search

opencontrol / discuss

a place to have conversations about OpenControl projects
https://github.com/opencontrol/discuss/issues
Other
16 stars 0 forks source link

Make a Federal Government ATO (Authority To Operate) Easier! #11

Closed bab262 closed 7 years ago

bab262 commented 7 years ago

A question for federal contractors performing digital services/IT Modernization work for the Government: The ATO process at the end of development is an inevitable hurdle to overcome for successful project completion. What could help the contractor or project team achieve a smoother ATO?

Do you see any benefit in including the government contractor in the ATO process? Perhaps including NIST standards in RFQs? Or having them create the Compliance Masonry as part of a contract requirement?

I'm a GSA Contracting Officer hoping the better the process for the entire project team (contractor and Government). Thank you!

NoahKunin commented 7 years ago

Hi @bab262! Not a contractor, I'm with 18F/GSA. We lots of initiatives on this already. Hopefully you follow the 18F blog so you can get all the new updates we'll be rolling out soon. https://18f.gsa.gov/blog/

To your specific questions:

What could help the contractor or project team achieve a smoother ATO?

The first and most important stuff is to not start the ATO at the end! Work on it incrementally through the whole process. We know that's very hard, and most govt agencies won't accept it. We're working on that, and you can forward them to 18F in the meantime for consultation on iterative security practices.

Do you see any benefit in including the government contractor in the ATO process?

Yes! They're already involved, at least everywhere I've been. I'd be surprised if they weren't.

Perhaps including NIST standards in RFQs?

They are in all RFQs and RFPs! If they're not, the Govt. CO has made a mistake IMHO... :(

Or having them create the Compliance Masonry as part of a contract requirement?

As one of the founders of Compliance Masonry, yes! This would be huge. As soon as we get it to 1.0 hopefully in the next 3-6 months, we should absolutely work on this.

bab262 commented 7 years ago

Thanks Noah.

I've done a few searches on compliance masonry, but can you provide a description of it in layman's terms? I'd like to take it back to my team (also Contracting Officers) and explain to them.

mogul commented 7 years ago

Hi @bab262, did your search turn up the 18F blog post about Compliance Masonry?

bab262 commented 7 years ago

It did not. After reading the post I get the sense that Compliance Masonry (CM) deals with the ongoing maintenance of security controls for a system. If so, I see the benefit of including CM in RFQ's to address ongoing security... but how would CM affect the ATO process?