EPIC: Better Sharing of Compliance Documentation and SSPs

[afeld]

In my research for the FISMAtic project, "the lack of access to examples [of System Security Plans (SSPs)] came up...more than any other topic" by people that have been through an Authority to Operate (ATO) process. Lack of access to examples was also a blocker for that project and others like it trying to do analysis across SSPs. We have the power to solve this for TTS SSPs.

• Check in with FedRAMP to see if they've worked on this at all
• Check in with Security to see if they've worked on this at all
• Finalize the SSP Redaction Guide - cc add information about Controlled Unclassified Information (CUI) 18F/open-source-policy#93
• Update our ATO documentation to reference that guidance, and give tips when authoring from scratch
• Redact and publish an existing SSP

Might make sense to split some of those out to separate issues.

cc opencontrol/discuss#68

[afeld]

From @brittag:

Suggest reviewing our cloud.gov nonpublic training deck and our policy doc for this to see if they would help - https://docs.google.com/presentation/d/1uB4MlGCu8ZYUxjKVZKwicQ95MvLxaT4Mh93y6w79GPw/edit#slide=id.g1a2cf8d6b3_0_193 + https://github.com/18F/open-source-policy/blob/master/practice.md#protecting-sensitive-information - the good thing is that we have FedRAMP approval for those docs. we just haven’t yet tried applying to the SSP!

[afeld]

See also: email thread CUI Classification of GSA's System Security Plans.

[afeld]

Great quote from a colleague:

This is also why we want to publish our SSP (time for the circle back to the original question) - we had to invent a whole bunch of solutions to solve problems with mismatches between what the NIST Risk Management Framework expects (large company, traditional data center infrastructure, waterfall processes) and how a realistic cloud-native modern agile team works. So we want to publish those solutions so other people don’t have to reinvent them (reducing the cost of going through [ATO]) and (my dream) so that NIST can learn from them when revising the standards.

[JJediny]

Consolidating into #208