1. Defense Security Service’s Risk Managed Framework (RMF) Authorization & Assessment Process
Josh Thompson
Classified Information Systems – Western Region
Northrop Grumman

2. What is Risk Management Framework (RMF)
It is a unified information security framework for the entire federal government that replaces legacy Certification and Accreditation (C&A) Processes applied to information systems
RMF is a key component of an organization’s information security program used in the overall management of organizational risk

3. Why RMF

4. DSS A&A Process Flow

5. Primary Activities by Step
Step 1 – Categorize
Risk Assessment Report
SSP
System Identification
Key Roles & Responsibilities
System Environment
General Description Purpose
Interconnections
Applicable Appendixes
Must include at least a conceptual system/network diagram
Step 1
Similar to completing the ISFO SSP Template
High level overview to “register” the new system with DSS
Gives your ISSP a heads up that a new system is being initiated

6. Primary Activities by Step
Step 2 – Selection
Updated Risk Assessment Plan (if required)
SSP
Updated Step 1 Information (If required)
Control Selection
Overlays
Tailoring
Include Continuous Monitoring Strategy
Step 2
Initially a very short step
This step is used to tailor, which will be more beneficial in the future.
Need to better understand the controls and expectations before we can justify tailoring
Continuous monitoring strategy is already (tentatively) defined

7. Primary Activities by Step
Step 3 – Implementation
Updated Risk Assessment Plan (if required)
SSP
Updated Step 1 & 2 Information (If required)
Finalize System Description & Diagrams
Must include HW/SW Lists
Control Implementation Approach
Each implemented control must be described/documented
Systems
Controls Implemented on all systems
Step 3
This is where the real work begins
Rather than completing the IS Profile template, the contractor must now explain how we are meeting the control
Recommend relying heavily on the NIST- to-NISPOM Security Control Mapping document for guidance
Requires participation from ISSM/ISSO, FSO, System Administrators, Program Management, other stakeholders

8. NIST to NISPOM Mapping

9. Primary Activities by Step
Step 4 – Assess
ISSM Develops Security Assessment Plan
Primarily Based on the DSS Technical Assessment Guides
ISSM Performs Initial Assessment & Develops a POA&M
ISSM Provides Initial Assessment and POA&M to SCA
SCA Performs On-site validation
Step 4
SCAP is a big part of this step
Tip – Run SCAP on your systems prior to submitting your step 3 documentation to DSS.
Retain those results for DSS to review upon arrival
Create a POAM on your system prior to DSS’s arrival identifying all open findings
Your POAM may be classified based on your system’s SCG

10. Primary Activities by Step
Step 5 – Authorize
AO issues ATO
Step 6 – Monitor
ISSM Performs Continuing Monitoring Based On Continuous Monitoring Strategy
Step 5
Same as it’s always been
Step 6
Think weekly audits, AV updates, patching, and self-inspections
We’ve always done these things
Don’t get hung up on “ConMon”. Look at the requirement and think about how you’ve been doing this all along
Biggest change – You can’t forget about the system just because you have an ATO

11. ?