Case Study
Expediting ATOs with Data-Driven Compliance Automation
Introduction
In compliance with the Federal Information Security Management Act (FISMA), federal agencies are required to implement security controls outlined in the National Institute of Standards and Technology (NIST) Special Publication 800-53.
One agency sought a more efficient approach to producing evidence of compliance, to expedite achievement and streamline maintenance of formal Authority To Operate (ATO) designated systems. As part of a broader services contract, the agency engaged Improvix to design an automation and data-driven approach to compliance management.
Mission Objectives
Implement continuous monitoring of selected technical controls from NIST SP 800-53 using available tool investments.
Produce near-real-time evidence of compliance using automated data feeds, distinguished by system boundary and individual asset.
Provide an action-oriented interface identifying compliance gaps and areas of concern to prioritize support impact.
Deliver compliance data in a format that integrates with existing governance, risk, and compliance (GRC) tools.
Improvix’s Solution
Improvix partnered with information system security officers (ISSOs) to design a consolidated solution that continuously collects security data from network, system, and application assets, then analyzes and presents compliance findings in accordance with selected technical controls. The interactive dashboard allows ISSOs to select a system boundary, then see control-level evidence organized by individual system asset. Granular data is exportable for use within GRC tools to expedite preparation activities.
Tools & Technologies
Measureable Mission Value
Benefits & Outcomes
security data sources analyzed through integrated continuous monitoring.
availability of data for selected technical controls from AC, AU, and SI families.
ATOs achieved and maintained with the support of data-driven compliance.
Let’s Get Started!
Achieve your mission objectives faster with our customer-centric approach.
