DoD 8140-Qualified ISSO and ISSM Support
Winston & Miller provides operational ISSO and ISSM support to Navy commands and defense contractors holding active authorizations. We manage monthly scan review cycles, STIG compliance tracking, and POA&M burn-down — keeping your authorization current through every patch cycle and assessment window.
Operational Support Activities
Monthly ACAS/Nessus Scan Review
Results review, finding categorization, CAT I/II/III triage, report to AO.
STIG Compliance Tracking
New STIG release review, checklist updates, CAT I remediation tracking.
POA&M Management
Item aging, milestone enforcement, risk acceptance documentation, eMASS updates.
Continuous Monitoring Reporting
Monthly/quarterly ConMon reports per command requirements.
Change Management Support
Authorization impact analysis for system changes, ECPs, and software updates.
Incident Response Coordination
Security incident documentation, SCAR/SAAR support.
Qualifications
Our ISSO and ISSM support personnel hold DoD 8140 IAM Level III qualifications where required by command, and Level II as a baseline. Credentials include CISM, CASP+, and GSLC. DoD 8140 defines the qualification requirements for each workforce role; we align staffing to the applicable role designation for your command and system classification.
Related White Paper
Writing Control Implementation Statements Assessors Accept
An implementation statement is accepted when an assessor can test it. Write each statement against the NIST SP 800-53A Rev 5 assessment objectives, fill every organization-defined parameter, name who performs the control, the mechanism or procedure, the frequency, and where evidence lives, and state exactly which parts are inherited, hybrid, or system-specific.
Frequently Asked Questions
What is the difference between an ISSO and an ISSM role?
The Information System Security Officer (ISSO) maintains day-to-day security posture for a specific information system. The Information System Security Manager (ISSM) provides program-level oversight across one or more systems and interfaces directly with the Authorizing Official. We support both roles, and the appropriate level is determined by command structure and system scope.
Do you provide on-site ISSO support?
We provide both on-site and remote support depending on command requirements and security constraints. Classified system support is coordinated per command policy.
What scan tools do you work with?
We work with ACAS (Assured Compliance Assessment Solution, powered by Nessus), STIG checklists in CKL and CKLB formats, and SCC scan results. Output review and finding disposition are performed against current DISA guidance.
How do you handle STIG updates between authorization cycles?
We track DISA STIG releases, assess delta between the current benchmark version and the system's checklist, and triage new findings by category. CAT I findings receive immediate disposition; CAT II and III are scheduled into the POA&M.
Sustain Your Authorization Between Assessment Cycles
Discuss Your Continuous Monitoring Needs