W81K100-25-Q-A019_ Exhibit 1_ RMF Assessment Timeframes.pdf

Exhibit 1 is a timeframes document detailing RMF (Risk Management Framework) Assessment requirements and deadlines for both vendor and government actions following contract award. The document contains two tables with specific timelines for submission of various technical documents and assessments, including initial and final due dates for items such as Hardware/Software/Architecture Documents, Technical Nessus Scans, Technical STIG Checklists, Security Assessment Plan Generation, and RMF Templates.

Key timeframe highlights include: Vendor requirements like contacting the Government Point of Contact within 10 business days post-award, submitting Hardware/Software Documents within 15 business days post-award, and completing RMF Documentation Production within 6 weeks post-award. Government requirements include hosting a Kickoff Meeting, generating a Security Assessment Plan within 20 business days post-award, and coordinating Authorization to Operate (ATO-C) recommendations. The document emphasizes timely completion of technical documentation and assessments, with provisions for potential time extensions if the Government experiences delays.