Perspectives
The ISSO is a mission role, not a paperwork role
Programs that staff the ISSO seat as a documentation clerk pay for it at assessment time. A perspective on why that seat needs senior judgment.
· 4 min read
Six services, one outcome: an authorized, defensible system
Every engagement ends the same way: a system your authorizing official can sign for, and evidence that holds up at the next assessment.
RMF Assessment & Authorization
Categorization through authorization: SSP, SAR, POA&M and the full ATO package, built and managed in eMASS.
ISSO and ISSM support
DoD 8140-qualified security officers who run the day-to-day security posture of your system and answer to the mission.
NIST SP 800-171 and CMMC readiness
Gap assessment, System Security Plan, POA&M and SPRS score for contractors that handle Controlled Unclassified Information.
Continuous monitoring
ACAS/Nessus analysis, STIG review and POA&M burn-down that keep an ATO current between assessments.
Policy and documentation
Cybersecurity policies, procedures and plans written to the control, mapped to NIST SP 800-53, and ready for assessor review.
Role-based training
Security awareness and role-based training for system users, administrators and privileged staff.
Why programs choose Winston & Miller
Senior judgment on every task, and a structure built for federal set-asides.
Senior-led, every engagement
The founder bills on the work. You get 30 years of DoD information assurance judgment, not a junior team behind a senior name.
Two small-business set-aside paths
SDVOSB and WOSB certifications are in process with SBA, so one award can count toward both agency goals.
DoD 8140 aligned
CISM and CASP+ meet senior management and technical baselines; Security+ covers technical support roles; PMP keeps the schedule honest.
Cleared and close to the mission
Cleared leadership based minutes from Joint Base Andrews, Suitland, Camp Springs and Washington Navy Yard.
Proven inside the Navy's enterprise
The founder's record across Naval aviation, surface warfare and ordnance programs.
- 8+ years as Senior ISSO and Navy Qualified Validator for a Naval aviation research, development, test and evaluation enterprise: RMF A&A, eMASS administration, ACAS continuous monitoring and POA&M management across classified and unclassified networks, leading a team of 12.
- RMF subject matter expert supporting Authority to Operate processing for a Naval surface warfare center.
- IT/IA site and team lead for a Naval ordnance technical division, leading 14 IA and IT professionals through full Assessment & Authorization cycles.
Latest insights
Practitioner guidance on RMF, ATO, CMMC and the ISSO role. See all insights.
Articles
The DoD RMF process, step by step: what it takes to earn an ATO
The seven steps of the DoD Risk Management Framework, the eMASS artifacts each one produces, and the four places ATO packages most often stall.
· 7 min read
White papers
Keeping the ATO: an operating model for continuous monitoring
A white paper on continuous monitoring as an operating rhythm: scan cadence, STIG drift, POA&M burn-down, change control and ongoing authorization.
· 12 min read
Contracting data
Primary NAICS 541512. Product and service codes D310, D307, D399, R408 and R425. We accept the Government Purchase Card and EFT. UEI and CAGE registration is in process in SAM.gov.
541512541519541511541690541611611420
Frequently asked questions
- What does Winston & Miller do?
- Winston & Miller helps federal programs earn and keep their Authority to Operate. The firm delivers RMF Assessment & Authorization, ATO package development in eMASS, ISSO and ISSM support, NIST SP 800-171 and CMMC readiness, and continuous monitoring.
- Who leads Winston & Miller?
- Founder and CEO Jessica D. Miller, a U.S. Army veteran with 30 years in DoD information assurance, leads the firm and works on every engagement. She holds an active security clearance and the CISM, CASP+, GSLC, Security+ and PMP credentials.
- Is Winston & Miller a small business?
- Yes. Winston & Miller is a veteran-led, woman-owned small business. Its SDVOSB and WOSB certifications are in process with the U.S. Small Business Administration.
- What NAICS codes does Winston & Miller use?
- The primary NAICS code is 541512, Computer Systems Design Services. Secondary codes are 541519, 541511, 541690, 541611 and 611420.
- Where does Winston & Miller work?
- Winston & Miller is based in Washington, DC and Prince George's County, Maryland, and supports programs across the National Capital Region, including Joint Base Andrews, Suitland, Camp Springs, Washington Navy Yard and Patuxent River.
- How can primes team with Winston & Miller?
- Email jessica@winstonandmiller.com or call (240) 577-8855 to request a capability statement. Winston & Miller supports subcontracts, teaming agreements and direct awards.