W81K100-26-Q-A085 - Attachment C2 - RMF Assessment Timeframes (1).pdf

This is Exhibit 1 of a federal contract solicitation establishing RMF (Risk Management Framework) Assessment Timeframes for both vendor and government deliverables.

The document specifies two sets of timeframes. For Required Vendor Timeframes, the vendor must contact the Government POC within 10 business days post-award and submit Hardware/Software/Architecture Documents within 15 business days post-award (with a final deadline of 20 business days post-award). RMF Documentation Production is due 6 weeks post-award, Technical Nessus Scans within 1 month post-award (final deadline 6 months post-award), Technical STIG Checklists within 1 month post-award (final deadline 6 months post-award), and Technical SCAP within 1 month post-award (final deadline 6 months post-award). For Required Government Timeframes, the Government must schedule a Kickoff Meeting within 15 business days post-award, generate a Security Assessment Plan within 20 business days post-award (final deadline 30 days post-award), send RMF Templates to the Vendor within 5 business days of initial vendor contact, provide Copies of Applicable STIGs within 17 business days post-award (final deadline 30 days post-award), submit ATO-C recommendations with 3rd party validator review 2 weeks after final documentation/technical scans received, and schedule Independent Verification and Validation (IV&V) with 3rd party validator within 3 weeks after final documentation/technical scans received.