by Kathy Denton & Tom Skoff
On the programs Electrosoft supports, eight or more teams contribute to a typical Risk Management Framework (RMF) Assessment and Authorization (A&A) package. They include the Program Management Office (PMO), Security Engineering, Vulnerability Management, and others. Each team works to reduce cybersecurity risk through continuous assessment and vulnerability identification, mitigation, and remediation.
The RMF sets the steps. Here is how Electrosoft carries them out, from categorization to continuous monitoring.
Categorize the System
Prior to A&A package submission, the RMF calls for the system to be categorized based on the information it analyzes, stores, and relays. At Electrosoft, the information system owner, information owner, Information System Security Manager, and PMO work together to complete this step. Together, they also assess the impact that any loss of confidentiality, integrity, and availability would have on organizational operations and assets.
Prior to Assessment and Authorization, the Risk Management Framework calls for the system to be categorized based on the information it analyzes, stores, and relays.
Submit and Triage
Under the RMF, controls must be fully tested and documented, and all identified vulnerabilities documented, before the program submits the A&A package for approval. If discrepancies are identified in the triage process, we document them in a Package Return Report sent to the PMO.
If no discrepancies are identified, or the PMO corrects identified discrepancies, our Security Controls Assessor Representative (SCAR) proceeds with package review and drafts an Authorizing Official (AO) worksheet and summary that are sent to the government Security Controls Assessor (SCA) team.
Assess the Risk and Authorize
As the RMF prescribes, the SCA team conducts a risk assessment using the SCAR summary and review of system vulnerabilities, and the Plan of Action and Milestones (POAMs). Then, the risk assessment and approval recommendation are sent to the AO to support an authorization decision.
The approval recommendation includes the authorization period length and any terms and conditions the program must meet to maintain authorization for the entire period. Higher-risk systems may receive shorter-term authorizations with terms and conditions that the program must fix or mitigate to reduce the amount of risk the AO accepts.
Higher-risk systems may receive shorter-term authorizations with terms and conditions that the program must fix or mitigate to reduce risk.
Monitor Continuously
Upon A&A package approval, the program conducts continuous monitoring, a core RMF requirement, to ensure that security controls are properly implemented throughout the authorization period.
Best Practice: Keep Your Package Out of the Return Queue
A returned package costs time. Completed documentation up front and early PMO review give a package its best shot at clearing triage the first time. Before submission, confirm that every tested control and every identified vulnerability is documented.