Research & guidance

White Papers

Practical, source-cited guidance for federal buyers and defense contractors: how DoD RMF authorization works for Navy programs, how to move from an SPRS score to CMMC Level 2, how to run continuous monitoring that keeps an ATO current, and how to write control implementation statements assessors accept. Each paper opens with a direct answer and lists its primary sources.

• 11 min read · Last reviewed October 2026

  Navigating the DoD RMF Authorization Lifecycle: A Practical Guide for Navy Programs

  A Navy system earns and keeps its authorization by working through the seven RMF steps in DoDI 8510.01 and NIST SP 800-37 Rev 2: Prepare, Categorize, Select, Implement, Assess, Authorize, and Monitor. Programs that fix the boundary early, document inheritance, keep evidence current, and engage the assessor before submission reach a decision with fewer review cycles.

  For: ISSOs, ISSMs, program managers, and system owners supporting Department of the Navy information systems

  7 primary sources · 7 FAQs

• 10 min read · Last reviewed October 2026

  From SPRS Score to CMMC Level 2: A Readiness Roadmap for Defense Contractors

  A defense contractor handling CUI moves from an SPRS score to CMMC Level 2 by implementing the 110 NIST SP 800-171 Rev 2 requirements, scoring them honestly with the DoD methodology, closing high-value gaps first, and preparing evidence for a self-assessment or C3PAO certification. A conditional status requires at least 88 of 110 points.

  For: Defense industrial base executives, compliance leads, IT managers, and contracting officers

  13 primary sources · 7 FAQs

• 9 min read · Last reviewed October 2026

  Continuous Monitoring That Survives the ATO: Building an ISCM Program Under NIST SP 800-137

  Continuous monitoring keeps an authorization valid after the ATO letter is signed. Under NIST SP 800-137, an ISCM program defines a strategy, sets a monitoring frequency for each control and metric based on risk, automates collection where possible, reports to the authorizing official, and responds to findings, giving the AO current evidence for ongoing authorization decisions.

  For: ISSMs, ISSOs, authorizing official staff, and program managers responsible for systems in operation

  8 primary sources · 6 FAQs

• 9 min read · Last reviewed October 2026

  Writing Control Implementation Statements Assessors Accept

  An implementation statement is accepted when an assessor can test it. Write each statement against the NIST SP 800-53A Rev 5 assessment objectives, fill every organization-defined parameter, name who performs the control, the mechanism or procedure, the frequency, and where evidence lives, and state exactly which parts are inherited, hybrid, or system-specific.

  For: ISSOs, ISSMs, security engineers, and authors of system security plans

  6 primary sources · 6 FAQs