Integrations · Existing RMF systems
Designed to coexist with the repository you are required to use.
Your program did not choose its authorization repository, and it cannot choose to stop using it. CertiField is built on that assumption rather than against it.
- eMASS — built integration
- Xacta — coexists
- OSCAL — machine-readable exchange
- Package export
- Ref
- I-41
- Kind
- Position
Two different jobs, often confused for one.
A system of record stores the authorization. An operational layer maintains it. Most programs have the first and improvise the second.
| Question | System of record | CertiField |
|---|---|---|
| Where does the authorization live? | Here | Not here — it exports to there |
| What does the assessment work happen in? | Usually spreadsheets beside it | Here |
| What happens when the architecture changes? | Somebody notices, eventually | The affected control scope is derived |
| Where does engineering evidence arrive? | Re-keyed by hand, if at all | Ingested from the pipeline that produced it |
| Who is required to use it? | You are | Nobody — which is why it has to earn the slot |
System reality
What engineering actually produces
- Architecture
- Inventory
- DISA STIGs
- Scan results
- SBOMs
- CI/CD pipelines
- Evidence
CertiField
The operational RMF layer
- Controls
- Evidence
- Assessments
- Determinations
- Findings
- POA&M
Authorization
What reviewers and systems receive
- SSP
- SAR
- POA&M
- Authorization package
- OSCAL
- eMASS
- Ref
- I-42
- Kind
- Exchange
- eMASS
- round-trip integration
- Others
- package + OSCAL export
How the data actually gets there.
eMASS
A built, round-trip integration. Import the baseline and POA&M; export control information, CCI test results, POA&M items and inventory, or the assembled package bundle, over mutual TLS.
The eMASS integration →Xacta and other required repositories
CertiField is designed to coexist with these rather than compete with them. Data reaches them through the authorization package export and through OSCAL, which is the format this problem has been waiting for. We will name a repository as a built integration when it is one, and not before.
Package and OSCAL export →Next step