Software Development & Modernization
Designing, implementing, and refactoring complex government software — including high-visibility, congressionally mandated DoD programs. Application engineering and modernization, delivered the agile way.
Service-Disabled Veteran-Owned Small Business
Mission-grade
Palladium delivers software, security, and cloud for government, defense, education, and commerce.
Mission-grade
software, security &
cloud
Palladium delivers software, security, and cloud for government, defense, education, and commerce.
Palladium Innovations delivers digital transformation to local, state, and federal agencies — bridging the gap between small, mission-essential applications and the enterprise environments they operate in.
What we do
Comprehensive technology solutions, built to government standard.
From designing and modernizing complex government software to standing up secure cloud and carrying systems through the full RMF lifecycle.
Cybersecurity & Risk Management
Direct experience implementing DoD RMF in cloud at Information Protection Levels 2, 4, 5, and 6 (Secret) — supporting the full lifecycle from system categorization through continuous monitoring.
Cloud Computing
Deep experience building and supporting commercial cloud solutions, from single applications to complex, multi-tenant environments with integrated security components.
Site Reliability & Engineering
Site reliability and development engineering with practices modeled after DoDAF and TOGAF, including command-specific tailoring — so systems stay dependable as they scale.
Built in-house
Proven capabilities, ready to leverage.
Not slideware, and not someone else’s software — these are proprietary systems Palladium has designed, built, and owns, and brings to a client’s problem. Velsa and our OSCAL tooling are public and verifiable; the rest are private IP. Together they compose a single hardened platform.
ProductVelsa
A complete venue & event-management platform — bookings, contracts, operations, exhibitor management, and fund accounting — running live on the platform below.
EvidenceAudit Logging
A production-grade audit-and-logging capability that unifies CloudTrail, Config, GuardDuty, Security Hub, and VPC flow logs into NIST 800-53–mapped dashboards — continuous proof a system stays compliant. 19 CloudFormation stacks, deployed as code.
How it works
Security telemetry from across the AWS account — CloudTrail, Config, GuardDuty, Security Hub, Inspector, VPC flow logs and more — fans into SNS/SQS buffers, is normalized by Lambda collectors, and lands in a VPC-private OpenSearch cluster behind Cognito MFA. 65 pre-built searches and dashboards map every event to NIST 800-53 controls (AU, AC, and SI families), so producing audit evidence is a query — not a fire drill. The whole system is 19 parameterized CloudFormation stacks, KMS-encrypted end to end and deployed entirely as code.
DeliveryGoverned pipeline
A canary-gated, infrastructure-as-code delivery pipeline that validates and promotes every change before it reaches production — governance baked into the path to release.
How it works
Every change is built into an immutable, digest-pinned artifact, run through validation and security gates, deployed first to a canary, and only promoted to production once the canary clears its health checks — with automatic rollback if it doesn’t. The pipeline itself is infrastructure-as-code, so the path to release is governed, repeatable, and fully auditable.
HardeningThe Compliance Factory
Produces hardened containers and machine images that carry their own compliance evidence — the step most hardening skips — and is expanding toward machine-readable OSCAL output.
How it works
It takes a base image — a container or a machine image — and applies a hardened, benchmark-driven baseline (STIG / CIS). The difference: as it hardens, it emits machine-readable evidence for each control it enforces, packaged alongside the image so the proof travels with the artifact. That evidence is being shaped toward OSCAL. More on the thinking in our approach.
FoundationHardened AWS landing zone
A reusable, security-hardened AWS base — built once and recycled across engagements. It runs Velsa today and is ready to stand up for the next mission.
How it works
A multi-account AWS foundation defined entirely as CloudFormation — network segmentation, encryption everywhere, centralized logging, least-privilege IAM, and security guardrails baked in from the first stack. Because it’s parameterized infrastructure-as-code, the same hardened baseline stands up for a new product or client in hours, not months — which is exactly why it already runs Velsa.
Woven through all of it: open-source OSCAL tooling that turns FedRAMP’s CR26 rules and NIST 800-53 into validated, machine-readable compliance artifacts — the language the evidence above is headed toward. View on GitHub →
Our approach — The Compliance Factory
Hardened images that prove it.
Plenty of vendors will hand you a hardened container or machine image. Almost none hand you the evidence — the machine-readable proof that the hardening is real and stays in place. The Compliance Factory is Palladium’s framework for producing hardened images that carry their own evidence, turning compliance from an after-the-fact scramble into a rapid, proof-positive part of the build.
It’s the connective tissue behind the stack above: the images it hardens run on our reusable AWS foundation, the pipeline promotes them, Audit Logging proves they stay compliant, and the evidence is headed toward machine-readable OSCAL. The Palladium difference — we bridge small, mission-essential applications and the enterprise environments they live in, breaking complex work into understandable pieces so it ships even when integrations are hard and resources are limited.
Customer experience
Trusted on high-visibility federal programs.
Agencies served
- • Defense Human Resource Activity (DHRA)
- • Air Force Special Operations Command (AFSOC)
- • Air Education and Training Command (AETC)
Selected programs
- • Joint Special Operations Cloud Computing Environment (JOSCE)
- • Air Force Learning Management System / Joint Education Training System (AFLMS / JETS)
- • Applications supporting congressionally mandated DoD programs
At a glance
Ready to contract.
Certification
SDVOSB
UEI
VKYQK4L8BDT8
CAGE Code
9FH15
DUNS
11-886-9687
NAICS
518210
NAICS
513210
NAICS
541512 · 541519
NAICS
611420
Team certifications: CompTIA CASP+ · Certified Scrum Product Owner · AWS Solutions Architect – Associate · AWS DevOps Engineer – Professional. We accept credit and purchase cards.
Download capabilities statement ↓
Get in touch
Let’s talk about your mission.
Whether it’s a small mission-essential app or an enterprise modernization, we’d like to hear what you’re working on.
Email us →Erik Cass
Managing Member
Email erik@go-palladium.com
Phone 850-240-1615
Office 341 Angela Lane
Mary Esther, FL 32569
Mary Esther, FL 32569