RMF Assessment Timeframes.pdf

Exhibit 1 is an RMF (Risk Management Framework) Assessment Timeframes document detailing required vendor and government actions and deadlines following contract award. The vendor timeframes include specific documentation submission requirements such as contacting the government point of contact within 10 business days post-award, providing Hardware/Software/Architecture Documents within 15 business days post-award, and completing RMF Documentation Production within 6 weeks to 6 months post-award.

The government requirements section outlines corresponding deadlines, including a kickoff meeting within 15 business days post-award, Security Assessment Plan Generation within 30 days post-award, and RMF Templates sent to the vendor within 5 business days of initial vendor contact. Additional critical milestones include sending applicable STIGs to the vendor, obtaining Authorization to Operate (ATO-C) recommendation, and scheduling Independent Verification and Validation (IV&V) with a third-party validator. The document emphasizes that if government delays occur, the vendor will be granted additional time for future actions proportional to the experienced delay.