscal.json

    What the assessor will examine, interview and test.

    • OSCAL
    • JSON

  • Assessment results

    sar.oscal.json

    Results and findings, each tied to the control it tests.

    • OSCAL
    • JSON

  • POA&M

    poam.oscal.json

    Open items, and closed items with their closure evidence.

    • OSCAL
    • JSON

  • Monthly monitoring package

    monitoring-2026-10.zip

    Updated POA&M, scan results, change report and inventory.

    • MONTHLY
    • SIGNED

  • Signed evidence

    evidence-2026-10.bundle

    Every record signed with Cosign and anchored in Sigstore Rekor.

    • COSIGN
    • REKOR

Frameworks

  • FedRAMP Rev 5 and 20x
  • NIST SP 800-53 Rev 5
  • NIST SP 800-137

Where it runs

In REAEGIS cloud or inside your own boundary. Your team signs in with SAML 2.0 or OpenID Connect.

REAEGIS cloud

Runs outside and connects to your pipeline.

Crosses the boundary
Findings and pull requests
Sign-in
SAML 2.0, OpenID Connect

In your boundary

Runs inside, next to your pipeline.

Crosses the boundary
Nothing
Sign-in
CAC and PIV

HOW PEOPLE SIGN IN

Single sign-on
  1. Your engineers and compliance teamRegister themselves
  2. Your identity providerSAML 2.0 or OpenID Connect
  3. API gatewayValidates the token on each request
  4. REAEGISIsolated by tenant

Authorization is not a destination. It is a system property.

Request a demo and we will walk one finding from detection to signed evidence.

Request a demoSee the platform

  • Federal programs

    Invitation only, with CAC and PIV.

    Request access

  • Commercial teams

    Self-register with single sign-on.

    Create a workspace

  • Pricing

    Plans start at $2,500 per month. In-boundary and air-gapped deployments are scoped per program.

    See pricing