Anchore Federal by Anchore is designed to secure software factories within the US Department of Defense (DoD). It meets DoD DevSecOps requirements and applies zero-trust principles to applications, ensuring cyber readiness. Anchore Federal automates security checks to secure software for warfighters and leverages out-of-the-box policy packs for DoD standards. It is deployed in IL4 to IL6 environments and supports a continuous feed of new vulnerabilities in air-gapped or high side environments. Anchore Federal integrates with DevOps platforms like GitLab, GitHub, or Jenkins to enable a 'shift left' security posture and runs on any Kubernetes, including government clouds, on-prem OpenShift, or Rancher. It automates DoD and NIST security checks, enforces DoD standards with automated policy checks, and leverages policy packs for NIST, DoD, DISA, and FedRAMP to speed compliance. Anchore Federal provides proof of security posture with pass/fail reports of NIST, DoD, DISA, and FedRAMP checks, documents software contents with application-level SBOMs, and tracks changes in security posture and SBOMs over time. It achieves continuous ATO (cATO) by using automated security checks and policy enforcement to monitor and assess security controls per the Risk Management Framework (RMF). Anchore Federal generates, stores, and monitors SBOMs throughout the development lifecycle to ensure software supply chain security and uses a centralized SBOM database to triage the impact of zero-day vulnerabilities.
