Products Authorization and vulnerability management

Cordevan

STIG checklists and RMF evidence, collected for you inside the air gap.

Agents gather the evidence from your systems. Cordevan turns it into the checklists, findings and RMF artifacts your authorization depends on, all without an internet connection.

Request a product discussion

Demo available v0.49.0

Why it exists

The evidence is already in one place.

Authorization teams lose days pulling scan results, spreadsheets and screenshots together before anyone can judge risk. Cordevan pulls it straight from the systems and keeps it in one record that the ISSO, the ISSM and the program office all work from.

Product scope

What Cordevan does today.

Collects the evidence itself

Agents for Linux and Windows enroll over mutual TLS and report inventory, services, patches, permissions, audit and crypto settings, and container platforms. Network discovery finds what has no agent yet, with port profiles for ICS/OT segments.

Works the STIG checklist

Import DISA STIGs as published, adjudicate each rule with a justification, manage waivers, and export CKL and CKLB checklists for STIG Viewer.

Puts known exploited vulnerabilities first

Matches discovered software against NVD data, scores it with CVSS through v4.0, and escalates anything on the CISA Known Exploited Vulnerabilities list.

Produces the paperwork

Builds SSP, SAR, POA&M and evidence packages, exports eMASS-compatible CSV and OSCAL POA&M, and maps findings to NIST SP 800-53, NIST SP 800-171 and CMMC.

Deployment model

Runs inside the boundary.

Cordevan installs with Docker Compose or Kubernetes and runs with no internet connection. It connects to the SIEM, ticketing and directory services you already operate.

  • Fully offline install with Docker Compose or Helm
  • SIEM forwarding, plus Jira and ServiceNow ticketing with status sync
  • LDAP and Active Directory sign-in with role-based access
  • FIPS mode, a tamper-evident audit log and USG consent banners
Framework coverage

The records Cordevan is built to support.

  • NIST RMF
  • NIST SP 800-53
  • NIST SP 800-171
  • CMMC (via the DoD CCI crosswalk)
  • DISA STIGs
  • OSCAL POA&M
  • XCCDF 1.2
  • CycloneDX SBOM
Technical review

Architecture belongs in the technical conversation.

Security design, deployment prerequisites and product architecture are shared in a technical review with your team.

Request a technical review
Product questions

Before an evaluation.

What does Cordevan do?

Cordevan collects STIG and vulnerability evidence with agents on Linux and Windows systems and turns it into CKL and CKLB checklists, POA&M items, SSP and SAR content, and eMASS-compatible exports. It runs fully offline.

Can Cordevan operate without an internet connection?

Yes. Cordevan installs with Docker Compose or Kubernetes and runs with no internet connection. DISA STIG content and NVD and CISA KEV vulnerability data are imported into the environment, and the Linux agent is signed and checked before install.

Which frameworks does Cordevan support?

Findings map to NIST SP 800-53, with NIST SP 800-171 and CMMC mappings through the DoD CCI crosswalk. STIG work follows DISA STIGs. Results export as eMASS-compatible CSV, OSCAL POA&M and XCCDF 1.2, and the software admission analyzer produces signed CycloneDX evidence.

What is included in an evaluation?

An evaluation runs the current release on a bounded set of your systems inside your environment. We agree on the scope and the features included before it starts.

Product discussion

See it on your own systems.

Tell us about the enclave and the authorization work ahead. We will show the current release and set up a demonstration or a bounded evaluation.

Start a product conversation