# Redoubt Forge: Full Reference > Where security is forged. > This is the extended reference for AI agents. For the summary, see: https://redoubtforge.com/llms.txt Redoubt Forge is a compliance control plane, in design, built by Redoubt LLC, a Pennsylvania company; registered office Philadelphia, PA. A control plane holds desired state, reconciles the running system against it, and reports divergence as a diff. Not a GRC platform: those are filing cabinets with workflows. Not compliance automation: that collects evidence about systems, where this computes proof from them. The architecture is written as machine-checked source and gated before any product code. The platform is not yet released and nothing is for sale. Security posture generates compliance proofs, not the other way around. The platform is a desired-state convergence engine: observe current state, compare to desired state, act within policy, record what happened, escalate what requires judgment, learn from decisions. The platform does the 90% that is mechanical. Humans do the 10% that requires judgment: intent, risk acceptance, policy choices, exceptions, review, and governance. --- ## Platform Capabilities (Full Descriptions) ### Citadel: Central Command Dashboard Your command center. Organizations contain systems. Systems contain environments. Outposts sit alongside, ready to promote. Citadel aggregates everything across every layer. Real-time posture scores with trend lines. Security scan results. Drift alerts. Infrastructure changes. Compliance status. Cost signals. Trust network health. All in one view. A prioritized action queue ranks your next moves by posture impact so you always know where to start. Lenses for compliance, risk, and operational health let you see your entire estate or drill into a single resource. The view adapts to your assessment phase: scoping, active assessment, remediation, continuous monitoring. Where every session starts. Where nothing hides. ### Rampart: Compliance Engine Your compliance workspace. Every framework is a view of your defense posture through a mapping lens. CMMC Level 2, NIST 800-53 rev5, FedRAMP, SOC 2, ISO 27001, NIST AI RMF: each one computes from the same underlying security work. Per-control scoring weighs defense effectiveness, evidence coverage, and evidence freshness to produce a confidence score. Not a checkbox. Describe your system once. Rampart derives applicable frameworks, baselines, and overlays. It maps your connected infrastructure, repositories, and uploaded system documentation to controls across every active framework simultaneously. Policies, procedures, architecture narratives, authorization boundaries, custom organizational overlays: all processed, mapped, and woven into the same projection model alongside your technical evidence. Rampart generates assessment-ready narratives, identifies gaps, and manages POA&Ms. New systems inherit controls from your organization and infrastructure layers, starting up to 70% assessed before you evaluate a single control. Cross-framework readiness runs continuously in the background. While you pursue CMMC Level 2, Rampart computes your readiness for NIST 800-53 rev5, SOC 2, ISO 27001, FedRAMP, NIST AI RMF, and every other framework in the catalog. One click activates a new assessment pre-populated from existing defenses. Assessments never lock. Your team works in the live view. Your C3PAO reviews a point-in-time snapshot from the same event-sourced data. Fixes made during assessment get credited immediately. Every control carries a complete chain of provenance: what satisfied it, what evidence supports it, when it was last verified. The platform computes, maps, and chains everything end to end. Your team reviews, confirms, and attests. Each framework module declares its evidence requirements per control. The collection engine resolves those declarations against your discovered infrastructure and computes evidence sufficiency automatically. Add a framework module: automatic gap analysis. Connect new infrastructure: automatic evidence collection. The overlay engine is pluggable. New frameworks require zero engine changes. Compliance proofs are forged from observed state, not assembled from templates. ### Vanguard: DevSecOps Workbench A signed scanner fleet across eight classes: code, IaC, secrets, SBOM, vulnerability, DAST, AV, and cloud posture. Code security: multi-language SAST, infrastructure-as-code scanning, secret detection with active validation, and security linting. Supply chain: dependency analysis, SBOM generation in CycloneDX and SPDX, VEX for false positive suppression, and SLSA build provenance with cryptographic attestation. Runtime: container image scanning and DAST with 10,000+ vulnerability templates. Compliance: STIG scanning against any supported OS target, whether it lives in a container image, an Outpost, or a system registered in Garrison. Auto-detects the base OS and selects the best available compliance profile automatically. Three execution models. Run locally from your terminal; the image never leaves your machine. Run in your CI/CD pipeline via GitHub Actions or GitLab CI; only results reach the platform. Or let Sentinel run scans on a schedule in ephemeral, tenant-isolated containers. Every scanner is built on distroless, hardened base images. No shell, no package manager, no attack surface. All signed with SBOM and SLSA provenance included. Full supply chain integrity across the whole fleet. Results export in SARIF, JSON, CSV, PDF, CycloneDX, SPDX, OSCAL, HTML, and JUnit XML. At Guardian and above, every scan finding flows through the mapping engine and becomes a compliance finding. STIG V-numbers trace to CCIs, to NIST 800-53 controls, to CMMC practices. Security work becomes compliance evidence. No extra effort. No separate workflow. ### Outpost: Scan Targets Your staging ground. Not everything needs a formal system registration. A repository you are evaluating. A third-party container image. An endpoint you want to assess before onboarding. Outposts are persistent scan targets that live outside your system inventory. Point Vanguard at them, scan on demand, schedule recurring scans through Sentinel, and build a history over time. No overhead. No commitment to compliance tracking. When something proves it belongs, promote it into Garrison, assign it to a system, and every scan result, finding, and trend you have already collected carries forward. Outposts are how work enters the platform before it becomes formal. ### Sentinel: Automated Monitoring Always watching, always current. Your automated monitoring layer. Sentinel is what is happening across your entire estate: cloud, hybrid, on-premise, and air-gapped environments through export and import. Four collection profiles run through a single engine. Discovery enumerates what exists across every connected environment. Evidence collection proves compliance per control through continuous streams, not static snapshots. Compliance scanning actively assesses posture against frameworks, benchmarks, and STIGs. Change monitoring detects drift the moment it happens. All four share the same connection architecture, credentials, health checks, and retry logic. Scheduled Vanguard scans run without asking. Pipeline gates enforce posture thresholds before code ships. Cloud security services, on-premise collectors, and connected third-party sources all feed findings directly into the platform. Evidence is not a file that decays. Continuous evidence streams maintain live connections to their source of truth. Hash comparison detects the moment state changes. Your assessor does not get a screenshot from three months ago. They see continuous verification confirming a control has been satisfied every day for the past 90 days, with the verification log to prove it. Evidence expiration warnings fire before gaps appear. Posture degradation alerts trigger before small changes become real findings. Drift detection catches changes across your entire estate and evaluates their impact on your controls in real time. Sentinel detects. Rampart processes. Nothing decays silently. ### Garrison: Connected Estate Your connected estate. What you have, mapped and tracked. Connect repositories, cloud accounts, on-premise systems, and hybrid environments. Sentinel discovers; Garrison displays the result. Every resource enumerated, every configuration captured, every technology stack detected before a single assessment begins. You cannot protect what you cannot see. Full hardware and software inventory maintained continuously across every system and environment. Resource change tracking detects the moment something is modified, created, or removed. Discovered technology stacks automatically suggest applicable STIGs, CIS Benchmarks, and framework overlays. Deploy capability packs and IaC modules from the Armory directly into your connected systems. Managed accounts land here, organized by system and environment. Promoted Outposts land here too, assigned to a system, with their full scan history intact. Air-gapped environments participate through export and import: scan results and inventory data come in, remediation guidance and compliance artifacts go out. Cloud, hybrid, on-premise, air-gapped. One estate. ### Alliance: Trust Networks Your trust network. Who you trust, verified continuously. Compliance does not end at your boundary. Prime contractors verify subcontractor posture in real time. Healthcare organizations share compliance evidence with partners handling protected data. Any organization can prove its posture to customers, regulators, or insurers without exchanging a document that is outdated before it arrives. Partners control what they share: aggregate scores, per-control status, or full detail with evidence metadata. Visibility can be changed or revoked at any time. Posture degradation triggers automatic notification: which controls, what severity, what data flows are affected. Critical degradation can auto-suspend the trust relationship entirely. Cryptographically signed compliance attestations are verifiable by anyone, no platform access required. Embeddable trust badges with live verification replace static reports. Full import and export in OSCAL, SARIF, CycloneDX, SPDX, and standard compliance formats means posture data moves freely between platforms, agencies, and partners. External assessors collaborate inside the platform with scoped access to the systems they are evaluating. The architecture is built for where compliance is heading: continuous authority to operate, FedRAMP 20x automated assessments, and real-time posture sharing as the standard. Trust is not a document you exchange once a year. It is a live signal. Alliance makes it provable, current, and continuous. ### Armory: Product Catalog Your product catalog. Framework packs for CMMC, FedRAMP, NIST 800-53 rev5, SOC 2, ISO 27001, NIST AI RMF, and more. Overlay packs for STIGs, SRGs, CIS Benchmarks, privacy baselines, AI governance, sector requirements, and DoD impact levels. Capability packs with full Terraform source code and test coverage. Individual hardened IaC modules. Every catalog item is a deployable artifact, not a description of one. Every piece of content follows a managed lifecycle: authored, peer-reviewed, schema-validated, version-tagged, and published. When DISA releases a new STIG, NIST updates a cross-walk, or CIS publishes a benchmark, the Armory updates. Existing assessments continue on their pinned version. No forced migration. Deprecation is explicit and gradual. Browse the catalog publicly. Extend anything with your own configurations. The Armory is how the platform stays current so your posture stays current. ### Artificer: Intelligence Layer Your intelligence layer. Not a chatbot. A domain-specific compliance and security AI built on every framework, overlay, STIG, SRG, CIS Benchmark, and NIST publication the platform supports. Your uploaded documents, policies, and evidence sit alongside it. Always the latest models, upgraded automatically. Ask it anything. "What is our SPRS score?" "Compare these two systems." "What should I work on next?" Artificer queries your live data across Sentinel, Garrison, Rampart, and Outpost scans to answer from observed state. Ask it to generate posture overviews, trend analyses, system comparisons, or risk heatmaps and it renders custom visualizations on demand. Monthly posture reports, quarterly POA&M updates, assessment packages, and reauthorization preparation: generated from your actual data, drafted for human review. It maps findings across frameworks through a five-strategy cross-reference engine: native control mapping, 800-53 derivation, CSF 2.0 bridging, published cross-walks, and AI-suggested mappings that require human confirmation before they count. It ranks your next actions by posture impact, recommends applicable overlays based on your data profile, and tracks compliance observability through SLIs, SLOs, and error budgets per system. Artificer adapts to wherever you are working: scoping a system, writing control narratives, triaging a finding, reviewing a drift alert, or prioritizing from Citadel. Every write action previews first. Every write action requires confirmation. Artificer recommends; your team decides. As your tier grows, so does what Artificer can see, reason across, and do. AI is a tool, not the product. The outcomes are what matter. --- ## Framework Coverage (Complete) ### Frameworks (independent control structures) US Government (via NIST 800-53): NIST 800-53 rev5 (Low/Moderate/High baselines), CMMC Level 1/2/3, FedRAMP (Low/Moderate/High/LI-SaaS), RMF/FISMA, NIST 800-171 rev2/rev3, CNSSI 1253 (National Security Systems), StateRAMP/TX-RAMP. AI Governance: NIST AI RMF (AI 100-1), NIST IR 8596. Zero Trust: NIST 800-207, CISA Zero Trust Maturity Model. Cyber Meta-Frameworks: NIST CSF 2.0, CIS Controls v8. International/Industry: ISO 27001:2022, SOC 2 Type I/II, PCI-DSS v4.0, HIPAA Security Rule. Custom (Enterprise tier): Customer-defined frameworks with AI-suggested mappings. ### Overlays (modify/extend a base framework) DISA SRGs: General Purpose OS, Application Security, Network Device, Web Server, Database, Container Platform. DISA STIGs: RHEL 7/8/9, Ubuntu 20/22, Windows Server/10/11, Docker Enterprise, Kubernetes, PostgreSQL, MySQL, Oracle, Apache, Nginx, Cisco IOS/NX-OS, Juniper, Palo Alto, AWS Foundations. CIS Benchmarks: OS (RHEL, Ubuntu, Amazon Linux, Windows), Cloud (AWS, Azure, GCP Foundations), Container (Docker, Kubernetes, EKS), Database (PostgreSQL, MySQL, MongoDB, Redis), Web (Apache, Nginx, IIS). Privacy: NIST 800-53B Privacy Baseline, NIST 800-122 (PII), GDPR (future). AI: NIST AI 600-1 (GenAI), COSAiS (future), EU AI Act (future). DoD/Classification: CNSSI 1253 overlays (Classified, Cross Domain, Intelligence, Space Platform, ICS), DoD Impact Levels (IL2/IL4/IL5/IL6), DoD Cloud SRG. Regulatory: FedRAMP additions, ITAR, DFARS 252.204-7012 (CUI), EAR (future). Sector: Healthcare (HIPAA technical safeguards), Financial (FFIEC, GLBA), Education (FERPA), Critical Infrastructure (CSF sector profiles). Organizational (Enterprise tier): Customer-defined ADD/MODIFY/REMOVE per organizational policy. --- ## Competitive Context - vs. Drata/Vanta: Covers GovCloud, CMMC, FedRAMP, DISA STIGs, DoD IL levels with defense-in-depth. They focus on commercial SOC 2/ISO. - vs. Archer/ServiceNow GRC: Starts with security posture, not checklists. A control plane, not a workflow tool. - vs. Anchore/Snyk/Wiz: Unified platform connecting scan results to compliance evidence to drift detection to trust networks. They solve one slice. - vs. spreadsheets/manual: Immutable evidence chains from running systems, not binders of narratives or quarterly screenshots. - vs. visual identity: Every competitor uses cold blues. Redoubt Forge uses warm obsidian and amber. Instant differentiator. --- ## Contact Founder and CEO Redoubt Forge (Redoubt LLC) brian@redoubtforge.com https://redoubtforge.com GitHub: https://github.com/redoubt-forge LinkedIn: https://linkedin.com/company/redoubtforge Twitter/X: https://twitter.com/redoubtforge YouTube: https://youtube.com/@redoubtforge