Gomes Security

Decision graph — controls · evidence · decisions ▲ Governance — objectives · sign-offs · deliverables ▼ Foundations — signals · engines · atomic data drag · orbit ✧ scroll · zoom ✧ click a decision to run it swipe sideways · orbit ✧ tap a decision to run it Rev 5 · High — the tier FedRAMP 20x hasn't reached yet.
The graph outlives the paperwork.
FedRAMP's 2026 rules are optional today for providers on the current baseline.
The vulnerability rules take effect December 7, 2026; the rest, January 1, 2027.

Sources & licensing ⓘ

Cited, never reproduced: IBM/Ponemon Cost of a Data Breach 2025 (Figs. 7, 9, 13–14, 39) & 2026 · Verizon DBIR · Mandiant M-Trends · CrowdStrike GTR · ITRC · CISA KEV · OMB FISMA report · MITRE ATT&CK ↔ NIST SP 800-53 mappings (Center for Threat-Informed Defense) · Picus Red Report 2026. Industry reports are free to read (registration) and appear here as attributed figures only — no charts or text reproduced. NIST, FedRAMP, CISA, and OMB materials are U.S. government works — public domain (17 U.S.C. §105). Full bibliography: sources.html.

Connections

What the color means a control nothing to report watch this slipping or firing past its clock overdue done and signed this run's receipt your provider covers it inheritedred ring this decision's blast reachred line shares a controlControl color — how often attackers go there:attackers go here a lotattackers go here sometimesnot ratedblue ring — your provider covers it

What the shape means Icosahedron — a control Octahedron — the evidence vault Cone — the decision ledger Box — vendor inheritance

Where it lives Top — the paper · Middle — the controls · Bottom — the data

Size and light Bigger — reaches more controls Brighter, labeled at rest — one of the ten

The ten — placement Placement — rank 01 in the middle, the rest in a ring around it Depth — rank order · number one sits deepest

Decision 16 / 16

What ATO does →

What's the call?

The platform never decides. On this page, you do.

Executed:

The rulebook — FedRAMP 2026

The full record →

What happened

What the platform knew

What the platform did

The money

What it costs →

If it happens — at the affected companies’ scale

The fix — sized for a small SaaS team · hours at $80/hour loaded

Late or lost ATO — a typical Moderate CSP, directional

Their numbers are at their scale. The fix numbers are at yours.

The decision

Predictive

What would your assessor find first? Ranked by cost, then by people affected

Your federal contract, per year

Stays in your browser. Nothing is sent.

Deterministic by Design

The math doesn't improvise.

The numbers here are computed, not generated: forecasts, rankings, dollar figures, propagation counts. Same inputs, same answer, every time.

AI drafts paperwork on this platform. It never makes a decision, computes a number, or approves a change. The checks that guard your record run with no AI in them at all — and a named person signs every change.

Agents can hallucinate. Math can't. And when the data can't support an answer, the platform says so — it abstains instead of guessing.

Two kinds of numbers live on this page: records and forecasts. Records are looked up — or marked “not assessed.” Never guessed. Forecasts are computed the same way every run, and always arrive as a range. We never dress one up as the other.

Built for what's next.

The math doesn't improvise.