What we have learned keeping authorization packages current.

Start with the four terms.

Most of what follows depends on these. They are precise where the market's vocabulary is not, and each one is a claim we are willing to be held to.

1. 01 What is RMF automation, and what is it actually automating? RMF automation means three distinct things — evidence ingest, impact derivation and artifact generation. Most tools do the first and third well and the second barely at all, which is why packages still go stale. 7 min read · RMF · Automation · ATO
2. 02 Best RMF automation software for DoD There is no single best RMF automation tool, because "RMF automation software" describes at least four distinct product categories — systems of record, operational RMF layers, configuration compliance tools and generic GRC platforms. Identifying which one your problem belongs to eliminates most of the market before you compare a single feature. 11 min read · RMF · Automation · Buying · DoD
3. 03 RMF automation tools, compared by category Comparing RMF tools vendor-by-vendor produces a grid where every product wins the rows describing its own job, because the products are not substitutes. Comparing categories first — system of record, operational layer, configuration compliance, generic GRC — narrows the market before any vendor conversation. 9 min read · RMF · Automation · Buying · eMASS
4. 04 NIST 800-53 compliance automation Roughly a third of an 800-53 baseline is mechanically verifiable, another third is verifiable only with evidence a human interprets, and the rest is organizational fact. Automating the first third well is worth more than automating all three badly. 10 min read · NIST 800-53 · Automation · RMF · CCI
5. 05 ATO software for defense contractors A contractor does the RMF work and does not own the decision, the repository or often the schedule. Tooling has to produce artifacts defensible inside a government process you do not control, survive personnel turnover, and prove the work was done when the contract is recompeted. 9 min read · ATO · Contractors · RMF · Buying
6. 06 RMF software for SBIR companies Do the unfunded parts first — boundary, categorization, architecture — because they cost nothing but decisions and everything downstream depends on them. Tooling helps after that, and helps most with the parts a small team cannot sustain manually. 9 min read · SBIR · RMF · ATO · Small business
7. 07 Automating SSP generation without losing the thread An SSP is worth automating only if it is generated from the authorization record rather than assembled beside it — otherwise generation is a one-time act and every subsequent change is a manual edit to a Word file. 8 min read · SSP · RMF · Automation · OSCAL
8. 08 OSCAL SSP generation Generating a valid OSCAL SSP is a serialisation problem and most tools can do it. The question worth asking is whether the OSCAL and the human-readable SSP are two renderings of one record, or two artifacts that can drift apart. 9 min read · OSCAL · SSP · RMF · Automation
9. 09 How to automate an ATO package Automate the record first and the assembly last. An authorization package is SSP plus SAR plus POA&M, and if those three are generated from one record they cannot contradict each other — which is the actual deliverable, not the ZIP file. 11 min read · ATO · RMF · Automation · SP 800-37
10. 10 Automating SAR generation from the assessment record A SAR should be generated from the assessment record, including which version of the system architecture each assessment was performed against — otherwise it describes the system as it is today rather than as it was when assessed. 6 min read · SAR · Assessment · RMF · Automation
11. 11 OSCAL SAR generation An OSCAL SAR is hard to produce not because the format is difficult but because it demands distinctions most assessment records never made — observation, finding and risk are three separate things, and a record that conflated them has nothing to serialize. 9 min read · OSCAL · SAR · Assessment · RMF
12. 12 Security control assessment automation Automate the preparation, not the determination. Evidence gathering, normalization, correlation and currency tracking are mechanical; deciding whether a control objective is satisfied is an authorization judgment with a person's name on it. 9 min read · Assessment · RMF · Automation · CCI
13. 13 CCI assessment automation A CCI is a single testable assertion derived from a control statement, and DoD assessment happens at that level rather than at the control level. Any system storing one status per control forces its nuance into a comment field, which is where reporting goes wrong. 8 min read · CCI · Assessment · RMF · STIG
14. 14 RMF assessment software Judge RMF assessment software on the second assessment, not the first. Prior determinations preserved, adjudicated false positives remembered, scope derived from what changed, and every result naming the system state it was performed against. 8 min read · Assessment · RMF · Buying · CCI
15. 15 Evidence reuse in RMF, and why most programs cannot do it Evidence reuse depends on two facts most programs never record — which controls an artifact supports, and whether it still describes the current system. Without them, every assessment cycle rebuilds evidence that never changed. 7 min read · Evidence · RMF · Assessment · Continuous monitoring
16. 16 RMF evidence management Evidence management is not storage. It is binding — recording which objectives and determinations each artifact supports, where it came from, when, and what was already decided about it, so its relevance is a fact rather than something a person remembers. 9 min read · Evidence · RMF · Assessment · Provenance
17. 17 Scan results to POA&M, without losing the thread Converting scan output into POA&M items is a formatting exercise. The valuable part is preserving lineage — item to finding to observation to the scan and date that produced it — and preserving the adjudication decisions so the same false positives are not re-judged every cycle. 9 min read · POA&M · ACAS · Nessus · Automation
18. 18 Maintaining an ATO after authorization Sustaining an ATO fails for a structural reason — authorization is resourced as a project and maintenance is not. The fix is to make the impact of a change derivable rather than something a person has to happen to notice. 7 min read · ATO · Continuous monitoring · RMF
19. 19 Continuous ATO software No software grants a continuous ATO. A cATO is an arrangement your AO agrees to, on the strength of demonstrated monitoring, a controlled pipeline and evidence that changes are assessed as they happen. Tooling makes that demonstrable — it does not make the decision. 9 min read · cATO · ATO · Continuous monitoring · RMF
20. 20 RMF continuous monitoring software Scan monitoring is the part everyone already does. The three that quietly erode an authorization are inventory drift, STIG applicability drift and evidence expiry — because each one changes what is true without producing an alert. 9 min read · Continuous monitoring · RMF · ATO · STIG
21. 21 Continuous monitoring vs continuous authorization Continuous monitoring is an evidence practice a program runs. Continuous authorization is a posture an AO grants on the strength of it. You can do the first without the second, and you cannot get the second without the first. 6 min read · Continuous monitoring · cATO · ATO · RMF
22. 22 eMASS integration software Judge an eMASS integration on the second submission. One-way export works once; what matters is whether POA&M items upsert on their eMASS external identifier, whether import brings an authorized system forward, and whether imported data stays labeled as imported. 8 min read · eMASS · Integration · POA&M · RMF
23. 23 How to import and export eMASS data Import as a reviewable session that a person accepts, never as a silent write. Export with POA&M items upserting on their eMASS external identifier. Keep imported data labeled as imported, and refuse any proposal whose target changed since it was prepared. 9 min read · eMASS · POA&M · Integration · RMF
24. 24 Xacta vs eMASS eMASS is the DoD government-owned system of record, provided rather than sold and mandated for most DoD systems. Xacta is a commercial compliance and authorization platform from Telos. They are frequently run together, because one is a submission target and the other is a place to work. 8 min read · eMASS · Xacta · RMF · Buying
25. 25 AI in RMF: what should and shouldn't be automated AI should read, rank, extract and draft. It should never make an authoritative RMF determination. The line is not about capability — it is about who is accountable for the claim. 8 min read · AI · RMF · Governance · Provenance
26. 26 STIG applicability without the guesswork STIG applicability should be ranked against the technologies a system actually runs, catalog updates should merge into existing checklists rather than replace them, and a dismissal should be a recorded decision with an author and a reason. 6 min read · STIG · DISA · Checklists · CMMC
27. 27 How DISA STIGs map to RMF controls A STIG rule maps to a CCI, and the CCI maps to a specific statement within an 800-53 control. The mapping is published rather than inferred, it is many-to-many, and a passing STIG rule is evidence about a control rather than a determination on it. 8 min read · STIG · CCI · DISA · RMF
28. 28 CKL vs CKLB CKL is the legacy XML checklist format produced by earlier STIG Viewer versions. CKLB is the newer JSON format introduced with STIG Viewer 3. Both carry per-rule status, finding details, comments and CCI references — and any tool handling DoD STIG work needs to read and write both, because programs have years of CKL history. 7 min read · STIG · CKL · CKLB · DISA
29. 29 STIG checklist management at scale At scale the problem is not producing checklists but maintaining them. Merging a new STIG revision without discarding prior review work, reusing dispositions across identical assets, and keeping applicability current are what determine whether a program's checklists stay honest. 9 min read · STIG · Checklists · DISA · Scale

Comparisons.

Category and fit rather than a feature scorecard — what each system is, when it is the right answer, and how it works alongside CertiField. Several of these are systems CertiField exports to rather than competes with, and the pages say so.

Topic guides.

Shorter pages answering the questions people arrive with, rather than the ones we would rather they asked.