One source of truth, two outputs
Inventory, findings, plans, POA&Ms and evidence live in one database. FedRAMP 20x machine-readable deliverables and the traditional Rev5 package are rendered from the same records.
Boundary Layer Control
Get to an ATO faster. Stay compliant with less effort.
BLC (Boundary Layer Control) is a compliance and operations platform for systems sold to the US Government. It helps teams reach an Authorization to Operate (ATO) faster and stay compliant afterwards. It keeps your inventory, findings, plans, POA&Ms and evidence in one place, and is built to produce FedRAMP 20x and Rev5 deliverables from the same records.
Built for FedRAMP 20x and Rev5.
What BLC does
POA&M stands for Plan of Action and Milestones, the list of known weaknesses and how each will be fixed. Five ideas shape the product.
Faster to an ATO
Inventory is generated from authoritative sources, not kept in a spreadsheet. Evidence and change history live in git, and every change is a reviewed pull request. Control analysis sits alongside 20x indicators.
Easier to stay compliant
Continuous monitoring, remediation clocks for both rubrics, and checker evidence that shows when it has gone stale. A merge is evidence, not closure; a rescan clears a finding.
Runs in your boundary
Built for delivery through the AWS Marketplace as containers on Amazon ECS with AWS Fargate, in your own AWS account, with your own identity provider.
An assistant that helps, never decides
Core functions are deterministic automation. PlannedAn optional in-app assistant drafts and suggests. People approve and sign.
From inventory to a current package
The same loop serves the first ATO and every month after it.
- Bring in what you have Inventory is generated from authoritative sources instead of a spreadsheet.
- Work it by role Each role gets an inbox of the work that needs it, with approvals routed to whoever owns them.
- Monitor continuously Checkers and scans report evidence with freshness. Findings carry remediation clocks.
- Produce the package FedRAMP 20x deliverables and the Rev5 package come from the same records.
Who it is for
BLC is for the people who carry a system through authorization and keep it there. Each of them works from the same records.
- ISSO Drafts and advises. Works the findings, plans and evidence for the system.
- Security program manager Signs risk acceptance and accepts the plan list that becomes the POA&M list.
- Assessor A read-only view of everything, including full history and evidence.
- Engineer Works remediation tickets and links the pull requests that make the change.
- SOC and NOC Their own roles and inboxes, on the same inventory and evidence the compliance team uses.
- Program manager A read-only view of plans, milestones, budget and risk posture.
Talk to us
Preparing for an ATO, or running continuous monitoring for a FedRAMP system? We would like to hear what you are working on.