[02/01/22] Finalize and submit minor ATO for AVS - Githubissues

department-of-veterans-affairs / va.gov-team

Public resources for building on and in support of VA.gov. Visit complete Knowledge Hub:

https://depo-platform-documentation.scrollhelp.site/index.html

278 stars 194 forks source link

[02/01/22] Finalize and submit minor ATO for AVS #52495

Open lindsay-insco opened 1 year ago

lindsay-insco commented 1 year ago

Description

AVS is undergoing an assessment to receive a minor ATO in the VA. The entire VEText team is tasked with ensuring all scans, documents, and AVS itself are in compliance.

Acceptance Criteria

[x] Follow up with team conducting WASA scan to provide instructions on how to access the VEText dev environment in order to conduct scan. (If this cannot be completed, the team will proceed ahead with the pen. test only as per instructions)
[x] Review all ATO documents to ensure information is up-to-date
[x] Enter bigfix scans to eMASS
[ ] Submit final assessment

lindsay-insco commented 1 year ago

Uploaded ISCP, DRP, CMP, PTA, PIA to eMASS
Documents commented by @jwowk for improvement
WASA blocked due to lack of CCOW access - Rob to send direct link

lindsay-insco commented 1 year ago

Actions for week:

@lindsay-insco to reach out to Jason Barnard to ensure POA&Ms for DB scans and Fortify scan will carry over to AVS despite being labeled as for VEText
Phil to complete 50 unassessed controls
Phil to ensure inheritance is populated into AVS

lindsay-insco commented 1 year ago

All possible actionable items for ATO have been completed - updated SOPs, controls updated, etc. Final steps:

Formally assigning our VEText System Steward to AVS in order to submit package
Assess final 14 controls - pending approval of SS
Remediate 2 findings in WASA scan and resubmit - in progress by Rob