executing-nist-rmf-authorization-to-operate skill (Anthropic-Cybersecurity-Skills)

From Public Agent Wiki

What it does. Drive a federal system through the NIST Risk Management Framework (SP 800-37 Rev 2) to an Authorization to Operate (ATO): Prepare, Categorize (FIPS 199), Select a control baseline (FIPS 200 / SP 800-53 Rev 5), Implement, Assess (SP 800-53A), Authorize, and Monitor continuously. Use when a system needs an ATO or a renewal, when working a FISMA/FedRAMP authorization package, when building or reviewing an SSP, SAR, or POA&M, when categorizing a system as Low/Moderate/High impact, when selecting or tailoring a control baseline, or when standing up continuous monitoring (ConMon) after authorization. Covers ATO, conditional ATO (cATO), and the artifacts assessors expect. Keywords: NIST RMF, 800-37, ATO, authorization to operate, FISMA, FedRAMP, SSP, SAR, POA&M, FIPS 199, FIPS 200, 800-53, 800-53A, control baseline, security categorization, continuous monitoring, authorizing official, system boundary, ongoing authorization. Part of mukul975/Anthropic-Cybersecurity-Skills (817 security skills) (mukul975/Anthropic-Cybersecurity-Skills).
Upstream mukul975/Anthropic-Cybersecurity-Skills
Skill file skills/executing-nist-rmf-authorization-to-operate/SKILL.md
License Apache-2.0 (skill folder LICENSE)
Author mukul975
Fetched 2026-09-10

Install

  • npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill executing-nist-rmf-authorization-to-operate, or copy the skill folder into ~/.claude/skills/executing-nist-rmf-authorization-to-operate/.
  • Raw file: curl -sL https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/executing-nist-rmf-authorization-to-operate/SKILL.md

SKILL.md (verbatim)

name: executing-nist-rmf-authorization-to-operate
description: >-
  Drive a federal system through the NIST Risk Management Framework (SP 800-37 Rev 2)
  to an Authorization to Operate (ATO): Prepare, Categorize (FIPS 199), Select a control
  baseline (FIPS 200 / SP 800-53 Rev 5), Implement, Assess (SP 800-53A), Authorize, and
  Monitor continuously. Use when a system needs an ATO or a renewal, when working a
  FISMA/FedRAMP authorization package, when building or reviewing an SSP, SAR, or POA&M,
  when categorizing a system as Low/Moderate/High impact, when selecting or tailoring a
  control baseline, or when standing up continuous monitoring (ConMon) after authorization.
  Covers ATO, conditional ATO (cATO), and the artifacts assessors expect. Keywords: NIST
  RMF, 800-37, ATO, authorization to operate, FISMA, FedRAMP, SSP, SAR, POA&M, FIPS 199,
  FIPS 200, 800-53, 800-53A, control baseline, security categorization, continuous
  monitoring, authorizing official, system boundary, ongoing authorization.
domain: cybersecurity
subdomain: compliance-governance
tags:
- nist-rmf
- nist-800-37
- ato
- fisma
- fedramp
- nist-800-53
- fips-199
- ssp
- poam
- continuous-monitoring
- governance
version: "1.0"
author: andrewibrah
license: Apache-2.0
nist_csf:
- GV.OC-03
- GV.RM-01
- ID.AM-08
- ID.RA-05
- PR.IR-01
mitre_attack:
- T1078
- T1190
- T1068
- T1210
- T1486

Executing the NIST RMF to an Authorization to Operate (ATO)

When to Use

  • When a federal or federally-aligned system (or a FedRAMP cloud service) needs an Authorization to Operate, a re-authorization, or has fallen out of authorization.
  • When you must produce or review the core authorization artifacts: System Security Plan (SSP), Security Assessment Report (SAR), and Plan of Action & Milestones (POA&M).
  • When categorizing a system's impact level (Low / Moderate / High) under FIPS 199.
  • When selecting, tailoring, or implementing a NIST SP 800-53 Rev 5 control baseline.
  • When standing up continuous monitoring (ConMon) or pursuing ongoing authorization / cATO after an initial ATO.

Prerequisites

  • A defined system and authorization boundary (what's in, what's inherited, what's a leveraged service).
  • An identified Authorizing Official (AO), System Owner, and ISSO.
  • The information types the system handles (use SP 800-60 to map them to impact levels).
  • For cloud: the provider's Customer Responsibility Matrix (CRM) and any inherited/leveraged ATO.
  • Access to assessment evidence sources (config, scans, policies) for the Assess step.

Workflow

NIST SP 800-37 Rev 2 defines seven steps. Prepare is the foundation; the rest run in order and then loop through Monitor.

0/1. Prepare (organization and system level)

Establish context: roles (AO, SO, ISSO, assessor), risk-management strategy and tolerance (ties to SP 800-39), a control baseline strategy, common controls available for inheritance, and the system's mission/business context. Define the authorization boundary precisely — scope creep here inflates the whole package.

2. Categorize (FIPS 199 + SP 800-60)

Determine the impact level for confidentiality, integrity, and availability for each information type, then take the high-water mark across the three to set the overall system categorization: Low, Moderate, or High. Document in the SSP. This single decision drives the entire control baseline.

3. Select (FIPS 200 + SP 800-53 Rev 5 + SP 800-53B)

Start from the SP 800-53B baseline matching the categorization (Low/Moderate/High). Then tailor: apply scoping guidance, select compensating controls where needed, and assign values to organization-defined parameters. Add overlays (e.g., privacy, FedRAMP). Record the tailored set and the rationale in the SSP. Identify which controls are common (inherited), system-specific, or hybrid.

4. Implement

Deploy the selected controls and document how each is implemented in the SSP — the implementation statement, not just "yes." This is the artifact assessors read first; vague statements generate findings.

5. Assess (SP 800-53A Rev 5)

An independent assessor evaluates controls using the examine / interview / test methods against assessment objectives. Findings of "other than satisfied" become weaknesses. Output is the Security Assessment Report (SAR). Remediate what you can before authorization; the rest flows to the POA&M.

6. Authorize

Assemble the authorization package: SSP + SAR + POA&M (plus supporting artifacts). The AO reviews residual risk and renders a decision:

  • ATO — authorized, typically with a defined term and a ConMon expectation.
  • Conditional / cATO — authorized subject to conditions or operating under an approved ongoing-authorization model.
  • Denial / DATO — risk too high; system may not operate.

The decision and its rationale are captured in the authorization decision document.

7. Monitor (continuous monitoring)

Authorization is not a one-time gate. Maintain an ongoing posture: track control effectiveness, ingest scan/config drift, update the SSP on change, work the POA&M to closure, report per the ConMon plan, and feed significant changes back into reassessment. Mature programs move from periodic re-ATO to ongoing authorization.

Key Concepts

Concept Definition
Authorization boundary The set of components, data flows, and inherited services covered by the authorization.
FIPS 199 categorization Low/Moderate/High per C/I/A; overall = high-water mark across the three.
Control baseline The SP 800-53B starting control set for the categorization, before tailoring.
Tailoring Adjusting the baseline via scoping, compensating controls, and parameter values.
Common / inherited control A control provided by another entity (e.g., the platform) and inherited by the system.
SSP System Security Plan — describes the system, boundary, and how each control is implemented.
SAR Security Assessment Report — the assessor's findings on control effectiveness.
POA&M Plan of Action & Milestones — tracked weaknesses with owners and remediation dates.
ATO / cATO / DATO Authorize / conditional (ongoing) / denial of authorization to operate.
Authorizing Official (AO) The senior official who accepts residual risk and signs the authorization.
ConMon Continuous monitoring — ongoing control-effectiveness and risk tracking post-ATO.

Tools & Systems

  • NIST SP 800-37 Rev 2 — the RMF process (7 steps).
  • FIPS 199 / FIPS 200 / SP 800-60 — categorization and minimum requirements.
  • NIST SP 800-53 Rev 5 / 800-53B — control catalog and baselines.
  • NIST SP 800-53A Rev 5 — assessment procedures (examine/interview/test).
  • OSCAL — machine-readable SSP/SAR/POA&M (NIST's authorization-document format).
  • eMASS (DoD) / FedRAMP templates — package management and submission.
  • GRC platforms — Xacta, ServiceNow, RegScale, etc., to manage the package and ConMon.
  • NIST CSF 2.0 — cross-walks to communicate RMF posture in framework terms.

Common Scenarios

  • New system pre-launch. Run Categorize → Authorize before go-live; ATO is the gate to production.
  • Cloud service (FedRAMP). Inherit the platform's controls, document the CRM split, and authorize the customer-responsible delta.
  • Re-authorization. Triggered by term expiry or significant change; refresh SSP/SAR/POA&M and re-decide.
  • cATO / ongoing authorization. Replace periodic re-ATO with continuous evidence and an approved ConMon model.
  • POA&M review. Triage open weaknesses by risk, assign owners and dates, and report closure trend to the AO.

Output Format

Produce an Authorization Package summary using assets/template.md, containing:

  1. System & boundary — description, components, data flows, inherited services.
  2. Categorization — FIPS 199 C/I/A and overall impact, with information-type rationale.
  3. Control baseline & tailoring — baseline selected, tailoring decisions, common vs system-specific.
  4. Implementation status — per-family implementation summary (from the SSP).
  5. Assessment results (SAR) — findings by severity; what's satisfied vs other-than-satisfied.
  6. POA&M — open weaknesses, risk, owner, milestone dates.
  7. Authorization decision — ATO/cATO/DATO, term, conditions, residual-risk statement, AO.
  8. ConMon plan — what's monitored, how often, reporting cadence, reassessment triggers.

Use scripts/process.py to select the right SP 800-53B baseline from a FIPS 199 categorization, summarize control-implementation status, and generate a POA&M table from a findings JSON.

Other files in this skill

assets/template.md (verbatim)

Authorization Package Summary (NIST RMF / SP 800-37 Rev 2) — Worked Example

Filled example for a Moderate-impact federal web application seeking an initial ATO. Replace bracketed content for your own system.

1. System & Authorization Boundary

  • System name: Citizen Services Portal (CSP)
  • System owner / ISSO / AO: [SO name] / [ISSO name] / [AO name]
  • Description: Public-facing web portal for benefit applications; React frontend, containerized API, managed Postgres, all in an authorized cloud (FedRAMP Moderate) tenant.
  • Boundary: The application containers, API gateway, database, and CI/CD pipeline within the project's cloud account. Inherited: physical, environmental, and hypervisor controls from the FedRAMP-authorized platform (documented in the CRM).
  • Leveraged authorization: Platform IaaS at FedRAMP Moderate.

2. FIPS 199 Categorization

(generated by scripts/process.py from the information-type table; overall = high-water mark)

Objective High-water mark
Confidentiality Moderate
Integrity Moderate
Availability Moderate
Overall system impact Moderate

Information types: PII (C:Mod / I:Mod / A:Low), Eligibility records (C:Mod / I:Mod / A:Mod), Public content (C:Low / I:Mod / A:Mod). Selected SP 800-53B baseline: Moderate. Privacy overlay applied (PII present).

3. Control Baseline & Tailoring

  • Baseline: SP 800-53B Moderate + privacy controls (PT family).
  • Tailoring decisions: PE family largely inherited from the platform (common controls). Organization-defined parameters set for AC-7 (lockout threshold = 5), AU-11 (log retention = 1 year), IA-5 (password/authenticator policy).
  • Allocation: Common (inherited) — PE, parts of SC/CP; System-specific — AC, AU, SI, application-layer SC; Hybrid — IR, CM (platform + app split per CRM).

4. Control Implementation Status (from the SSP)

Family Implemented Total %
AC 22 25 88%
AU 14 16 88%
SC 28 30 93%
SI 12 14 86%
Total 76 85 89%

(Each implemented control carries an implementation statement in the SSP — not a bare "yes." Open items map to the POA&M below.)

5. Assessment Results (SAR)

Independent assessment per SP 800-53A Rev 5 (examine / interview / test). Result: 3 controls "Other Than Satisfied", all with remediation plans. No Critical findings. Detailed evidence in the full SAR.

6. Plan of Action & Milestones (POA&M)

(generated by scripts/process.py, sorted by severity)

ID Control Weakness Severity Status Remediation Owner Milestone
F-001 AC-7 No account lockout on the portal login High Other Than Satisfied Configure lockout after 5 failed attempts App team 2026-07-15
F-002 AU-6 Audit logs not reviewed on a defined cadence Moderate Other Than Satisfied Stand up weekly SIEM review + alerting SOC 2026-08-01
F-003 SI-2 Two medium CVEs unpatched in a dependency Moderate Other Than Satisfied Patch in next sprint; add Dependabot gate App team 2026-07-30

Open High/Critical findings: 1 (F-001) — track to closure before/within ATO conditions.

7. Authorization Decision

  • Decision: ATO with conditions (effectively a cATO posture).
  • Term: 3 years, contingent on continuous monitoring and POA&M adherence.
  • Conditions: Close F-001 (High) within 30 days of authorization; F-002 and F-003 per their milestones.
  • Residual-risk statement: Residual risk is Moderate and acceptable given the compensating monitoring and the committed remediation timeline.
  • Authorizing Official: [AO name], [date].

8. Continuous Monitoring (ConMon) Plan

  • Monitored continuously: vulnerability scans (weekly), configuration drift (CM), POA&M status (monthly to the AO), control effectiveness sampling (quarterly).
  • Reporting cadence: Monthly ConMon report; immediate notification of any High/Critical finding or significant change.
  • Reassessment triggers: new external interface, change of categorization, major architecture change, or a significant incident.
  • Maturity goal: Move from periodic re-ATO toward ongoing authorization as ConMon evidence stabilizes.

references/standards.md (verbatim)

NIST RMF / ATO — Standards & Reference

Primary standard

NIST SP 800-37 Revision 2 — Risk Management Framework for Information Systems and Organizations

The seven RMF steps

# Step Core question Key inputs
1 Prepare Are roles, strategy, and boundary set? SP 800-39 risk strategy, common controls
2 Categorize How bad is a loss of C/I/A? FIPS 199, SP 800-60
3 Select Which controls apply? FIPS 200, SP 800-53B baselines, SP 800-53 Rev 5
4 Implement How is each control built? SSP implementation statements
5 Assess Do the controls work? SP 800-53A Rev 5; produces the SAR
6 Authorize Is residual risk acceptable? Package (SSP+SAR+POA&M); AO decision
7 Monitor Is it still effective? ConMon plan, scans, change management

Companion standards

Document Role
FIPS 199 Security categorization — Low/Moderate/High per confidentiality, integrity, availability.
FIPS 200 Minimum security requirements for federal information and systems.
NIST SP 800-60 Vol 1 & 2 Maps information types to impact levels (input to FIPS 199).
NIST SP 800-53 Rev 5 Control catalog — 20 control families.
NIST SP 800-53B Control baselines (Low / Moderate / High) and the privacy baseline.
NIST SP 800-53A Rev 5 Assessment procedures (examine / interview / test).
NIST SP 800-39 Organization-wide risk management context (three tiers).
NIST SP 800-137 Information Security Continuous Monitoring (ISCM) — the Monitor step.
OSCAL Open Security Controls Assessment Language — machine-readable SSP/SAP/SAR/POA&M.

FIPS 199 categorization

For each information type, rate the impact of a loss of:

  • Confidentiality — unauthorized disclosure
  • Integrity — unauthorized modification/destruction
  • Availability — disruption of access/use

Each at Low / Moderate / High. The overall system impact level = the high-water mark (highest single value) across all information types and all three objectives. That overall level selects the SP 800-53B baseline.

SP 800-53 Rev 5 control families (20)

AC (Access Control), AT (Awareness & Training), AU (Audit & Accountability), CA (Assessment, Authorization & Monitoring), CM (Configuration Management), CP (Contingency Planning), IA (Identification & Authentication), IR (Incident Response), MA (Maintenance), MP (Media Protection), PE (Physical & Environmental Protection), PL (Planning), PM (Program Management), PS (Personnel Security), PT (PII Processing & Transparency), RA (Risk Assessment), SA (System & Services Acquisition), SC (System & Communications Protection), SI (System & Information Integrity), SR (Supply Chain Risk Management).

Control allocation

  • Common (inherited) — provided by another provider/platform; the system inherits the implementation and the evidence.
  • System-specific — implemented and owned by this system.
  • Hybrid — partly inherited, partly system-specific (responsibility split documented, e.g., in a FedRAMP CRM).

Core authorization artifacts

Artifact Produced in step Contents
SSP — System Security Plan Select/Implement System description, boundary, categorization, control implementation statements.
SAR — Security Assessment Report Assess Assessor findings: satisfied / other-than-satisfied, with evidence.
POA&M — Plan of Action & Milestones Assess → Authorize Open weaknesses, risk, remediation owner, milestone dates.
Authorization Decision Document Authorize ATO/cATO/DATO, term, conditions, residual-risk acceptance, AO signature.
ConMon Plan Monitor What's monitored, frequency, reporting cadence, reassessment triggers.

Authorization outcomes

  • ATO — Authorization to Operate (often time-bound, e.g., up to 3 years, with ConMon).
  • cATO — Conditional / ongoing authorization under an approved continuous model (increasingly preferred in DoD).
  • DATO — Denial of Authorization to Operate.

NIST CSF 2.0 alignment

CSF 2.0 ID Relevance
GV.OC-03 Legal/regulatory requirements (FISMA) understood and managed.
GV.RM-01 Risk-management objectives established and agreed.
ID.AM-08 Systems managed across the lifecycle (authorization boundary).
ID.RA-05 Risk used to inform prioritization and the authorization decision.
PR.IR-01 Protective technology / controls implemented per the baseline.

Back to mukul975/Anthropic-Cybersecurity-Skills (817 security skills) or Agent skills.