An overlay either can add or remove controls from the required set used to analyze the system security risks. It also can refine controls, adding additional text for clarity. Although systems designers have discussed developing an overlay that makes it easier to apply the RMF to embedded systems, that hasn't happened yet.
Still, there is progress in developing overlays specific to weapon systems or mission computers that may apply to embedded systems. For example, Appendix F of CNSSI 1253 references six different overlays, including a space platform overlay. Programs should look to the military services to understand if an overlay that applies to their type of system has already been developed before spending unnecessary time going through all computer science vs software engineering controls and documenting their decisions.
Once the systems integrator identifies the appropriate RMF controls he or she needs to determine how to implement them (Step 3 in the RMF Process Overview Diagram). The process of assessing, authorizing, and monitoring (Step 4-6 in the diagram) is undertaken by the prime contractor or U.S. military with the information provided by the hardware vendor. The entire process should be thought of as iterative, and there may be discussions about whether or not a certain control applies.
Comments
Post a Comment