USACE ERDC NIST RMF Support Project Details

Work performed for the U.S. Army Corps of Engineers (USACE) Engineer Research and Development Center (ERDC) included NIST Risk Management Framework (RMF) security control assessment validation (SCA-V), evaluation, cybersecurity engineering, and compliance support for systems and enclaves ranging in size from 10 to 10,000 IT assets consisting of Windows 10, Windows 2008R2, 2012, Unix, Linux, network devices, databases, web servers, mail, active directory, firewalls, multi-function devices, or any IT capability that applies a DISA STIG or NIST 800-53 control as a security baseline. Tools utilized include Assured Compliance Assessment Solution (ACAS)/Nessus, DISA Security Compliance Checker (SCC), eMASS, and others. Assessments and tests of systems ranged from 1,700 to 3,000 compliance checks each. 

Our validators not only identified non-compliant documentation, configurations and security controls, but made recommendations to the customers on how to improve their overall security and how to be compliant with DISA security STIGs, NIST RMF, and other guidance. Additionally, Netizen provided pre-assessment cybersecurity engineering services as Information System Security Officers (ISSOs), Information System Security Engineers (ISSEs), and Information System Security Managers (ISSMs) for DoD customers to secure, certify and maintain their classified (up to and including TS/SCI) and unclassified networks and systems. In these roles our team members were embedded within each customer organization to provide daily guidance and advisory for cybersecurity and compliance support operations.

All work followed U.S. Army NETCOM procedures and our team was one of the most successful Security Control Assessment Validation (SCA-V) teams across the entire U.S. Army. It was recognized by the USACE ERDC Chief Information Office (CIO) as such. Netizen also developed custom tools to support work on this effort, including the open source "AutoSTIG" validator tool suite which reduced compliance checking time on certain systems from several hours to mere minutes with an eMASS-compatible report.