W81K100-26-Q-A080_ Attachment C2_ RMF Assessment Timeframes (1).pdf

EXHIBIT 1: RMF Assessment Timeframes

This document outlines the required vendor and government timeframes for completing actions related to a Risk Management Framework (RMF) assessment process. The timeframes establish deadlines for both vendor and government deliverables to ensure timely progression through the RMF assessment phases.

Vendor Requirements specify initial draft dates and final due dates for key deliverables. The vendor must contact the Government Point of Contact within 10 business days post-award, submit Hardware/Software/Architecture Documents within 15 business days with a final deadline of 20 business days post-award, and deliver RMF Documentation Production within 6 weeks post-award. Technical Nessus Scans, Technical STIG Checklists, and Technical SCAP assessments each have an initial deadline of 1 month post-award with a final deadline of 6 months post-award. Government Requirements include a Kickoff Meeting due 15 business days post-award, a Security Assessment Plan Generation due 20 business days post-award with final delivery in 30 days post-award, RMF Templates to be sent to the vendor within 5 business days of initial vendor contact, Applicable STIGs copies due 17 business days post-award with final delivery in 30 days, Authorization to Operate with Conditions (ATO-C) Recommendation submitted to a third-party validator 2 weeks after final documentation/technical scans are received, and Independent Verification and Validation (IV&V) Scheduling with the third-party validator within 3 weeks after final documentation/technical scans are received.