W81K00-21-Q-0001_Exhibit 1_RMF Timelines.pdf
PDF 12 KB Posted
- Solicitation number
- W81K00-21-Q-0001
- Issued by
-
Department of the Army Medical Command
About this file
This document outlines required timeframes for a Risk Management Framework compliance project. It specifies initial and final due dates for the vendor and government to complete key actions including producing documentation, conducting technical scans, and scheduling independent verification and validation. The vendor must contact the government point of contact within 10 business days of award and submit initial hardware, software, and architecture documents within 15 business days. Final documentation and scans are due from both parties within four to six months of award. Upon completion, the government will recommend an Authorization to Operate with Conditions and schedule third-party validation within two to three weeks.
View the file
Other files
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
EXHIBIT 1
RMF Assessment Timeframes
Required Vendor Timeframes: The Government shall complete its required actions within the following referenced timeframes but no later than one year after order/contract issuance. If the vendor has completed all required actions in a timely manner and acceptable manner while the Government experiences delays, the vendor would be given additional time for future actions corresponding to the amount of Government delay.
Vendor Requirements: Initial Draft Date Due Final Date Due
Vendor to contact Gov POC:
dha.detrick.med-log.mbx.cyberlog@mail.mil
10 business days post award
Hardware/Software/Architecture Documents 15 business days post award
20 business days post
RMF Documentation Production
6 weeks post award
4 months post
Technical Nessus Scans
1 month post award
6 months post
Technical STIG Checklists
Technical SCAP
Required Vendor Timeframes: The Government shall complete its required actions within the following referenced timeframes but no later than one year after order/contract issuance. If the vendor has completed all required actions in a timely manner and acceptable manner while the Government experiences delays, the vendor would be given additional time for future actions corresponding to the amount of Government delay.
Government Requirements Initial Draft Date Due Final Date Due
Kickoff Meeting 15 business days post award -
Security Assessment Plan Generation 20 business days post award 30 days post award
RMF Templates sent to Vendor 5 business days post vendor initial contact
Copies of Applicable STIGs sent to Vendor 17 business days post award
30 days post award
Authorization to Operate with Conditions (ATO-C) Recommendation
ATO-C recommendation submitted to
3rd party validator 2 weeks after final documentation/technical scans received
Independent Verification and Validation (IV&V) Scheduling
Scheduling request to 3rd party validator 3 weeks after final documentation/technical scans received
File details come from the government source that posted it. Updated .