{
  "advisorName": "REM5 LLC",
  "logo": "https://www.rem5.com/logo-512.png",
  "serviceDescription": "REM5 LLC is an independent advisory practice for commercial software companies entering and operating in United States federal and Department of Defense markets. We advise engineering and security teams on FedRAMP certification under the 2026 Consolidated Rules, on DoD Impact Level 4 and 5 authorization under the DoD Cloud Computing SRG, and on the engineering work underneath both: secure supply chain, FIPS-validated cryptography, DNSSEC, patch and System Security Plan automation, and Cloud Access Point design. Engagements are advisory. We work alongside the team that owns the authorization rather than producing its artifacts or meeting its ongoing requirements on its behalf.",
  "contactInformation": [
    "advisory@rem5.com",
    "https://www.rem5.com"
  ],
  "servicesOffered": [
    {
      "serviceName": "Federal Market Strategy",
      "serviceDescription": "Strategic direction for building a federal business: whether to pursue it at all, which agencies and programs to approach first, how to find and keep a sponsor, and what an authorization genuinely costs in engineering time rather than in consulting fees."
    },
    {
      "serviceName": "Government, NIST and DoD Requirements",
      "serviceDescription": "Translating NIST SP 800-53, FIPS, and Department of Defense policy into engineering work a team can schedule. The goal is that engineers understand why a requirement exists, not just that it was assigned to them."
    },
    {
      "serviceName": "Secure by Design Program Development",
      "serviceDescription": "Building the engineering culture, defaults, and controls that make an authorization a byproduct of how the team already works instead of a separate campaign run against a deadline."
    },
    {
      "serviceName": "FedRAMP Certification Advisory",
      "serviceDescription": "Advisory across FedRAMP certification under the 2026 Consolidated Rules: choosing among Certification Classes A through D, meeting Key Security Indicators, structuring evidence, and preparing for assessment. We advise the team that owns the certification; we do not produce its artifacts or meet its ongoing requirements on its behalf."
    },
    {
      "serviceName": "DoD Impact Level Authorization",
      "serviceDescription": "Advisory for Department of Defense Impact Level 4 and Impact Level 5 authorization under the DoD Cloud Computing SRG: what the authorization asks of the system and the engineering team, how it differs from FedRAMP certification, and how to sequence the two. IL5 now requires CNSSI 1253, the National Security System designation, and we advise on meeting those controls."
    },
    {
      "serviceName": "CNSSI 1253 and National Security System Controls",
      "serviceDescription": "Advisory on CNSSI 1253, the National Security System designation now required for Impact Level 5: which controls apply to a given system, and how to meet them in a running system rather than on paper."
    },
    {
      "serviceName": "FedRAMP Secure Configuration Guide",
      "serviceDescription": "Producing the customer-facing configuration guidance FedRAMP requires under SCG-CSO-RSC: how an agency securely accesses, configures, operates, and decommissions top-level administrative accounts, and what the settings only those accounts can reach actually do. Required of providers certified in Classes B, C, and D."
    },
    {
      "serviceName": "3PAO Selection",
      "serviceDescription": "Choosing an independent assessor, and knowing what to ask before signing. Assessors differ in the architectures they have actually assessed, how they handle findings mid-assessment, their throughput, and whether they have worked at your certification class or Impact Level. REM5 does not perform assessments — we help you pick the organization that will."
    },
    {
      "serviceName": "Authorization Maintenance",
      "serviceDescription": "Keeping an authorization alive after the award: continuous monitoring, significant change handling, vulnerability response within required timelines, and the reporting cadence that agencies and sponsors rely on."
    },
    {
      "serviceName": "IL4 and IL5 Cloud Access Point Design",
      "serviceDescription": "Designing connectivity that survives DoD Cloud Access Point and DISA connection review: boundary definition, CAP ingress and egress paths, and the network architecture decisions that are expensive to reverse once an authorization is underway."
    },
    {
      "serviceName": "DISA Enterprise Service Integration",
      "serviceDescription": "Designing the integrations an Impact Level 5 service has to make with DoD enterprise infrastructure: DISA EEMSG, MILProxy — the DNS proxy for .mil domains — and the DoD NIC. Planned for early these are routine; discovered late they force architecture changes."
    },
    {
      "serviceName": "DNSSEC Implementation",
      "serviceDescription": "Zone signing, key generation and rotation, chain of trust to the parent zone, and resolver behavior under failure. Covers the operational practices that keep a signed zone from becoming an outage."
    },
    {
      "serviceName": "Secure Supply Chain",
      "serviceDescription": "Building a supply chain you can make claims about: SBOM generation and consumption, build provenance and attestation, artifact signing and verification, dependency integrity, and the policy that decides what is allowed to ship. In DoD environments that extends to hardened base images and registries such as Iron Bank."
    },
    {
      "serviceName": "NIST IR 8587 — Token and Assertion Protection",
      "serviceDescription": "Advisory on meeting NIST IR 8587, Protecting Tokens and Assertions from Forgery, Theft, and Misuse: signing key management and scoping, token verification and validity periods, and the identity provider and authorization server architecture behind single sign-on, federation, and API access."
    },
    {
      "serviceName": "FIPS Compliance",
      "serviceDescription": "Implementing FIPS to meet FedRAMP and Department of Defense requirements: selecting validated cryptographic modules, configuring the stack to use them, and resolving the libraries and third-party components that need work before they will run under FIPS."
    },
    {
      "serviceName": "System Security Plan Automation",
      "serviceDescription": "Generating and maintaining System Security Plan content from live system state instead of by hand, so the documented system and the running system describe each other and stay that way between assessments."
    },
    {
      "serviceName": "CIS Benchmark and DISA STIG Hardening",
      "serviceDescription": "Applying and maintaining hardening baselines across the operating systems, containers, and services in scope: which benchmark or STIG applies to what, which deviations can be justified and how to document them, and keeping hardened images from drifting once they are running. We also advise on authoring new benchmarks and STIGs, and can help write them."
    },
    {
      "serviceName": "Patching Automation",
      "serviceDescription": "Meeting remediation timelines without a manual scramble: automated patch and image pipelines, vulnerability triage that distinguishes real exposure from scanner noise, and evidence that remediation happened when you said it did."
    }
  ]
}