Streamlining Security Authorization Through OSCAL Automation

Federal agencies must undergo the complex and laborious process of security authorization to operate (ATO) for each information system (IS) in accordance with the Federal Information Security Modernization Act (FISMA). Currently, most agencies rely on manual documentation processes. These include popular productivity tools to capture the applicable security controls and the status/plans of implementation of the controls for each IS as well as an enterprise Governance, Risk and Compliance (GRC) tool for documentation repository and ATO tracking purposes. The manual documentation processes are tedious, time consuming, costly and error prone.

The National Institute of Standards and Technology (NIST) is developing the Open Security Controls Assessment Language (OSCAL) as a standardized framework for documenting, assessing and communicating security controls for information systems. With the full release of OSCAL 1.0 in June 2021, several vendor tools are now available to leverage OSCAL to streamline and partially automate ATO processes.

This webinar will focus on the opportunities and current challenges in leveraging OSCAL and integratingOSCAL-based ATO processes gradually into agency FISMA processes.