Attachment_0096_RMF_One_Time_DID.docx

Attachment 0096 – Risk Management Framework (RMF) One Time DID Solicitation No.: W56HZV-22-R-0026

Attachment 0096 Risk Management Framework (RMF) One Time DID

Solicitation No.: W56HZV-22-R-0026 Date: 29 March 2022

Distribution Statement A: Approved for public release; distribution is unlimited.

DATA ITEM DESCRIPTION

Title: DOD RISK MANAGEMENT FRAMEWORK (RMF) PACKAGE DELIVERABLES

Applicable Forms: N/A

Use/relationship: The RMF Package Deliverable data will be used to satisfy the requirements of the RMF. This Data Item Description (DID) contains the format, content, and intended use information for the data product resulting from the work task described by the contract.

Requirements:

1. Reference documents. DoDI 8500.01, DoDI 8510.01, Trusted System Network per DoDI 5200.44, NIST 800-53r5 (Unclassified), DoD Cybersecurity Test and Evaluation Guidebook, version 2.0 change 1 (Unclassified).

2. Format. The RMF package artifacts shall be delivered in a format approved by the Government’s Authorizing Official (AO) or Information Systems Security Manager (ISSM).

3. Content. The content of the RMF package artifacts shall contain the necessary artifacts required by the AO or ISSM to successfully achieve and maintain Authority to Operate (ATO).

3.1 Introduction. This section shall contain a narrative of the RMF package deliverable content.

3.1.1 Interim Authority to Test (IATT) Request. The IATT Request shall document the ‘who’, ‘what’, ‘why’, ‘where’, ‘when’, and ‘how’ of the requested Test event. The IATT Request shall require additional documentation to assert RMF compliance, such as the RMF Implementation Plan, vulnerability scans, and STIG checklists. The IATT Request shall be delivered not less than 45 days prior to the start of the Operational Test Event to the Program Office.

3.1.2 ATO Request. The ATO Request shall use the approved AO or ISSM format. The ATO Request shall use identify the ‘who’, ‘what’, ‘why’, ‘where’, ‘when’, and ‘how’ of the requested authorization. The ATO Request shall include the System Security Implementation Plan (SSIP), artifacts asserting NIST 800-53 control compliance and any supporting artifacts which attest to that compliance. An ATO Request may be submitted in-lieu of an IATT Request.

3.1.3 System Security Implementation Plan (SSIP). The SSIP shall use the approved AO or ISSM format. The SSIP shall have a section for approval and signatures by the ISSM, Program Manager (PM), and AO.

3.1.4 RMF Implementation Plan (RIP). The RIP shall use the approved AO or ISSM format. The RIP shall document NIST 800-53 controls as ‘Compliant’, ‘Inherited’, ‘Non-Compliant’, or ‘Not Applicable’.

3.1.5 Assessment and Authorization (A&A) Project Plan. The A&A Project Plan shall be approved and signed by the ISSM and PM. The A&A Project Plan shall define the Tasks and Milestones needed to achieve and maintain IATT and/or ATO.

3.1.6 A&A Tasks and Milestones. The A&A Tasks and Milestones shall be a list of tasks, deliverables, events, and milestones with status, risk, and schedule for achieving the A&A Project Plan. The A&A Tasks and Milestones shall have a section for schedule which identifies each task, deliverable, event, and milestone as on schedule, complete, behind schedule, and any dependencies required to achieve the schedule.

3.1.7 Information Assurance Vulnerability Management (IAVM) Plan. The IAVM Plan shall be in the contractor’s format. The IAVM Plan shall be submitted in conjunction with the System Security Implementation Plan.

3.1.8 Collaboration Brief. The Collaboration Brief shall contain a summary of the System, RMF Package, and Residual Risk that is presented to the DAA, AO, Certification Authority (CA), or Security Control Assessor (SCA), Penetration Test Teams, and Cyber Tabletop Exercise during collaborative meetings. The Collaboration Brief shall use the approved ISSM’s format.

3.1.9 Plan of Action and Milestones (POA&M). The POA&M shall use the approved DAA, NAO, AO, or ISSM format.

3.1.10 Cyber Security Waiver Requests. Cyber Security Waiver Requests shall be IAW with the Request for Variance Form, DD Form 1694, from https://www.esd.whs.mil/Directives/forms/ .

3.1.11 Cyber Security Waiver Extension Request. Cyber Security Waiver Extension Requests shall be IAW with the Request for Variance Form, DD Form 1694, from https://www.esd.whs.mil/Directives/forms/

3.1.12 Key and Certificate Management Plan (KCMP). The KCMP shall be IAW DI-MISC-81688. The template is modified to include a section 3.7, titled Key Storage, which shall detail where each key and certificate is stored through its lifecycle with enumeration between private and public keys and certificates (This includes backups, production facilities, the fielded system and its subsystems, maintenance devices, and other devices which store and use keys and certificates). The template is modified to include a section 3.8, titled Compromise, which will describes what to do if keys become compromised or are suspected to be compromised. Table 2, in section 3.2, of the KCMP template may be changed to better enumerate multiple keys as long as all information from the table remains present. Section 3.4 shall also detail how the keys are generated.

image1.png