OCULUS SECURITY
Continuous Security

One system for every finding, decision, and report

Security findings arrive from everywhere — scanners, penetration tests, assessments, audits, incidents, vendor reviews, customer questionnaires, and engineering systems. Continuous Security turns that noise into a repeatable identify, evaluate, respond, and report cycle.

Start a Conversation
The cycle

Identify, evaluate, respond, and report

Identify

Bring findings and risk signals together from every relevant source.

Evaluate

Determine what matters in the context of the system, affected customers, and actual risk.

Respond

Assign ownership and track remediation, mitigation, exceptions, and supporting evidence.

Report

Keep leadership, auditors, customers, and agencies working from consistent human-readable and machine-readable information.

Federal specialization

FedRAMP ongoing security and authorization support

For cloud providers pursuing or maintaining a federal authorization, Oculus brings specialized experience across FedRAMP, FedRAMP 20x, DoD Cloud Impact Levels, and Intelligence Community authorization requirements.

Vulnerability Detection and Response (VDR) is the ongoing practice of finding security issues across your environment and acting on them — not just logging alerts, but routing them into ownership, remediation, and evidence your assessors can rely on.

Vulnerability Evaluation and Reporting (VER) is how those findings and responses are assessed, documented, and communicated — giving agencies, customers, and leadership a consistent picture of risk and status over time.

Coverage

One team for the whole federal landscape

Civilian, defense, and intelligence systems each have their own authorization path. We work fluently across all three.

Civilian Federal Agencies

FedRAMP

LowModerateHigh

Authorization to Operate for cloud services sold to federal civilian agencies, built on NIST SP 800-53 Rev 5 baselines and the agency authorization path, now modernizing through FedRAMP 20x.

Department of Defense

DoD Cloud (DISA Impact Levels)

IL2IL4IL5

DoD Provisional Authorization under the DoD Cloud Computing SRG: IL2 for non-critical public information, IL4 for Controlled Unclassified Information (CUI), and IL5 for higher-sensitivity CUI and unclassified National Security Systems.

Intelligence Community

ICD 503

A&AReciprocity

Assessment & Authorization and risk management for IC information systems under Intelligence Community Directive 503, structured to support reciprocity across IC elements.

The future of FedRAMP

FedRAMP 20x

FedRAMP 20x is the program’s ground-up reinvention of how cloud services earn and keep an authorization, trading document-heavy reviews for automated, continuously validated security. We help you get ahead of it.

Key Security Indicators (KSIs)

A focused set of machine-verifiable security outcomes that replace much of the manual narrative review with evidence the automation can check directly.

Automation-first validation

Security posture is validated programmatically against the KSIs, helping teams produce consistent, repeatable evidence for ongoing review.

Machine-readable evidence

Authorization artifacts shift from static documents to structured, machine-readable data that can be assessed and reused continuously.

Continuous validation

Rather than point-in-time snapshots, 20x emphasizes ongoing, near-real-time confidence in a service’s security state.

How 20x is rolling out

Phase 1
KSI Pilot

An initial cohort of cloud service providers piloted automated validation of all of FedRAMP’s Key Security Indicators.

Phase 2
Expanded Pilots & Authorizations

Selected participants advanced the model into real authorizations, refining the automated approach at scale.

2026+
Consolidated Rules

Consolidated rules, timelines, and guidance are shaping FedRAMP through 2028 as 20x moves toward broad adoption.

How Oculus gets you 20x-ready

Map your existing controls and evidence to the Key Security Indicators
Stand up automation and machine-readable evidence pipelines
Position legacy Rev 5 packages for the 20x transition
Build continuous validation into your engineering workflow