Attachment 2-RMF Assessment Timeframes.pdf

Exhibit 1 is a detailed RMF (Risk Management Framework) Assessment Timeframes document outlining specific timeframes for vendor and government actions following a contract award. The document is divided into two sections: Vendor Requirements and Government Requirements, each specifying initial draft and final due dates for various technical and administrative deliverables.

Vendor Requirements include tasks such as contacting the Government Point of Contact, producing Hardware/Software/Architecture Documents, RMF Documentation, Technical Nessus Scans, Technical STIG Checklists, and Technical SCAP. Government Requirements involve a kickoff meeting, Security Assessment Plan Generation, RMF Template distribution, providing copies of applicable STIGs, and Authorization to Operate (ATO-C) recommendation. The timeframes range from 5 business days to 6 months post-award, with most deliverables expected within 30 days. The document emphasizes that if the vendor completes all required actions in a timely manner, additional time will be granted for government-caused delays.