Government and public sector
Public-sector extended support
When open source that your agency or contract depends on loses its community patches, someone still has to ship the fix. OSSeva ships patched, signed builds with an SBOM, VEX statements and a CVE record per release, which you can set against NIST SP 800-53, NIST SP 800-171 and CMMC. Delivery works on networks with no internet access.
Last reviewed
What the rules ask when a component loses support
These rules set no end-of-life date. They ask what happens when a component loses its vendor. CISA's Open Source Software Security Roadmap of 12 September 2023 lists reducing risks to federal agencies among its four goals. The table sets each rule next to what OSSeva supplies and what stays with you. Clause wording was read on 26 October 2026.
| Rule | What it asks | OSSeva evidence | What stays with you |
|---|---|---|---|
| SA-22NIST SP 800-53 Rev. 5, Unsupported System Components | Replace components when the developer, vendor or manufacturer no longer supports them, or provide options for alternative sources of continued support. | A patched build from an alternative source of support, with its CVE record, VEX statements and signature. | The decision to use an alternative source, and the replacement plan. |
| SI-2NIST SP 800-53 Rev. 5, Flaw Remediation | Identify, report and correct system flaws. Test updates before installation. Install security-relevant updates within an organization-defined period. Build remediation into configuration management. | CVE records and VEX statements to identify and report. A patched build within the patch window to correct: Critical CVEs within 48 hours, High within 7 days. | Testing, installing within your defined period and the configuration management record. |
| 3.14.1NIST SP 800-171 Rev. 2 and CMMC Level 2 | Identify, report and correct system flaws in a timely manner. 32 CFR 170.14(c)(3) makes the CMMC Level 2 requirements identical to NIST SP 800-171 Rev. 2. | The same CVE records, VEX statements and patched builds as for SI-2. | Scoping, your system security plan and the assessment with your assessor. |
| SI-02FedRAMP, Rev5 baselines | SI-02 applies to Rev5 Class B, C and D. FedRAMP points to its Vulnerability Detection and Response rules for timeframes; its SI-02 page lists none. | Dated CVE records and build identifiers that show when a fix shipped. | Your FedRAMP authorization and the remediation timeframes in FedRAMP's rules. |
OSSeva does not certify that you comply with any of these rules, does not act as an assessor and makes no FedRAMP authorization claim. The full clause-by-clause guide is FedRAMP, CMMC and end-of-life software; the wider set is in the compliance matrix.
What this covers
OSSeva covers the lines on the supported versions list: databases such as PostgreSQL, MySQL, MariaDB and MongoDB, messaging and streaming such as RabbitMQ and Kafka, and frameworks and servers such as Spring and Tomcat. The question is the same for each: has the community stopped patching the line you run, and who ships the fix. The end-of-life tracker gives the date for each line.
The patch window is the same on every technology: Critical CVEs within 48 hours and High within 7 days. Assure adds compliance documentation and 24/7 reactive support. Operate adds proactive monitoring and a 15-minute P1 response. OSSeva does not patch operating systems.
Delivery on disconnected networks
Builds are delivered to your internal Artifactory or Nexus instance, and production needs no outbound internet access. Each build carries a signature, a checksum, an SBOM and VEX statements, so the enclave can check it before it installs. The steps, the formats and the verification commands are on air-gapped delivery. A transfer cadence that is slower than your patch rule is the usual gap, and the page works through it.
How to buy
Buy directly from OSSeva. This site lists no contract vehicle, schedule or reseller arrangement, so none is claimed here. If your procurement office needs one, name it on the first call.
- 01
List the estate. Technologies, versions, instances and environments, including which ones sit on disconnected networks.
- 02
Check coverage. Compare the list with the supported versions page, or send it through the form.
- 03
Scope and quote. The quote follows the technologies and lines you run, how many clusters or instances carry them, and the tier: Patch, Assure or Operate. OSSeva publishes no price.
- 04
Review the paperwork. OSSeva's SOC 2 Type II report is available under NDA for vendor risk review. The procurement page covers contract and SLA questions.
Estates with many technologies are scoped as one portfolio; see enterprise extended support.
Not a fit for
- A contract that requires the supplier itself to hold a FedRAMP authorization, to sit on a named schedule or to come through a specific reseller. This page confirms none of these.
- Operating system, kernel or firmware patching. OSSeva does not patch them.
- A technology or version that is not on the supported versions list.
Can you sell through a reseller?
This site lists no reseller, distributor, schedule or contract vehicle, so this page cannot confirm one. If your agency or prime contractor buys through a specific vehicle, name it on the first call and OSSeva will say whether it applies.
Is OSSeva FedRAMP authorized?
No. OSSeva is not a cloud service provider and makes no FedRAMP authorization claim. OSSeva supplies patched builds, SBOMs, VEX statements and CVE records for open source you run. The authorization of your own system, and the decision on what evidence it accepts, stay with you and your authorizing official.
Does OSSeva make us compliant with NIST SP 800-53 or CMMC?
No. The evidence is OSSeva's record of what it patched, when and in which build. It maps to the three verbs in SI-2 and 3.14.1, identify, report and correct, and your assessor decides what it proves. CMMC Level 2 requirements are identical to NIST SP 800-171 Rev. 2, so the same evidence applies to both.
Can patched builds be delivered to a network with no internet access?
Yes. Artifacts are delivered to your internal Artifactory or Nexus instance, and production needs no outbound internet access. How a build crosses into the enclave follows your own transfer policy. The delivery page sets out the steps, the formats and the verification commands.
Get a quote
Bring the estate list.
We will say what is covered.
One conversation with an engineer who can read your inventory. An engineer replies within 1 business day.