Skip to main content
All Posts By

Lon Berman

Lon Berman
In Dr. RMF

Dear Dr. RMF

“Identity Crisis” writes: I am a contractor working on development of a system that is jointly owned by a DoD agency and a federal civil agency (Dept. of Treasury). My company is expected to do most of the “heavy lifting” to develop the RMF package for this system and we…
Read More
Lon Berman
In Dr. RMF

Dear Dr. RMF

“Overlay Layover” asks: I’m a little bit confused about how to find available security controls overlays. According to the RMF policy (DoD Instruction 8510.01) and the RMF Knowledge Service, approved overlays can be found on the CNSS.GOV website. Well, I keep looking there and all I see are the same…
Read More
Lon Berman
In Dr. RMF

Dear Dr. RMF

“In Search of Perfection” writes: One of my customers was told by their Security Control Assessor (SCA) that they could not get Authorization To Operate (ATO) unless their POA&M had zero open items; in other words, they are expected to be 100% compliant with all the controls in their baseline.…
Read More
Lon Berman
In Dr. RMF

Ask Dr. RMF

Dear Dr. RMF, We are having a dispute in our office about how to handle security control selection for a “non-National Security System” (non-NSS). We know DoD has mandated that System Categorization and Security Control Selection shall be done “in accordance with CNSSI 1253”. However, the CNSSI 1253 security control…
Read More
Lon Berman
In Dr. RMF, Risk Management Framework

Ask Dr. RMF

Dear Dr. RMF, RMF IA-4 Identification Management control is not easy.  It has so many rabbit holes.  I am not sure how to tackle this control.  Could you please simplify this control for me.  Let's say for IA-4 Identifier Management, the information system is a web application/web server.  For the…
Read More
Lon Berman
In Dr. RMF, emass

Ask Dr. RMF

Dear Dr. RMF, I can tell you I am definitely new to eMass. However, I have registered several packages and brought over artifacts. I have blindly (using the job aid) assigned controls, exported the spreadsheet and reimported. Haven't been able to produce the RAR or POAM.  With that being said,…
Read More
Lon Berman
In Dr. RMF, Risk Management Framework

Ask Dr. RMF

Dear Dr. RMF, I was wondering if you could guide me to the official "source" for all SOP's required for RMF. I have copies of SOP's I have done for another group but these were built off templates we were given from our ISSM at the time. I have combed…
Read More
Lon Berman
In Dr. RMF, Risk Management Framework

Ask Dr. RMF

Dear Dr. RMF, First of all, just stumbled across this blog few days ago....awesome! There is piles of documentation but not enough community sourced help for the RMF process. I tried starting an RMF sub-reddit but it never took off! I have so many questions! But one in particular that…
Read More
Lon Berman
In Dr. RMF, FEDRamp, Risk Management Framework

Ask Dr. RMF

Dear Dr. RMF, Government IT Security staff work with systems owners to make sure that all systems in the agency have implemented the proper Risk Management Framework (RMF) controls. Organizations have deployed technologies like eMASS, XACTA, and RSA to manage the workflow and documentation for the RMF for their systems.…
Read More
Close Menu