Security Compliance Policy
The Game Warden security compliance policy covering Authority to Operate requirements, Authorization Package, CVE remediation timelines, and RBAC enforcement.
On October 14, 2022, the Department of War (DOW) granted Second Front Systems, Inc. (2F)—and, by extension, the 2F Platform—its Authority to Operate (ATO). This authorization allows the 2F Platform-as-a-Service (PaaS) to operate within the DOW network at Impact Levels (IL) 2, 4, and 5 for applications deployed to both the Staging (STG) and Production (PRD) environments. 2F develops, maintains, and operates the 2F Platform.
Authorization Package
The Security Compliance Policy applies to all 2F customers with applications hosted on the 2F platform and deployed to STG or PRD at ILs 2, 4, and 5.
If you deploy applications to PRD at these ILs, you must have a signed Authorization Package from the government's Information Systems Security Manager (ISSM).
The Authorization Package—a Game Warden–specific term—is a body of evidence containing the artifacts required to meet ATO requirements. An ISSM-signed Authorization Package allows you to inherit 2F's ATO, granting permission to deploy applications into both STG and PRD at the applicable ILs.
The ATO is non-transferable and valid only for applications hosted on Game Warden.
The Authorization Package includes:
- Authorization Boundary Diagram
- Body of Evidence (BoE)
- Common Vulnerabilities and Exposures (CVE) summary
Policy definition
The Security Compliance Policy defines the actions 2F takes if your application does not meet CVE remediation timelines. All customers must review, acknowledge, and address CVEs under 2F's Acceptance Baseline Criteria.
| Policy area | Description |
|---|---|
| Ongoing maintenance | Application owners must keep PRD applications updated and maintained. |
| Notification of findings | 2F notifies application owners when security findings near the acceptable remediation timeline. Resolve the findings so applications can continue running in PRD. |
| Failure to remediate | If you do not complete required actions within a timeframe agreed upon by the ISSM, 2F, and the application owner, 2F follows its ATO guidelines. This may include service interruption, such as removing the application from STG and PRD. |
| Service restoration | 2F restores service only after you resolve all outstanding vulnerabilities and the ISSM approves them. If your Deployment Passport has expired, you must receive a new Deployment Passport before 2F restores service. |
| RBAC on the 2F Platform | 2F enforces least-privilege RBAC in its platform clusters. - Allowed: Role + RoleBinding; ClusterRole + RoleBinding (grants access only within the bound namespace). - Not Allowed: ClusterRoleBinding (not permitted because it grants cluster-wide privileges and introduces unacceptable risk to core platform services). |