ATO Tooling Overview

This table starts with the tools already implied by the dmwd.io stack, then adds open-source tools that close FedRAMP and ATO evidence gaps. Order is by category so adoption can happen one control area at a time.

Selection Rules

• Prefer open-source or self-hostable tools when they meet the control need.
• Keep GitHub Actions, Kubernetes, Helm, Argo CD, OpenTelemetry, and Prometheus as the spine because they are already in the preferred stack.
• Use tools that emit machine-readable evidence: SARIF, JSON, CycloneDX, SPDX, OSCAL, in-toto, or signed attestations.
• Treat commercial or hosted services as inherited or shared controls only when provider evidence exists.

Official Sources and OSCAL

Tool	Link	What It Does	How It Helps ATO	Evidence Output	Adoption
FedRAMP Rev 5 Templates	fedramp.gov templates	Official FedRAMP package templates and supporting documents.	Prevents drifting from required package structure.	Official Word, Excel, and PDF artifacts	Required
FedRAMP SSP Guidance	FedRAMP SSP documentation	Explains SSP expectations and package storytelling.	Helps turn technical controls into assessor-readable implementation statements.	SSP drafting guidance	Required
NIST OSCAL	pages.nist.gov/OSCAL	Machine-readable control, SSP, assessment, and results language.	Supports FedRAMP 20x direction and automated evidence validation.	OSCAL JSON, YAML, XML	Recommended
OSCAL CLI	github.com/usnistgov/oscal-cli	NIST command-line tool for OSCAL validation and transformation.	Validates OSCAL artifacts before package review.	Validation output	Recommended
Compliance Trestle	github.com/oscal-compass/compliance-trestle	Open-source OSCAL authoring, validation, and governance toolkit.	Helps manage SSP and component definitions as code.	OSCAL artifacts and generated markdown	Recommended
Lula	github.com/defenseunicorns/lula	Validates live systems against OSCAL component definitions.	Connects Kubernetes compliance intent to runtime evidence.	Validation reports	Optional

Identity and Access

Tool	Link	What It Does	How It Helps ATO	Evidence Output	Adoption
Keycloak	keycloak.org	Open-source identity and access management.	Supports OIDC, SAML, MFA patterns, and centralized access policy.	Realm export, policy export, audit logs	Candidate
Authentik	goauthentik.io	Open-source identity provider and SSO platform.	Supports SSO, MFA, application access, and identity evidence.	Configuration export, event logs	Candidate
Authelia	authelia.com	Open-source authentication and authorization gateway.	Useful for protecting internal apps and admin surfaces.	Configuration and access logs	Optional
WebAuthn	webauthn.guide	Standard for phishing-resistant public-key authentication.	Supports higher-assurance MFA for privileged users.	Enrollment and authenticator policy records	Recommended

Source Control, CI, and Change Control

Tool	Link	What It Does	How It Helps ATO	Evidence Output	Adoption
GitHub Actions	github.com/features/actions	CI/CD automation already in the preferred stack.	Produces build, test, scan, release, and approval evidence.	Workflow logs and artifacts	Existing
GitHub Branch Protection	GitHub branch protection docs	Enforces review, checks, and protected changes.	Supports separation of duties and configuration management.	Repository settings export	Existing
Argo CD	argo-cd.readthedocs.io	GitOps deployment controller already in the preferred stack.	Records deployed desired state and sync history.	Sync history and application status	Existing
Helm	helm.sh	Kubernetes packaging already in the preferred stack.	Makes deployed configuration reviewable and versioned.	Chart versions and values	Existing
OpenTofu	opentofu.org	Open-source infrastructure-as-code tool.	Provides reviewable, repeatable infrastructure changes.	Plans, applies, state metadata	Candidate

Secure Coding, SAST, and Secrets

Tool	Link	What It Does	How It Helps ATO	Evidence Output	Adoption
CodeQL	codeql.github.com	Semantic code analysis for vulnerability patterns.	Supports SA and SI controls for secure development and flaw detection.	SARIF	Recommended
Semgrep	semgrep.dev	Rule-based SAST for application code.	Adds language-specific security checks and custom policy rules.	SARIF or JSON	Recommended
gitleaks	github.com/gitleaks/gitleaks	Secret scanning for repositories and CI.	Helps prove secrets are not committed.	JSON, SARIF, or report output	Recommended
TruffleHog	github.com/trufflesecurity/trufflehog	Secret scanning with verification features.	Complements gitleaks for high-confidence secret detection.	JSON report	Optional
OWASP ZAP	zaproxy.org	Open-source DAST scanner.	Supports web application vulnerability scanning.	HTML, JSON, XML reports	Recommended

Dependency, SBOM, and Provenance

Tool	Link	What It Does	How It Helps ATO	Evidence Output	Adoption
Syft	github.com/anchore/syft	Generates SBOMs for images and filesystems.	Supports supply-chain inventory and incident response.	CycloneDX, SPDX, Syft JSON	Recommended
Grype	github.com/anchore/grype	Scans SBOMs, images, and filesystems for vulnerabilities.	Supports RA-5 and SI-2 vulnerability management.	JSON, table, CycloneDX-linked output	Recommended
Trivy	trivy.dev	Scans containers, filesystems, repositories, IaC, Kubernetes, and secrets.	Broad scanner for CI and Kubernetes evidence.	SARIF, JSON, table reports	Recommended
OSV-Scanner	google.github.io/osv-scanner	Scans dependencies against OSV database.	Adds dependency vulnerability coverage for open-source packages.	JSON and table reports	Recommended
cosign	docs.sigstore.dev/cosign	Signs and verifies container images and artifacts.	Supports trusted artifact and supply-chain controls.	Signatures and verification output	Recommended
SLSA GitHub Generator	github.com/slsa-framework/slsa-github-generator	Generates SLSA provenance for GitHub Actions builds.	Provides build provenance for supply-chain review.	in-toto provenance attestation	Recommended
OpenSSF Scorecard	github.com/ossf/scorecard	Scores repository supply-chain security practices.	Gives measurable supplier and repository posture signals.	JSON or SARIF	Optional

Containers, Kubernetes, and Infrastructure

Tool	Link	What It Does	How It Helps ATO	Evidence Output	Adoption
Kyverno	kyverno.io	Kubernetes-native policy engine.	Enforces admission controls and generates policy reports.	PolicyReport resources	Recommended
OPA Gatekeeper	open-policy-agent.github.io/gatekeeper	Kubernetes admission control using OPA policies.	Alternative for policy-as-code where Rego is preferred.	Constraint violations	Optional
kube-bench	github.com/aquasecurity/kube-bench	Checks Kubernetes against CIS Benchmark.	Provides cluster hardening evidence.	JSON and text reports	Recommended
Kubescape	kubescape.io	Kubernetes posture and risk scanning.	Adds cluster misconfiguration and framework scans.	JSON and reports	Optional
Checkov	checkov.io	IaC and configuration scanning.	Detects Terraform, Kubernetes, and cloud misconfigurations before deploy.	SARIF, JSON, CLI output	Recommended
Conftest	conftest.dev	Policy testing for structured configuration.	Tests Helm, Kubernetes, Terraform plans, and config files.	Test output	Optional
OpenSCAP	open-scap.org	Security compliance scanning against SCAP content.	Supports host baseline and vulnerability evidence.	HTML, XML, ARF reports	Recommended

Runtime Detection, Monitoring, and Audit

Tool	Link	What It Does	How It Helps ATO	Evidence Output	Adoption
OpenTelemetry	opentelemetry.io	Telemetry standard already in the preferred stack.	Correlates traces, metrics, and logs for monitoring evidence.	OTLP data and traces	Existing
Prometheus	prometheus.io	Metrics collection already in the preferred stack.	Supports availability, alerting, and ConMon dashboards.	Metrics and alert history	Existing
Grafana	grafana.com/oss/grafana	Open-source dashboards and visualization.	Shows control health, scan status, uptime, and alert history.	Dashboards and snapshots	Recommended
Loki	grafana.com/oss/loki	Open-source log aggregation.	Centralizes logs for AU and SI evidence.	Log queries and retention config	Recommended
Falco	falco.org	Runtime threat detection for Linux and Kubernetes.	Detects suspicious runtime behavior.	Alerts and rule results	Recommended
Wazuh	wazuh.com	Open-source security monitoring and SIEM-like platform.	Supports host monitoring, vulnerability, FIM, and alert evidence.	Alerts, dashboards, reports	Optional

Backup, Recovery, and Resilience

Tool	Link	What It Does	How It Helps ATO	Evidence Output	Adoption
Velero	velero.io	Kubernetes backup and restore.	Supports cluster recovery evidence and restore tests.	Backup and restore logs	Recommended
pgBackRest	pgbackrest.org	Postgres backup and restore tool.	Supports database backup, restore, and retention evidence.	Backup logs and restore results	Recommended
Litestream	litestream.io	SQLite replication and backup.	Useful if SQLite remains in approved production scope.	Replication and restore logs	Optional

Privacy, Data Inventory, and Retention

Tool	Link	What It Does	How It Helps ATO	Evidence Output	Adoption
OpenMetadata	open-metadata.org	Open-source metadata and data catalog.	Helps maintain data inventory and ownership.	Catalog exports	Optional
DataHub	datahubproject.io	Open-source data catalog and lineage platform.	Helps document data flows, lineage, and owners.	Metadata exports	Optional
PostgreSQL native auditing	PostgreSQL logging docs	Database logging and audit configuration.	Supports data access and administrative event evidence.	Database logs	Recommended

Adoption Priorities

Priority	Add First	Reason
1	Syft, Trivy, cosign, gitleaks, CodeQL	Fastest CI/CD evidence gain for SA, SI, SR, and RA.
2	Kyverno, kube-bench, Falco	Strong Kubernetes control enforcement and runtime evidence.
3	OSCAL CLI or Compliance Trestle	Moves package content toward machine-readable FedRAMP 20x direction.
4	ZAP, Semgrep, Checkov	Broadens application, IaC, and web security coverage.
5	Velero, pgBackRest, Loki, Grafana	Strengthens continuity, audit, and ConMon evidence.