Identity that survives the assessor cycle.
IGA, PAM, and zero-trust programs for federal agencies, state and local government, and federal contractors. FedRAMP, NIST 800-53, FISMA, and CMMC aligned.
- NIST 800-53
- FedRAMP
- FISMA
- CMMC
- NIST 800-171
- CJIS Security Policy
Use cases we have shipped in government.
- Use case · 01
PIV / CAC + derived credential access
Federal employee, contractor, and military access engineered around PIV, CAC, and derived mobile credentials. NIST 800-157 derived credential lifecycle wired into the IDP rather than handled by a parallel system.
- Use case · 02
FedRAMP Moderate / High access governance
Access governance and audit evidence for FedRAMP Moderate and High authorized boundaries. Continuous monitoring inputs delivered to the agency in formats that fit the assessor cycle, not a one-off export.
- Use case · 03
Zero-trust architecture per OMB M-22-09
Phased zero-trust implementations aligned to the federal zero-trust strategy. Identity, device, and network verification integrated with continuous risk evaluation — not a slide deck.
- Use case · 04
CMMC Level 2 / 3 readiness
IGA and PAM programs scoped to CMMC controls for defense industrial base contractors. CUI access and audit trail engineered to satisfy a third-party assessor in a single cycle.
- Use case · 05
FICAM-aligned identity programs
FICAM trust framework alignment for agencies and trust-bound partners. ICAM playbook integration into the live identity program, not as a separate documentation artifact.
- Use case · 06
Privileged access for classified environments
Privileged session governance for classified and high-impact environments. Recording, two-person rule, and audit trail engineered to satisfy ICD 503 and parallel agency-specific requirements.
- Use case · 07
Cross-agency federation + SLTT collaboration
Federated trust between agencies and with state, local, tribal, and territorial partners. SAML / OIDC trust frames and attribute release policies engineered to honor each side's constraints.
The buyer archetypes we have shipped programs for.
We hold NDA on most engagements. Tiers below reflect the buyer archetypes we have shipped programs for. References available on request, after mutual NDA.
- TB
Tier-1 US Bank
FFIEC · SOX
- CB
Custody Bank
GLBA · FFIEC
- FA
Federal Agency
FedRAMP High
- SS
State System
StateRAMP
- HS
Top-10 Hospital
HIPAA · HITRUST
- HP
Health Payer
HIPAA
- FP
FinTech Platform
PCI-DSS · SOC 2
- AM
Asset Manager
SOX · SOC 2
Practices that anchor this industry.
Common questions.
Are you authorized to work in regulated federal environments?+
We deliver in FedRAMP-authorized environments and operate under partner relationships with the major IAM vendors that hold FedRAMP authorization. For ATO-bound work we co-deliver with cleared sponsors. We are happy to discuss specific engagement constraints in discovery.
Can you align IAM evidence across NIST 800-53, FedRAMP, and FISMA simultaneously?+
Yes. The control overlap is high — NIST 800-53 is the substrate. We engineer evidence-as-code so a single control test produces artifacts mapped to FedRAMP CRM, FISMA SSP, and where relevant CMMC Level 2 / 3 control families. Reusable evidence; one cycle of work per quarter.
Do you work with PIV / CAC and derived credentials?+
Yes. PIV and CAC integration is a frequent engagement shape — typically alongside Okta, Entra, or Ping. NIST 800-157 derived mobile credential lifecycles are within scope; we engineer the issuance and revocation flows directly into the IDP.
How do you approach OMB M-22-09 zero-trust implementation?+
M-22-09 is a phased journey. We assess against the CISA Zero Trust Maturity Model first, then sequence interventions by impact and feasibility. Identity is the keystone pillar; we typically engage on the identity workstream first, then expand to device and network as the program matures.
What is a typical engagement shape for a federal agency?+
90-day diagnostic + reference architecture aligned to your assessor cycle, then phased build over 6-9 months for the first audit-scope. We engage early enough to influence ATO-period planning rather than reacting after a finding.
Ready to scope a government engagement?
Same-day reply during business hours. NDA on request before discovery.