Authorization Package Submission Process

Use this guide to receive Game Warden Authorizing Official (AO) approval for your Authorization Package after you collect and verify all required documentation.

Prerequisites

Before the Game Warden security team can prepare your Authorization Package for review, your application must meet the following requirements:

Task	Responsibility
1. Resolve all security findings All security findings must be resolved and accepted by the Game Warden Security team.	Customer & Second Front
2. Verify the Body of Evidence (BoE) Confirm that: Components are updated to the current version. Components not included in the Authorization Package are marked Excluded. CUI type is identified (if applicable). Personnel information is complete. Government contract information is accurate. All external databases, systems, and dependencies are documented (where applicable).	Customer
3. Update the Authorization Boundary Diagram Ensure the diagram: Is clear and organized. Uses the exact container names from the BoE. Shows all external connections and data flows (ingress and egress). Uses the same dependency, database, and system names as the BoE. Documents every External Data Connection with the name, ports, protocols, direction, and a complete data flow narrative.	Customer
4. Update the Information Security section Work with your Government System Owner and Contract Sponsor to confirm: Confidentiality, Integrity, and Availability (CIA) levels. Classification Level and Security Classification Guide (SCG). Distribution Control Type. CUI status (IL2 contains no CUI). PII details with your Privacy Official.	Customer
5. Update the Deployment Information section Verify that the BoE includes: All programming languages used. All dependencies (excluding databases). All databases (names must match the Authorization Boundary Diagram).	Customer
6. Harden all pipelines in Harbor	Second Front
7. Upload SAST scan results and attestation Upload the scan results to the BoE in Game Warden within 30 days of submitting the Authorization Package.	Customer
8. Complete DAST scan approval Requirements: A functioning application deployed in DEV. No architecture or code changes since the scan. All findings resolved before submission.	Second Front

Submission process

Once all prerequisites are complete, your Mission Success Manager (MSM) will submit an internal support ticket to start the formal review process.

Code freeze

While your Authorization Package is under review, do not make any changes to the application. Any change may generate new CVEs, requiring resolution and restarting the process.

Review stages

Security Team Review

The Game Warden security team checks your Authorization Package for:

Complete documentation.
All CVE findings, SAST, and DAST findings resolved.
Consistency between the deployed application, BoE, and Authorization Boundary Diagram.

If issues are found, your TIM or Mission Success Managers will work with you to resolve them before resubmission.

Third-Party Review (required for AFWERX customers)

Once approved internally, the Authorization Package is sent to independent assessors for an external accuracy and completeness review.

Authorizing Official Review

The final review is done by the Authorizing Official. Upon approval, your application receives a Software Approval and inherits Game Warden's Authority to Operate (ATO) in DOW environments.

Final steps before deployment

For first-time deployments:

Your MSM will schedule a Pre-Deployment Brief with Second Front, your team, and your Government Sponsor.
This meeting serves as the last review before deployment.
Upon completion, you will receive confirmation for deploying your application to the staging environment.

FAQs

Can you submit an IL4 renewal Authorization Package at the same time as an IL5/IL6 one that is being worked on separately, with an earlier renewal date?

Yes — if it's the same application, you can submit all Authorization Packages together. This approach will likely reduce the Authorizing Official's workload.

The DAST scan is run against the DEV environment. As long as you are using a single DEV environment and there are no differences in the application, the same DAST scan can be used for both submissions.