Defense Security Service’s Risk Managed Framework (RMF) Authorization & Assessment Process Josh Thompson Classified Information Systems – Western Region Northrop Grumman

What is Risk Management Framework (RMF) It is a unified information security framework for the entire federal government that replaces legacy Certification and Accreditation (C&A) Processes applied to information systems RMF is a key component of an organization’s information security program used in the overall management of organizational risk

Why RMF

DSS A&A Process Flow

Primary Activities by Step Step 1 – Categorize Risk Assessment Report SSP System Identification Key Roles & Responsibilities System Environment General Description Purpose Interconnections Applicable Appendixes Must include at least a conceptual system/network diagram Step 1 Similar to completing the ISFO SSP Template High level overview to “register” the new system with DSS Gives your ISSP a heads up that a new system is being initiated

Primary Activities by Step Step 2 – Selection Updated Risk Assessment Plan (if required) SSP Updated Step 1 Information (If required) Control Selection Overlays Tailoring Include Continuous Monitoring Strategy Step 2 Initially a very short step This step is used to tailor, which will be more beneficial in the future. Need to better understand the controls and expectations before we can justify tailoring Continuous monitoring strategy is already (tentatively) defined

Primary Activities by Step Step 3 – Implementation Updated Risk Assessment Plan (if required) SSP Updated Step 1 & 2 Information (If required) Finalize System Description & Diagrams Must include HW/SW Lists Control Implementation Approach Each implemented control must be described/documented Systems Controls Implemented on all systems Step 3 This is where the real work begins Rather than completing the IS Profile template, the contractor must now explain how we are meeting the control Recommend relying heavily on the NIST- to-NISPOM Security Control Mapping document for guidance Requires participation from ISSM/ISSO, FSO, System Administrators, Program Management, other stakeholders

NIST to NISPOM Mapping

Primary Activities by Step Step 4 – Assess ISSM Develops Security Assessment Plan Primarily Based on the DSS Technical Assessment Guides ISSM Performs Initial Assessment & Develops a POA&M ISSM Provides Initial Assessment and POA&M to SCA SCA Performs On-site validation Step 4 SCAP is a big part of this step Tip – Run SCAP on your systems prior to submitting your step 3 documentation to DSS. Retain those results for DSS to review upon arrival Create a POAM on your system prior to DSS’s arrival identifying all open findings Your POAM may be classified based on your system’s SCG

Primary Activities by Step Step 5 – Authorize AO issues ATO Step 6 – Monitor ISSM Performs Continuing Monitoring Based On Continuous Monitoring Strategy Step 5 Same as it’s always been Step 6 Think weekly audits, AV updates, patching, and self-inspections We’ve always done these things Don’t get hung up on “ConMon”. Look at the requirement and think about how you’ve been doing this all along Biggest change – You can’t forget about the system just because you have an ATO

?