From weeks of manual compliance to push-button ATO packages.
AI agents run the RMF lifecycle end-to-end. Connect your cloud, import your docs, ship the package. CSRMC-aligned. IL-5 ready.
IL-5 ready
FIPS 140-2 validated
0 known CVEs
STIG ASD V6R4 286/286
WOSB certified
80%
Faster Inventory
17
AI Agent Skills
3
eMASS Exports
<20m
Deploy Time
0
Known CVEs
395+
STIG Benchmarks
The Old Way vs. The New Way
Stop doing compliance by hand.
Every hour your team spends copy-pasting into spreadsheets is an hour not spent on mission. ezRMF automates the tedious parts so your people can focus on decisions that matter.
Manual RMFWith ezRMFTime saved
✕Weeks typing control narratives into spreadsheets→✓Agents extract controls from your existing docs in minutes~70%
✕Manual Excel inventory — track every asset by hand→✓AWS discovery pulls 9 resource types on schedule~80%
✕Copy-paste security findings into POA&M line items→✓Security Hub findings land in the POA&M automatically~90%
✕Hunt through folders and emails for evidence artifacts→✓Semantic search surfaces evidence by meaning, not filenamequalitative
✕Build eMASS import packages by hand→✓One click ships test results, POA&M, and inventory to eMASS~99%
How It Works
Four automation pillars.
Connect your environment, import your artifacts, let AI agents handle the grind, and export eMASS-ready packages. Each step replaces days of manual work.
01
Connect Your Cloud
Discover EC2, RDS, S3, Lambda, EKS, ALB, VPC, Security Groups, and EBS volumes on a schedule. Security Hub findings auto-create POAM items with NIST control mapping.
Run 17 sandboxed agent skills that assess controls, organize evidence, generate documents, and link findings to CCIs. Vector search retrieves evidence by meaning, not filename.
Sandboxed execution · Full audit trail · Vector search
Your team decides, not spreadsheets
04
Export to eMASS
Export the Test Result Import Template, POA&M, and Hardware/Software Inventory in one click. eMASS-compliant formatting, CUI banners, ready to submit.
3 export types · CUI-compliant · eMASS-validated format
100% automated package assembly
Platform Tour
See the workbenches.
ezRMF is built around the work an ISSO actually does. Each surface is purpose-built for the task it serves — not a generic forms layer with compliance bolted on.
Assess Workbench
AP-level status across every control, CSP inheritance resolved inline, and the agent flagging the exact evidence each non-compliant CCI still needs.
Controls Workbench
Live Implementation Statement editor next to source 800-53 text, with per-CCI evidence chips and ODP / responsible-role assignment in the same view.
Evidence Pipeline
Artifacts chunked, embedded, and indexed automatically. Hover any CCI to see ranked evidence with section-level citations and a confidence score.
eMASS Export
One-click .xlsx for the Test Result Import Template, POA&M, and Hardware/Software Inventory — CUI banner, prepared metadata, eMASS-validated layout.
CSRMC Alignment
Built for the 5-phase lifecycle.
Purpose-built for the DoD CSRMC framework. Full coverage from Design through Operations with continuous monitoring and cATO support.
01
Design
System categorization, control selection, policy creation
02
Build
Implementation tracking, evidence collection, CCI mapping
Continuous monitoring, cATO, real-time compliance status
What's New
Shipping every week.
Release notes live in GitHub Releases. Last three highlights:
v4.2.2
Dependency vulnerabilities patched
14 advisories closed (12 moderate, 2 high) across @anthropic-ai/sdk, @xmldom, hono, mermaid, postcss, uuid, ws and more. Release pipeline back to green.
2026-05-19
v4.2.0
Fast projects, polished collapsed nav
Per-user project index makes the projects page open in ms. Collapsed sidebar gets a project icon with hover flyout. What's New popup centered.
2026-05-19
v4.1.0
Tighter Assess workbench
Collapsible queue with status dots, restructured AP table, CCI badges with evidence count + chevron affordance, scrollable matrix, SCA/SCAR/AO chat history fix.
2026-05-19
Roadmap
Where ezRMF is going next.
A look at what's live today, what's in design, and what we're researching. Detailed release notes ship continuously on GitHub Releases.
Shipping Now
v4.2 · Now
Collapsible workbench navigation with hover flyouts
Polished Assess workbench — AP table, CCI affordances, scrollable matrix
Evidence chips with confidence ranking on every CCI
Per-user project index for instant project switching
OIDC authentication, role-based access control, and FIPS-compliant Chainguard containers with zero known vulnerabilities. Secure by default, not bolted on.
Edge Deployable
Two-container architecture with minimal resource footprint. Supports disconnected, forward-deployed, and IL-6+ classified environments.
Platform + Expertise
Infrastructure-as-code provisioning. From terraform apply to fully operational in under 20 minutes. Optional embedded engineer and ISSM support to accelerate your ATO timeline.
Engagement
Pick the tier that fits the mission.
Three ways to engage, from a 30-day pilot to a fully embedded ISSM. Every tier ships ezRMF the same way — only the support and deployment model change.
Every engagement is deployed inside your authorization boundary — ezRMF is not offered as a SaaS. Pricing and scope align to your funding vehicle (BPA, contract vehicle, MIPR, etc.). Contact [email protected].
Compare
How ezRMF stacks up.
An honest look at the tools an ISSM might be choosing between. We win on automation and time-to-ATO; eMASS is still the system of record, and we feed it.
Comparison based on publicly documented capabilities as of mid-2026. Mileage varies by program.
