What Is Bedrock RMF?

An introduction to Bedrock RMF — open-source, self-hosted NIST SP 800-53 Rev 5 compliance management for ATO packages, built as an eMASS / Xacta alternative.

Bedrock RMF is a web application for running the Risk Management Framework (RMF) on real systems: the control implementations, plans of action, evidence, inventories and checklists that make up an Authorization to Operate (ATO) package. It is the tool Foxx Cyber uses for its own authorizations, and it is open source under the GNU AGPL v3 — free to run, inspect and modify, on hardware you control.

Who it's for

Bedrock RMF is built for the people who actually carry an ATO: ISSMs, ISSOs and ISSEs on defense and federal programs, assessors who need to see the evidence behind a control, and the small security teams at contractors and integrators who are handed an SCTM and a deadline. It assumes NIST SP 800-53 Rev 5, DISA STIGs and CCIs, and CNSSI 1253-style baselines and overlays, because that is the world its users live in.

It is also built for environments where a hosted SaaS is not an option. An RMF package routinely contains Controlled Unclassified Information — boundary diagrams, host inventories, findings. Bedrock RMF runs as one container stack on your own server, on a lab network or behind your own VPN, and never needs to call home.

What it does

Everything is scoped to an ATO package (a system boundary) and tracked with a full audit trail:

• Control implementations to the CCI — the full NIST SP 800-53 Rev 5 catalog (1,190 controls, with their 3,298 CCI mappings) is seeded on first boot; the complete DISA CCI list (5,137 CCIs) can be loaded from a source checkout with npm run db:seed:cci. Select a baseline and overlays, then write and track implementation statements per control and per CCI in the SCTM.
• POA&Ms with milestones — plans of action with severity, scheduled completion, milestones and status, per package and rolled up across the workspace.
• Evidence and artifacts — upload evidence straight from the browser to S3-compatible storage (MinIO on-box, or AWS S3), link it to controls, and keep the chain of custody in the audit log.
• Hardware and software inventory — assets with identity, role and software, deduplicated across STIG imports.
• PPSM — ports, protocols and services registrations per package.
• STIG Center — import .cklb / .ckl checklists, see posture per host and per benchmark, route open findings into POA&Ms, and see STIG evidence reflected in the SCTM down to the CCI.
• Cloud service inheritance — a catalog of cloud services with control mappings, so inherited controls are recorded as inherited rather than re-implemented.
• Boundary diagrams and the documentation matrix — the diagrams and documents an assessor expects, attached to the package.
• Code Security — track GitLab projects, import SAST and Trivy reports, triage findings with permanent dispositions, and report per project.
• Roles and teams — Admin, ISSM, ISSO, ISSE, Auditor and User roles enforced server-side, with an editable permission matrix and team-scoped package access. Email/password sign-in with TOTP two-factor.
• API keys — a /api/v1 API so agents and scripts can read and start control work the UI already exposes.

How it ships

Bedrock RMF is a Docker / Podman Compose stack: the application, a PostgreSQL 18 database and a MinIO object store, plus a one-shot bootstrap that applies migrations, seeds the NIST and CCI catalogs, generates the authentication secret and creates the first admin. docker compose up -d is the whole install — see the Deployment Quickstart.

Every release is a container image built and scanned by CI (Trivy filesystem and image gates, GitLab SAST) and published to a public registry; a version tag is only ever applied to an image that passed those gates.

Licensing & source

Bedrock RMF is licensed under the GNU AGPL v3.0 or later. The source, issues and merge requests live at https://gitlab.com/foxxcyber-oss/bedrock-rmf. If you run a modified version as a network service, the AGPL requires you to offer that source to its users.