Understanding the Risk Management Framework
How Second Front implements the NIST Risk Management Framework (RMF) to streamline security authorization for applications on Game Warden.
The Risk Management Framework (RMF) is a structured process that integrates essential security, privacy, and risk management activities into the system development life cycle.
Although the government and private sectors may apply RMF differently, both approaches highlight the importance of managing risks effectively throughout an application's life cycle. At Second Front (2F), 2F implements RMF to streamline this process for mission and application owners alike.
2F simplifies RMF adoption by minimizing the documentation and coordination needed to begin onboarding applications to the 2F Platform. We provide early-stage support through our Mission Success team, ensuring customers understand their shared responsibilities throughout the process. Our goal is to give you confidence and clarity from day one.
Prepare
In this first phase, the Mission Owner (MO) determines the appropriate Department of War (DOW) Impact Level (IL) for the application—IL2, IL4, or IL5—based on the sensitivity of the data involved. This ensures the application resides in an appropriately secure environment.
2F collaborates with mission owners to understand the nature of the data and how mission owners will use the application. For example, this may include:
- An application processing government data for analysis
- A system optimizing flight plans using Controlled Unclassified Information (CUI)
This phase also includes identifying key risk management roles on both the customer and 2F sides, outlining a shared responsibility model, and defining continuous monitoring processes.
2F also meets with the application owner to assess the system's handling of CUI.
Categorize
In the Categorize phase, the application and mission owner jointly assess the application's potential impact on confidentiality, integrity, and availability. This determines the system's risk level—low, moderate, or high—and confirms the applicable ILs (for example, IL2–IL5).
In the government's RMF process, this step also includes:
- Documenting the categorization decision
- Having the categorization reviewed and approved by an Authorizing Official (AO)
At 2F, this step mirrors the government's process but executes faster.
The government application of the categorization step of RMF informs organizational risk management processes and tasks by determining the adverse impact from the loss of confidentiality, integrity, and availability of systems and the information processed, stored, and transmitted by those systems. It involves documenting the security categorization of the system and information, completing the categorization decision, and having it reviewed and approved by the authorizing official.
Select
In the Select phase, mission owners choose the appropriate NIST 800-53 security controls based on the application's categorization and environment. These controls are:
- Tailored to each application and mission owner
- Classified as system-specific, hybrid, or common
- Allocated to system components accordingly
2F also develops a continuous monitoring strategy and supports the development of the Body of Evidence (BoE) to document selected controls and responsibilities.
- Accredited to DOW IL2/IL4/IL5
- Deployable to IL6 and JWICS via DAF CLOUDworks/ODIN
- FedRAMP Class D Certification
Implement
In this phase, teams put the selected controls in place and reflect them in the system's security and privacy plans. The application and MOs must apply all assigned controls and update documentation accordingly.
The 2F security team enforces NIST 800-53 security controls and provides both a shared responsibility model and a customer risk management matrix. These resources assist application and mission owners in understanding which security controls are already covered by the Game Warden platform—and which ones they are responsible for. By clarifying this division of responsibility, customers can focus on the controls that directly impact their application and move efficiently through the steps required for production deployment.
The 2F security team enforces NIST 800-53 security controls and provides both a shared responsibility model and a customer risk management matrix. These resources assist application and mission owners in understanding which security controls are already covered by the Game Warden platform—and which ones they are responsible for. By clarifying this division of responsibility, customers can focus on the controls that directly impact their application and move efficiently through the steps required for production deployment.
The key difference between how 2F and the government carry out the RMF lies in responsibility for security controls. In a traditional government process, the application and MOs are responsible for implementing all required controls—often over 600—which can be time-consuming and resource-intensive. With the Game Warden platform, most of these controls are already handled by the platform itself. As a result, customers have fewer controls to address, allowing them to move their application into production and become operational much faster.
Assess
During the Assessment phase of the RMF, government stakeholders check whether security controls are in place, functioning as intended, and meeting system and organizational security and privacy requirements. This phase includes:
- Selecting qualified assessors
- Creating assessment plans
- Addressing any vulnerabilities or deficiencies identified (for example, from scans)
- Developing a Plan of Action and Milestones (POA&M) to track and resolve outstanding control issues
2F's security assessors collaborate with the application owner to integrate the application into the development environment. They use a suite of security tools to scan for and identify various levels of Common Vulnerabilities and Exposures (CVEs). Once the scans are complete, the assessors work with the application owner to remediate any security findings. After the assessors address all issues, they generate a Authorization Package, which includes a Software Approval, marking the application ready for deployment.
2F's security assessors collaborate with the application owner to integrate the application into the development environment. They use a suite of security tools to scan for and identify various levels of Common Vulnerabilities and Exposures (CVEs). Once the scans are complete, the assessors work with the application owner to remediate any security findings. After the assessors address all issues, they generate a Authorization Package, which includes a Software Approval, marking the application ready for deployment.
Onboarding an application through 2F enables customers to work directly with 2F's security assessor team to integrate your application into the Game Warden development environment, perform vulnerability scans, and address any findings. This collaborative process results in the issuance of a Authorization Package and a Software Approval, authorizing the application for production use.
In contrast, the traditional government approach typically assigns an assessment team only for review—leaving application and mission owners fully responsible for implementing controls and resolving vulnerabilities. As a result, the standard Authority to Operate (ATO) process often takes far longer to reach production readiness.
Authorize
During the Authorization phase, the government AO reviews a comprehensive package that includes the executive summary, BoE, assessment reports, and a plan of action with milestones (POA&M). Based on the evidence provided, the AO decides whether to grant an ATO or deny the request.
During this phase, the 2F security team submits the Authorization Package to the AO for review and approval. Once the AO signs off on the Authorization Package, the application owner can transition their application from the development environment into staging and production.
During this phase, the 2F security team submits the Authorization Package to the AO for review and approval. Once the AO signs off on the Authorization Package, the application owner can transition their application from the development environment into staging and production.
The key advantage of using 2F over traditional government processes is the much shorter timeline to reach production. By partnering with the 2F security team, application owners can typically move into production in less than 90 days from the initial contract award. Hands-on support throughout the RMF process drives this accelerated pace, culminating in a Authorization Package that the AO reviews and approves.
Monitor
During the Monitoring phase, the government places full responsibility for ongoing security monitoring of the application and hosting environment on the application owner. As a result, application owners often need to hire a large internal team or contract external resources to manage continuous monitoring and compliance.
2F's security team provides continuous monitoring for applications hosted on the Game Warden platform. The platform's integrated security suite runs container scans every day. Scan results go to both the application owner and the Second Front security team to ensure transparency. When the platform detects vulnerabilities, the security team provides detailed guidance to assist in determining how to remediate or mitigate each issue based on its risk and context.
2F's security team provides continuous monitoring for applications hosted on the Game Warden platform. The platform's integrated security suite runs container scans every day. Scan results go to both the application owner and the Second Front security team to ensure transparency. When the platform detects vulnerabilities, the security team provides detailed guidance to assist in determining how to remediate or mitigate each issue based on its risk and context.
The biggest advantage for application owners using 2F and the Game Warden platform is the ability to inherit the platform's robust security posture. 2F's security assessor team continuously reviews the results of vulnerability scans run on application containers. As a result, application owners do not need to build or manage their own security tooling—the Game Warden platform provides integrated monitoring and assessment out of the box.