Risk Management Framework (RMF) Got You Down?

Our consultants can help you navigate RMF 101 with everything from digesting required ISSM training, getting established in eMASS, basic support with overlays, control implementation, and narratives to get you on the right track to obtain an Approval to Operate (ATO) for a classified computer system granted by DCSA. 

Our consultants support:

  • Selecting and augmenting the baseline security controls (security requirements)

  • Implementation of security controls and updating documentation, such as policies, operating procedures, “as built” documentation, and other “artifacts” in support of the RMF process

  • Evaluating compliance with security controls

  • Support the ISSM in ensuring system information is appropriately entered into the organization’s RMF support system (eMASS)

  • Assist in in developing the Authorization Package, including the System Security Plan (SSP) and Plan of Action & Milestones (POA&M)

*The decision to grant an ATO is based on an assessment of risk. This includes a comprehensive analysis of compliance technical and non-technical security controls defined by the overarching life cycle process called the Risk Management Framework (RMF). 

Additional information on RMF is detailed in the National Institute of Standard and Technology (NIST) Special Publication (SP) 800-37 and in DoD Instruction (DoDI) 8510.01. Security controls are published in NIST SP 800-53.

Gracefully navigate the RMF process today!