Skip to main content

RMF Authorization Packages for Navy Commands

Winston & Miller delivers complete Risk Management Framework authorization packages to Navy commands and defense contractors. We manage every step — categorization through SAR — with eMASS-formatted deliverables that satisfy validator and authorizing authority requirements in the National Capital Region.

What We Deliver

System Security Plan (SSP)

NIST SP 800-53 Rev 5, structured implementation statements, control inheritance documented.

Security Assessment Report (SAR)

Test procedures per control, findings, assessor attestation.

Plan of Action & Milestones (POA&M)

eMASS-compatible fields, milestone scheduling, risk acceptance documentation.

eMASS Package Support

STIG findings imported, control crosswalk, package review and submission coordination.

Our Process

  1. System categorization and boundary definition

    Establish the authorization boundary, identify all components, and determine impact level per FIPS 199.

  2. Control selection and tailoring to baseline

    Select the applicable baseline and tailor controls per DoD overlays and command-specific requirements.

  3. Implementation documentation and narrative development

    Write implementation statements for each applicable control with supporting evidence references.

  4. Evidence collection and control testing

    Collect artifacts, screenshots, configuration outputs, and interview records to support assessment.

  5. SAR preparation and findings remediation

    Document assessment results, categorize findings by risk, and track remediation actions.

  6. POA&M development and eMASS package finalization

    Build the POA&M with milestone dates, import findings into eMASS, and prepare the authorization package.

Service Areas

We serve commands and defense contractors at NAS Patuxent River, NSWC Dahlgren, NSWC Carderock, the Washington Navy Yard, and organizations throughout the National Capital Region.

Related White Paper

Navigating the DoD RMF Authorization Lifecycle: A Practical Guide for Navy Programs

A Navy system earns and keeps its authorization by working through the seven RMF steps in DoDI 8510.01 and NIST SP 800-37 Rev 2: Prepare, Categorize, Select, Implement, Assess, Authorize, and Monitor. Programs that fix the boundary early, document inheritance, keep evidence current, and engage the assessor before submission reach a decision with fewer review cycles.

Frequently Asked Questions

How long does a Navy RMF authorization typically take?

Timeline depends on system complexity, existing documentation, and authorizing authority workload. Simple systems with mature documentation have reached ATO in under six months; complex multi-enclave programs may take twelve to eighteen months. Verified on current Navy A&A guidance.

Do you submit directly to eMASS?

We prepare eMASS-formatted documentation and coordinate submission with your ISSO or the command's eMASS point of contact. The information system owner or designated ISSO holds the eMASS account; we provide the package and submission support.

What baselines do you work with?

We primarily work with NIST SP 800-53 Rev 5 Low, Moderate, and High baselines as applied under DoD RMF. We also support legacy 800-53 Rev 4 systems in active continuous monitoring.

Can you support validator preparation?

Yes. We develop test procedures and pre-assessment evidence packages aligned to assessor expectations, and provide technical support during the Security Control Assessment.

Ready to Start Your Authorization Package?

Schedule a Project Scoping Call