FedRAMP_-_ATO_Automation_Tool.pdf

PDF 441 KB Posted Jul 11, 2017

Attached to: FedRAMP ATO Automation Tools
Solicitation number: Not on record
Issued by: GSA Technology Transformation Service

About this file

From the source

FedRAMP Automation Tool

View the file

On GovTribe

Work with this file

Download the original file
Contacts named in this file
Similar government files
Ask GovTribe AI about this file

Try for free Login

Text version

The file's text, extracted by GovTribe without its formatting.

ATO

AUTOMATION

TOOLS

RFI NUMBER: TTS_FEDRAMP_ATO

Response Due: July 25, 2017 by 5:00pm EST

PAGE | i

TABLE OF CONTENTS

1.	PROJECT	GOALS	...............................................................................................................	1
2.	BACKGROUND	.................................................................................................................	1
3.	RFI	INSTRUCTIONS	...........................................................................................................	2
4.	QUESTIONS	......................................................................................................................	2
5.	OUTPUT	...........................................................................................................................	3

PAGE | 1

1. PROJECT GOALS

GSA

has

been

working

with

the

Office

American

Innovation

(OAI)

and

American

Technology

Council

improve

the

process

achieve

Authority

Operate

(ATO)

alone

the

following

dimensions:

1. Reducing toil that inhibits our ability to scale improvements

2. Decreasing errors from manual activities

3. Increasing speed to process (approvals and identification of issues)

4. Increasing value-add of machine-readable data for improving risk management

One

key

component

this

effort

identifying

ways

incorporate

automation

into

the

ATO

process.

assist

agencies

and

industry

collectively,

GSA

would

have

better

understanding

the

existing

commercially

available

products,

and

practices,

that

the

government

could

use

automate

any

portion

the

ATO

process.

2. BACKGROUND

Federal

Agencies

are

required

grant

federal

information

system

Authority

Operate

(ATO)

before

first

becomes

operational.

granting

ATO,

the

Agency’s

Authorizing

Official

(AO)

accepts

the

risk

operations

assessed

system

and

officially

declares

that

authorized

operate.

Authorizations

involve

comprehensive

identification,

selection,

implementation,

testing,

and

evaluation

security

controls

information

systems.

addresses

software

and

hardware

security

safeguards;

considers

procedural,

physical,

and

personnel

security

measures;

and

establishes

the

extent

which

particular

design

(or

architecture),

configuration,

and

implementation

meets

specified

set

security

requirements

throughout

the

life

cycle

the

information

system.

also

considers

procedural,

physical,

and

personnel

security

measures

employed

enforce

information

security

policy.

order

improve

information

security,

strengthen

risk

management

processes,

and

encourage

reciprocity

among

federal

agencies,

NIST

developed

common

information

security

framework

for

the

federal

government

and

its

contractors.

The

framework

consists

six

steps

that

are

detailed

the

Guide

for

Applying

the

Risk

Management

Framework

Federal

Information

Systems:

Security

Life

Cycle

Approach

and

also

are

alignment

with

the

NIST

CyberFramework1:

Step 1: Categorize Information System

Step 2: Select Security Controls

Step 3: Implement Security Controls

Step 4: Assess Security Controls

Step 5: Authorize Information System

Step 6: Monitor Security Controls

PAGE | 2

The

risk

management

process

changed

the

traditional

focus

Authorization

and

Accreditation

(A&A)

static,

procedural

activity

dynamic

approach

that

provides

the

capability

effectively

manage

information

system-related

security

risks

highly

diverse

environments

complex

and

sophisticated

cyber

threats,

ever-increasing

system

vulnerabilities,

and

rapidly

changing

missions.

effort

continuously

improve

the

authorization

process,

the

government

now

looking

for

information

automating

the

authorization

process.

Ideally,

the

government

looking

for

tools

that

are

already

available,

rather

than

conceptual

tools,

that

could

used

automate

the

process,

and

support

federal

priorities

already

underway

the

Continuous

Diagnostics

and

Mitigation

(CDM)

well

Ongoing

Authorizations

priorities

managed

the

Department

Homeland

Security

(DHS).

Some

challenges

the

authorization

process

that

are

experienced

vendors

and

agencies

include:

complex

process,

time

consuming,

lots

documentation,

manual

processing,

etc.

Our

goals

for

automation

are

streamline

the

process,

reduce

the

timeframe

for

authorizing

information

system,

reduce

risk

human

error,

provide

real-time

data

understand

vulnerabilities,

and

mitigate

risk.

3. RFI INSTRUCTIONS

1. Entire response to the questions below should not exceed four (4) pages.

2. Each

response

may

also

include

one

additional

slick

sheet/product/marketing

materials,

which

itself

should

not

exceed

four

(4)

pages

(two

(2)

pages

front

and

back).

3. Submit response to info@fedramp.gov by 5:00pm on Thursday, July 25th.

4. QUESTIONS

1) What tools do you offer to government agencies that automate any or all of the security authorization process?

a) Please

describe

this

designed

for

on-premise

solutions

that

agencies

could

implement

current

legacy

environments

this

solution

designed

for

cloud

based

technologies,

and/or

both?

b) What

step(s)

(or

portion

step)

the

risk

management

framework

(NIST

800-37)

and/or

security

controls

(NIST

800-53)

does

this

automate?

c) Please describe the tool’s capabilities and the benefits that will be realized.

2) What

the

deployment

model

your

solution?

i.e.

multi-tenant

cloud

offering

on-

premise

solution?

3) Where and how have customers used these tools in the past for automation?

a) Please provide any POC’s that would be willing to talk with GSA related to their use of your tool.

4) Describe

your

tools

interoperability

with

other

tools

both

for

data

inputs

and

outputs,

well

competing

tools.

a) Please

describe

how

you

support

interoperability

and

integration

with

similar

tools

across

heterogeneous

environment,

i.e.

your

product

working

with

competitors

system.

5) How can agencies buy your service?

a) What contract vehicles is your offering available on?

PAGE | 3

b) How do you price your offering (e.g. by user, by system, etc.)?

6) What

questions

aren’t

asking

that

should

asking?

What

recommendations

you

have

for

consider

automating

the

ATO

process?

7) Would you be willing to provide a demonstration of capabilities? (Yes/No)

5. OUTPUT

The

information

gathered

through

this

RFI

will

help

feed

recommendations

the

OAI

how

automate

the

ATO

process,

whole

part.

the

short

term,

this

will

potentially

turned

into

white

paper

available

tools

and

techniques

that

agencies

could

use

when

undertaking

the

authorization

process.

the

long-term,

this

will

inform

changes

GSA

and

the

Federal

Government

could

make

order

encourage

interoperability

amongst

all

the

tools.

File details come from the government source that posted it. Updated Nov 14, 2017.