Treasury Security Integration Platform
23 Contract Objectives · 4,218 assets · 8 bureaus · 14 Tier 1 HVAs
Program SHS
90
Cycle 00:00
Program Security Health Score
90
↑ +3 since last cycleT-SIP PROTECTS II · All 5 Groups
Group Scores
GRC
87
Identity
93
SecOps
88
Eng
91
Strategy
89
0Target ≥ 80100
4,218
Managed Assets
100% CMDB
27
Open Tickets
3 near SLA
27
PROTECTS II FTEs
vs ~70 traditional
23
Contract Objectives
All Active
All 5 Groups — Security Health Score & PB Status
All Groups Live
Group 1 · GRC
RMF · ATO · FISMA · SCRM · Privacy
87
1.1
1.2
1.3
1.4
Group 2 · Identity
ICAM · HVA · CI · Enterprise IAM · COMSEC
93
2.1
2.2
2.3
2.4
2.5
Group 3 · Sec Ops
ISCM · SOC · IR · Threat Intel · Insider Threat
88
3.1
3.2
3.3
3.4
3.5
Group 4 · Engineering
Zero Trust · DevSecOps · Resilience · AI Guardian
91
4.1
4.2
4.3
4.4
Group 5 · Strategy
SLAs · CDRL · Workforce · Transition · Innovation
89
5.1
5.2
5.3
5.4
Guardian — Live Cross-Group Action Feed
Auto-Running
[G4] Build blocked: occ-risk-platform — Critical SAST CWE-89 at line 247 — P1 created, dev team notified
cycle:0847 · G4 · 2 min ago
[G2] PIV bypass: j.smith@irs.gov — non-PIV auth detected, P1 ticket open, session flagged
cycle:0847 · G2 · 3 min ago
[G1] CISA KEV match: log4j-2.17.1 in 3 vendor SBOMs — Critical tickets auto-created, scan queued
cycle:0847 · G1 · 5 min ago
[G5] CO-010 at 81% SLA elapsed — warning task sent to IR Lead; escalation triggers at 90%
cycle:0847 · G5 · 7 min ago
[G3] 145,290 IOCs processed — 0 new matches against 4,218 assets this cycle
cycle:0847 · G3 · 9 min ago
[G4] Autonomous patch: CVE-2025-1847 applied to 28 endpoints via CrowdStrike RTR — MTTR 9 days
cycle:0846 · G4 · 14 min ago
[G4] Bedrock: 147 AI remediation plans generated and WORM-logged — 0 unaudited AI decisions
cycle:0846 · G4 · 18 min ago
[G2] HVA coverage verified: 14/14 Tier 1 HVAs in Orca + CrowdStrike — no gaps
cycle:0846 · G2 · 20 min ago

Group 1 — Governance, Risk & Compliance

RMF · ATO Management · FISMA · Supply Chain Risk · Privacy & Data Protection

CO-001 · CO-002 · CO-007 · CO-008 — 4 Performance Baselines
SHS Score
87
ATO Coverage
—
47 systems authorized
Zero past expiry
Open POA&Ms
—
CRIT/HIGH milestones active
3 approaching SLA
FISMA Score
—
Controls rated Effective
↑ +4% vs last cycle
KEV Matches
—
SBOM CVE active matches
Tickets open
PB Status
4 PBs
PB 1.1 — RMF & ATO ManagementCO-001100%
PB 1.2 — FISMA & ComplianceCO-00291%
PB 1.3 — Supply Chain RiskCO-00784%
PB 1.4 — Privacy & Data ProtectionCO-00878%
Bureau FISMA Heat Map
8 Bureaus
IRS
94%
1,842 assets
BFS
88%
612 assets
OCC
71%
389 assets
FINCEN
92%
287 assets
BPD
85%
241 assets
MINT
96%
198 assets
OFR
63%
312 assets
TTB
89%
137 assets
Guardian — GRC Actions
Live
POA&M auto-created: CVE-2025-1187 (IRS) — NIST CM-7 mapped, ISSO assigned
cycle:0847 · 2m ago
OCC-RISK-MGMT ATO 75 days to expiry — ISSO task auto-issued
cycle:0847 · 3m ago
KEV match: log4j-2.17.1 in 3 SBOMs — Critical tickets created, scan queued
cycle:0847 · 5m ago
FISMA CyberScope compiled — all 8 bureaus contributing, 30-day advance submitted
cycle:0846 · 10m ago
PIA task issued: 2 new Orca assets in BPD — Privacy Officer assigned
cycle:0846 · 12m ago
NIST CM family: 79% — ISSO task with 4 failing findings named
cycle:0845 · 17m ago
Guardian Advisory — Group 1 · GRC AI Active
Ready — select a briefing mode

Group 2 — Identity, Access & Asset Security

ICAM · High Value Asset Protection · Critical Infrastructure · Enterprise IAM · COMSEC

CO-004 · CO-013 · CO-014 · CO-018 · CO-020 — 5 Performance Baselines
SHS Score
93
PIV Enforcement
🆔
—
Privileged via PIV/CAC
6 flagged
HVA Coverage
—
Tier 1 HVAs monitored
100%
JIT Sessions
—
HVA sessions < 8hr
2 auto-revoked
CUI Violations
—
DLP events this cycle
All rules active
Tier 1 HVA Monitoring — All 14 Systems
14/14 Online
TAX-CORE
✅
Low
BFS-PAY
✅
Low
OCC-RISK
⚠️
Med
FINCEN
✅
Low
BPD-OPS
✅
Low
MINT-MFG
✅
Low
TTB-OPS
✅
Low
IRS-EIN
✅
Low
IRS-EFILE
✅
Low
OFR-DATA
⚠️
Med
DO-INTEL
✅
Low
BFS-ACH
✅
Low
IRS-ACS
✅
Low
TREAS-VPN
✅
Low
PB Status
5 PBs
PB 2.1 — ICAM MaturityCO-00498%
PB 2.2 — HVA ProtectionCO-013100%
PB 2.3 — Critical InfrastructureCO-01487%
PB 2.4 — Enterprise IdentityCO-01895%
PB 2.5 — COMSECCO-02091%
Okta Federation — 8 Bureaus
8/8
IRS
● Active
1,842 users
BFS
● Active
612 users
OCC
● Active
389 users
FINCEN
● Active
287 users
BPD
● Active
241 users
MINT
● Active
198 users
OFR
Degraded
312 users
TTB
● Active
137 users
Guardian — Identity Actions
Live
PIV bypass: j.smith@irs.gov — P1 open, session blocked, ISSO notified
cycle:0847 · now
JIT auto-revoked: HVA:OFR-DATA exceeded 8-hour cap — P2 ticket created
cycle:0847 · 1m ago
OFR federation degraded — 0 events this cycle, P1 to identity team
cycle:0847 · 3m ago
HVA verified: 14/14 in Orca + CrowdStrike — no gaps this cycle
cycle:0847 · 4m ago
UEI dedup: 4,218 assets normalized; 3 new auto-registered in CMDB
cycle:0846 · 9m ago
KMS key check: 2 keys at 88-day age — custodian tasks assigned (IRS + BPD)
cycle:0846 · 11m ago
Guardian Advisory — Group 2 · Identity AI Active
Ready — select a briefing mode

Group 3 — Security Operations & Monitoring

ISCM · SOC Integration · Incident Response · Threat Intelligence · Insider Threat

CO-003 · CO-005 · CO-010 · CO-012 · CO-015 — 5 Performance Baselines
SHS Score
88
Asset Coverage
—
Assets scanned < 7 days
Zero gaps
Triage SLA
—
Tickets acked < 15 min
Above 80% target
P1 Escalation
—
Mean CISO escalation time
Under 5-min SLA
IOCs/Day
—
IOCs processed this cycle
0 new matches
PB Status
5 PBs
PB 3.1 — Continuous Monitoring (ISCM)CO-00395%
PB 3.2 — SOC Operations & IntegrationCO-00588%
PB 3.3 — Incident ResponseCO-01092%
PB 3.4 — Threat Intel & Vulnerability HuntingCO-01284%
PB 3.5 — Insider Threat MonitoringCO-01579%
Vendor Connector Status
8/8 Live
CrowdStrike
47,291 events/cycle
● Live
Qualys
4,218 assets scanned
● Live
Orca Security
Cloud posture active
● Live
Splunk
SIEM events ingesting
● Live
Palo Alto
Firewall policy active
● Live
zScaler
Proxy enforced
● Live
Okta
Identity events flowing
OFR degraded
ServiceNow
Ticketing connected
● Live
Guardian — SecOps Actions
Live
145,290 IOCs processed — 0 new matches against 4,218 assets this cycle
cycle:0847 · 1m ago
All 8 connectors verified alive — no silent feeds this cycle
cycle:0847 · 2m ago
IRS-ACS-17 scan overdue 8 days — ISSO task created, bureau named in brief
cycle:0847 · 4m ago
P1 escalation fired: CVE-2025-4491 — CISO chain SNS at 4.1 min (SLA: 5 min)
cycle:0846 · 9m ago
CISA KEV feed verified — 0 new CVEs added since last cycle
cycle:0846 · 11m ago
Threat bulletin drafted: Q2 TTPs from IOC matches — ISSO distribution queued
cycle:0845 · 16m ago
Guardian Advisory — Group 3 · Security Operations AI Active
Ready — select a briefing mode

Group 4 — Security Engineering & Technology

Zero Trust Architecture · DevSecOps · Resilience & Chaos · AI Cybersecurity Enablement

CO-006 · CO-016 · CO-017 · CO-022 — 4 Performance Baselines
SHS Score
91
ZTA Alignment
—
Internet-facing behind proxy
4 bypasses blocked
Critical MTTR
—
Mean time to remediate
Inside 15-day SLA
Pipeline Gates
—
All pipelines gated
0 ungated builds
Bedrock Plans
—
AI plans this cycle
0 unaudited
PB Status
4 PBs
PB 4.1 — Security Engineering & OrchestrationCO-00691%
PB 4.2 — DevSecOps & CI/CD SecurityCO-016100%
PB 4.3 — Resilience & Chaos EngineeringCO-01785%
PB 4.4 — AI Cybersecurity EnablementCO-02297%
Zero Trust Status
NIST SP 800-207
Proxy Coverage
99.1%
Internet-facing
Continuous Auth
100%
Okta enforced
Micro-Seg
94%
Segments active
Device Trust
97%
CS enrolled
Lateral Block
81%
Rules enforced
Encrypt Transit
100%
TLS active
Guardian — Engineering Actions
Live
Build blocked: occ-risk-platform — Critical SAST CWE-89 (SQL Injection) at line 247 — P1 issued
cycle:0847 · 45m ago
Autonomous patch: CVE-2025-1847 applied to 28 endpoints via CrowdStrike RTR
cycle:0847 · 1h ago
ZTA bypass blocked: BPD-LEGACY-02 — zScaler rule auto-enforced + P1 created
cycle:0847 · 1h 12m ago
Bedrock plan: CVE-2025-2291 (CVSS 9.8) — SSVC-grounded with ATT&CK mapping in ticket
cycle:0847 · 2h ago
SBOM KEV: bfs-payments-api spring-boot-3.1.0 — out-of-band Qualys scan queued
cycle:0846 · 2h 15m ago
147 Bedrock decisions logged to WORM chain — 0 unaudited AI actions this cycle
cycle:0846 · 3h ago
Guardian Advisory — Group 4 · Engineering AI Active
Ready — select a briefing mode

Group 5 — Strategy, Performance & Workforce

CO SLA Enforcement · CDRL Delivery · Workforce Dev · Transition Execution · Tech Innovation

CO-009 · CO-011 · CO-021 · CO-023 — 4 Performance Baselines · 23 COs · 142 CDRLs
SHS Score
89
CO SLA Rate
—
23 COs tracked
1 CO at 81%
CDRLs On-Time
—
Deliverables submitted
2 due this week
NICE Coverage
—
27 FTEs role-mapped
All assigned
Certs Expiring
—
Within 30 days
Reminders sent
PB Status
4 PBs
PB 5.1 — Workforce Dev & Strategic PlanningCO-009100%
PB 5.2 — Program Performance IntegrationCO-01199%
PB 5.3 — Transition Planning & ExecutionCO-02187%
PB 5.4 — Tech Innovation & Special ProjectsCO-02392%
Phase 2 Transition Milestones
CO-021
Phase 1 ATO Package Delivery
Completed 2026-01-15 · CISO approved
Done
Guardian Integration (Non-HVA)
Completed 2026-02-28 · CO approved
Done
Runbook Transfer — IRS / BFS
Due 2026-04-30 · 14 days remaining
Active
Follow-on Team Onboarding
Planned 2026-06-01
Planned
Full RTO Validation Handoff
Planned 2026-07-15
Planned
Guardian — Strategy Actions
Live
CO-010 at 81% elapsed — warning sent to IR Lead; escalation at 90%
cycle:0847 · now
CDRL-006 author reminder: 7 days until due — Ops Lead notified
cycle:0847 · 2m ago
4 certifications within 30-day expiry — reminder tasks auto-created per bureau HR
cycle:0847 · 4m ago
NICE verified: 27/27 FTEs with current role codes — no gaps this cycle
cycle:0846 · 9m ago
EVM compiled: SV = -2.1% on CO-021 — within 10% threshold, PMO notified
cycle:0846 · 12m ago
Innovation project "ZTA-Mesh-PoC" stalled 11 days — CISO alert queued at day 14
cycle:0845 · 19m ago
Guardian Advisory — Group 5 · Strategy AI Active
Ready — select a briefing mode

Ticket Board — Open Remediation Items

All CRIT / HIGH / MED findings across Groups 1–5 · Guardian auto-creates · ISSO assigns · SLA tracked

ServiceNow Integration · SLA: P1=3d · P2=7d · P3=30d
Open Tickets
27
P1 Critical
—
Due within 72 hours
2 past SLA
P2 High
—
Due within 7 days
3 approaching
P3 Medium
—
Due within 30 days
All on track
Closed This Cycle
—
Remediated last 7 days
Guardian auto-patched 8
Open Tickets — All Groups
27 Open
ID Group Asset Finding Priority Assignee Created SLA Status

CI/CD Security Pipeline — DevSecOps Gates

SAST · DAST · SBOM · Container Scan · SCA gated on every commit · All bureaus

PB 4.2 · CO-016 · 100% pipelines gated · 0 ungated builds this cycle
Pipelines
100%
Pipelines Gated
—
All repos security-gated
0 ungated
Blocked Builds
—
occ-risk-platform SAST CRIT
P1 open
Clean Builds
—
Passed all gates today
8 bureau repos
SBOM Coverage
—
All builds produce SBOM
KEV-checked
Pipeline Gate Status — All Bureau Repos
G4 · PB 4.2
Repository Bureau SAST DAST SBOM/KEV Container Last Build Status

Reports — Generate & Export

Click any report to auto-generate a formatted compliance document from live portal data

PB 5.2 · CO-011 · 140/142 CDRLs on time · All Groups
CDRLs Due
2
CDRLs Submitted
—
On-time this period
2 due this week
Program SHS
—
Program-wide average
↑ +3 vs last cycle
FISMA Effective
—
Controls rated Effective
↑ +4% vs last month
Open POA&Ms
—
CRIT/HIGH with milestones
3 approaching SLA
FISMA Monthly Report
CyberScope-ready summary across all 8 bureaus — control effectiveness, POA&M status, SHS trend.
CO-001 · CO-002Monthly · CDRL-002
Not yet generated
ISCM / Continuous Monitoring
Asset scan coverage, connector health, vulnerability velocity, ISCM dashboard state per bureau.
CO-003 · CO-005Monthly · CDRL-006
Not yet generated
POA&M Status Export
All open Plans of Action & Milestones — SLA elapsed, ISSO assigned, bureau, remediation status.
CO-001 · CO-002Weekly
Not yet generated
Bureau Security Health Score
Per-bureau SHS breakdown with asset count, FISMA score, open tickets, and 3-cycle trend.
All GroupsWeekly
Not yet generated
CDRL Delivery Status
All 142 contract deliverables — submission status, due dates, author assignments, overdue flags.
CO-011 · PB 5.2Monthly · CDRL-035
Not yet generated
Guardian Cycle Activity
All autonomous actions this cycle — auto-tickets, RTR patches, PIV blocks, Bedrock AI decisions, WORM log.
All GroupsEvery Cycle
Not yet generated
Threat Intelligence Bulletin
IOC match summary, CISA KEV updates, Q2 TTP landscape, ATT&CK techniques observed, bureau exposure.
CO-012 · PB 3.4Monthly · CDRL-020
Not yet generated
ATO Coverage Report
Authorization status for all 47 systems — ISSO assignments, days to expiry, RMF step, POA&M counts.
CO-001 · PB 1.1Monthly
Not yet generated
Workforce & NICE Coverage
27-FTE roster with NICE codes, certification status, expiry alerts, training compliance, staffing gaps.
CO-009 · PB 5.1Monthly · CDRL-032
Not yet generated

T-SIP Guardian — Autonomous Security Orchestration

Auto-tickets · PIV enforcement · Asset scanning · SLA monitoring · AI remediation · WORM audit

Cycle: Active · Last run: <1 min ago · WORM chain: 147 decisions logged
Click to activate voice
Health
LIVE
Cycle Status
Active
All 8 connectors reporting
Running
Auto-Tickets Created
—
This month
0 manual gaps
Autonomous Patches
—
RTR-pushed this month
↓ MTTR from 28d to 11d
AI Decisions (Bedrock)
—
Plans generated this cycle
All WORM-logged
Connector Health — All 8 Vendors
8/8 Live
CrowdStrike Falcon
47,291 events this cycle · RTR active
● Live
Qualys VMDR
4,218 assets scanned · 7-day cadence
● Live
Orca Security
Cloud CSPM active · HVA overlay
● Live
Splunk SIEM
All bureaus forwarding · 0 silent sources
● Live
Palo Alto Prisma
FW policy active · IPS enforced
● Live
Zscaler ZIA
Proxy coverage 99.1% · 4 bypasses blocked
● Live
Okta Universal Directory
8 bureaus federated · OFR degraded
OFR
ServiceNow ITSM
Ticket API live · 27 open tickets synced
● Live
Guardian Automation Rules
All Rules Active
Auto-Ticket: Scan Gap > 7 days
P1 created, ISSO named, CISO chain
Active
Auto-Remediate: Non-HVA Patches
CrowdStrike RTR push within MTTR SLA
Active
PIV Bypass Detection
Okta event → P1 ticket + session block
Active
JIT Session Revocation
HVA sessions auto-revoked at 8hr cap
Active
CISA KEV Cross-Match
SBOM + Qualys matched every cycle
Active
CI/CD Gate Block
CRIT SAST/DAST findings block merge
Active
CO SLA Escalation Chain
Warning at 80%, Auto-escalate at 90%
Active
Bedrock AI Decision Logger
All AI plans WORM-chained + audited
Active
Guardian Full Activity Log
Live · All Groups
[G4] Build blocked: occ-risk-platform — CWE-89 SQL Injection, P1 auto-filed
cycle:0847 · G4 · 2m ago
[G2] PIV bypass: j.smith@irs.gov — P1 open, session blocked immediately
cycle:0847 · G2 · 3m ago
[G1] KEV match: log4j-2.17.1 in 3 SBOMs — Critical tickets auto-created
cycle:0847 · G1 · 5m ago
[G5] CO-010 at 81% elapsed — warning task queued, escalation at 90%
cycle:0847 · G5 · 7m ago
[G3] 145,290 IOCs processed — 0 new matches across 4,218 assets
cycle:0847 · G3 · 9m ago
[G4] Autonomous patch: CVE-2025-1847 deployed to 28 endpoints via RTR
cycle:0846 · G4 · 14m ago
[G4] Bedrock: 147 AI plans generated — all SSVC-grounded, ATT&CK mapped, WORM-logged
cycle:0846 · G4 · 18m ago
[G2] JIT auto-revoked: HVA:OFR-DATA — exceeded 8-hour session cap
cycle:0846 · G2 · 20m ago
[G2] HVA verified: 14/14 Tier 1 systems in Orca + CrowdStrike — no gaps
cycle:0846 · G2 · 21m ago
[G1] FISMA CyberScope compiled — all 8 bureaus contributing data, 30-day advance
cycle:0845 · G1 · 25m ago
[G4] SBOM KEV: bfs-payments-api spring-boot-3.1.0 — Qualys scan queued, P2 filed
cycle:0845 · G4 · 28m ago
[G5] NICE verified: 27/27 FTEs with current role codes — full coverage
cycle:0844 · G5 · 35m ago