EPIC: Authority to Operate (ATO) and System Security Plan (SSP) Sharing

[JJediny]

In research for the FISMAtic project, "the lack of access to examples [of System Security Plans (SSPs)] came up...more than any other topic" by people that have been through an Authority to Operate (ATO) process. Lack of access to examples was also a blocker for that project and others like it trying to do analysis across SSPs. We have the power to solve this for TTS SSPs.

• Check in with FedRAMP to see if they've worked on this at all
• Check in with Security to see if they've worked on this at all
• Finalize the SSP Redaction Guide - cc add information about Controlled Unclassified Information (CUI) 18F/open-source-policy#93
• Update our ATO documentation to reference that guidance, and give tips when authoring from scratch
• Redact and publish an existing SSP

Might make sense to split some of those out to separate issues.

cc opencontrol/discuss#68