Skip to main content

Now accepting design partners.

Request a demo
Request a demo

DoD programs

Continuous ATO, inside your boundary.

REAEGIS runs where your system runs, measures the three continuous ATO competencies, and keeps eMASS current.

Request a demoSee the platform

ORION-1 / Readiness

Evaluated 04:00 UTC

Authorization readiness

82of 100

Three competencies named by the DoD CIO

  • Continuous monitoring

    88

    Evaluation
    Daily
    Finding age
    6 days
    Package
    On time

  • Active cyber defense

    74

    Finding to fix
    4.2 days
    Gate pass rate
    91%
    Past SLA
    3

  • Secure software supply chain

    84

    Pipeline depth
    11 gates
    Signed artifacts
    97%
    SBOM
    Current

Measured from pipeline and monitoring events

2026-10-08 04:00Z

The boundary
sets the rules.

Three pressures on every DoD program office.

  • outsideOutside serviceauthorization boundaryServerDatabase

    Tooling must run
    inside the boundary

    In an IL4 or IL5 environment, nothing can depend on a service outside it.

    DOD IMPACT LEVELS · IL4 AND IL5

  • poam-status.xlsxtest-results.pdfTyped by handeMASS

    eMASS is updated by hand

    POA&M status and test results are retyped into the system of record at every milestone.

    EMASS · DOD SYSTEM OF RECORD FOR RMF

  • Checklist age by severity: assessed at the last assessment, not checked today
    SEVERITYASSESSEDTODAY
    CAT IAssessedNot checked
    CAT IIAssessedNot checked
    CAT IIIAssessedNot checked

    STIG compliance must stay current

    A checklist from the last assessment says nothing about the configuration running today.

    DISA STIGS · HARDENING BASELINES

How REAEGIS answers

It runs inside the boundary, and it keeps the system of record in step with the system.

Three ways to keep
eMASS current

Pick the path your network policy allows. eMASS stays the system of record.

  • AXIOM
  • CHRONICLE

  • Export files

    Files in the eMASS import format, uploaded by your team.

    REAEGIS exports files, your team uploads them manually to eMASS.

  • In-boundary agent

    Syncs POA&M status and results with a PKI credential you own.

    REAEGIS never holds the key

    REAEGIS syncs with an in-boundary agent, which updates eMASS with your PKI credential.

  • Direct API

    A direct connection, where network policy allows.

    REAEGIS and eMASS exchange data directly over the API in both directions.

A deterministic rule engine covers about 80% of findings with no external service.

An update kit for
air-gapped enclaves

A signed bundle comes in on your schedule and is verified before install. Nothing goes out.

  • ADVERSARIUS
  • CHRONICLE

STIG checks that
stay current

OpenSCAP evaluates each host against its DISA STIG and writes the checklist file for you.

  • ADVERSARIUS
  • PHAROS

ORION-1 / STIG / api-gateway-01

2 open
OpenSCAP

OpenSCAP evaluation

Host api-gateway-01, evaluated 2026-10-08 04:00Z

  • CAT I0 open
  • CAT II2 open
  • CAT III0 open

  • SSH restricted to approved ciphers

    CAT I · SC-8

    Pass

  • FIPS mode enabled for cryptographic modules

    CAT I · SC-13

    Pass

  • Audit records sent to a central collector

    CAT II · AU-4

    Open

  • Session lock after 15 minutes of inactivity

    CAT II · AC-11

    Open

  • Notice and consent banner shown before access

    CAT III · AC-8

    Pass

Written on each evaluation

api-gateway-01.cklremediation.sh
  1. Finding 0482SI-2 · RA-5Grype
  2. Rebuildhardened baseIron Bank
  3. Gates11 evaluated
  4. Pull request #482api-gatewayGitHub
  5. Maya Reyesapproves

Dockerfile

Removed: - FROM node:20.11.0

Added: + FROM registry1.dso.mil/…/nodejs20:20.11.1

WORKDIR /app

GATES ON THE REBUILT IMAGE

  • VULNERABILITYPASS
  • IMAGE_DIGESTPASS
  • SBOM_INTEGRITYPASS

Hardened images in
the rebuild path

A vulnerable base image is rebuilt on an Iron Bank image, checked by the gates, and sent for review.

  • ARE
  • RAMPART

What you hand over

What your ISSM uploads, your assessor checks and your Authorizing Official signs against.

  • eMASS-formatted exports

    POAM_ORION-1.xlsx

    POA&M status and control results in the eMASS import format.

    • EMASS IMPORT

  • POA&M with closure evidence

    evidence_0117.zip

    Each closed item carries its finding, fix, verification and approval.

    • EVIDENCE CHAIN
    • SIGNED

  • STIG checklist files

    api-gateway-01.ckl

    One checklist per host, with a remediation script for open rules.

    • CKL
    • REMEDIATION SCRIPT

  • OSCAL package

    ssp.oscal.json, poam.oscal.json

    SSP, assessment plan, assessment results and POA&M.

    • OSCAL
    • JSON

  • Signed evidence packages

    evidence-2026-10.bundle

    Every record with its signature, ready for an assessor to verify.

    • COSIGN

  • EVERY FILE IS

    • Signed with Cosign
    • Anchored in Rekor, or the internal log
    • Verifiable inside the boundary

Frameworks

  • DoD RMF
  • NIST SP 800-53 Rev 5
  • IL4 and IL5
  • DISA STIGs

Where it runs

Inside your IL4 or IL5 boundary, or in an air-gapped enclave. Sign-in is CAC and PIV.

  • In your boundary

    Runs inside an IL4 or IL5 environment, next to your pipeline.

    Crosses the boundary
    Nothing

  • Air-gapped

    Runs inside an enclave. The network link is cut.

    Crosses the boundary
    A signed update kit, inbound only

HOW PEOPLE SIGN IN

CAC and PIV
  1. ISSM, ISSO or Authorizing OfficialOn the program network
  2. CAC or PIVPresented at sign-in
  3. Your identity providerInside the boundary
  4. REAEGISREAEGISInside the boundary

Authorization is not a destination. It is a system property.

Request a demo and we will walk one finding from detection to signed evidence.

Request a demoSee the platform

  • Federal programs

    Invitation only, with CAC and PIV.

    Request access

  • Commercial teams

    Self-register with single sign-on.

    Create a workspace

  • Pricing

    Plans start at $2,500 per month. In-boundary and air-gapped deployments are scoped per program.

    See pricing