High-friction authorization
Security evidence and approval steps often arrived late or required repeated manual coordination.
ā€” CASE STUDY
Creating a reusable DevSecOps path to faster federal delivery
theta. integrated automated testing, deployment, observability, and security controls into batCAVE’s platform delivery path. The work gave product teams a repeatable way to move software toward authorization and production while inheriting established controls and strengthening software-supply-chain visibility.
customer
Centers for Medicare & Medicaid Services (CMS)
Contract Role
Subcontractor
Mission
Secure federal software delivery
Delivery Focus
DevSecOps integration, platform automation, and continuous authorization readiness
Capabilities
Build & Integrate | Secure, Test & Release | Enable & Transfer
Mission Context
CMS’s Information Security and Privacy Group was creating batCAVE as a platform-as-a-service environment for secure software delivery. Product teams needed a consistent route from code to authorized cloud deployment, with automated testing, inherited controls, observability, and supply-chain protection built into the path. theta. integrated the platform components and delivery practices that made that route repeatable.
Why it mattered
Federal teams often lose time rebuilding pipelines, documenting the same controls, and resolving security requirements late in delivery.
Federal teams often lose time rebuilding pipelines, documenting the same controls, and resolving security requirements late in delivery. A shared platform can reduce that friction only when its controls, tooling, and operating guidance work together as a usable product.
The Challenge
Make secure delivery repeatable, not project-specific
Reusable control inheritance
Product teams needed a dependable way to inherit established controls without treating every deployment as a new platform.
Software-supply-chain risk
The delivery path required visibility across build, test, deployment, runtime, and dependency activity.
How theta. Delivered
A usable platform path from code to production
Integrated the delivery pipeline
theta. connected GitLab runners, Argo CD, containers, Kubernetes, and Amazon EKS into a repeatable DevSecOps workflow.
Codified platform deployment
theta. used Helm and infrastructure-as-code practices to make environments more consistent and reproducible.
Built in observability and protection
theta. integrated Grafana, Loki, Prometheus, Istio, and Falco to improve runtime visibility and security monitoring.
Advanced continuous-ATO readiness
theta. researched and implemented automation patterns that brought testing, control evidence, and authorization activities closer to everyday delivery.
Outcomes
Security controls became part of everyday delivery
theta. turned a collection of platform tools and controls into a clearer, reusable path for secure federal software delivery.
More automated authorization readiness
Testing and evidence activities moved closer to the delivery pipeline, reducing avoidable late-stage friction.
Reusable inherited controls
Product teams gained a clearer way to build on controls already established within the platform environment.
Stronger delivery visibility
Integrated observability and security tooling improved insight across deployment and runtime operations.
Built for What Comes Next
A reusable foundation for secure product teams
The platform patterns give CMS product teams a foundation they can reuse, extend, and govern as secure delivery practices and authorization expectations continue to evolve.
Technical environment
Technology and delivery practices
YAML, Python, Shell, GitHub, GitLab, Grafana, Loki, Prometheus, AWS, Docker, Kubernetes, Amazon EKS, Istio, Falco, GitLab Runners, Argo CD, Helm, Linux, and Windows Server
Have a complex mission to turn into a usable digital product?
Let us start with the policy, people, systems, and operating realities that shape the work.
Related work
Related case studies
CMS
Across MACPro, eAPD, and OneMAC, theta. delivered cloud migration, testing, and product development that replaced fragmented legacy workflows with more secure, standardized digital services. The work moved MACPro into CMS AWS GovCloud and advanced the phased transition to OneMAC.
VA
theta. expanded VA’s Rapid Ready for Decision approach to PACT Act claims, connecting claims workflows with existing health data so eligible cases could move forward with less manual retrieval and fewer avoidable exams. The work paired product strategy, prototyping, secure integration, and iterative delivery around the needs of Veterans and claims processors.
NHTSA
theta. redesigned how NHTSA researched, updated, and presented state traffic-safety laws, reducing a four-month digest cycle to six weeks. The new process also expanded coverage of emerging topics and introduced interactive maps that made legislative changes easier to compare and use.