Risk Management and AnA Activities

---

Title III of the E-Government Act, entitled the Federal Information Security Management Act (FISMA), requires each federal agency to develop, document, and implement an information security program. The security program's management, operational, and technical safeguards or countermeasures are to be documented in an adequate System Security Plan (SSP). 

Our team has extensive experience assisting agencies, program managers, system owners, and security personnel across multiple federal departments identify the security controls that are required and implemented and document them in the SSP. Using NIST and FIPS guidance, our professionals will develop a security plan to fit any organization's mission.

Security Control Assessment ensure that system's controls have implemented correctly, operating as intended, and producing the desired outcome. AceProtocol independent assessors will have the responsibility of conducting a comprehensive assessment of system-specific, hybrid, and relevant common controls.

A Plan of Action and Milestones (POA&M) is mandated by the Federal Information Systems Management Act of 2002 (FISMA) as a corrective action plan for tracking and planning the resolution of information security weaknesses. Our team consists of Information System Security Officers and engineers that will take an hands-on approach for identifying vulnerabilities, creating POA&Ms, and mitigating flaws in the systems. 

As mentioned above, we provide assessment services and we also assist with the development and review of authorization packages. Our in depth risk review will give your authorizing official or Designated Approving Authority an holistic perspective of your information system in order to make an authorization decision. 

In an our ever changing and evolving technology environment, an Information system security posture needs to be reviewed, updated, and maintained in order to identify and address new risk as they occur. Monitoring implemented security controls is part of the overall risk management strategy for information security and our federal and private are required to maintain a security authorization that meets the regulatory compliance requirements.