Understanding the Risk Management Framework¶
The Risk Management Framework (RMF) is a structured process that integrates essential security, privacy, and risk management activities into the system development life cycle.
Although the government and private sectors may apply RMF differently, both approaches highlight the importance of managing risks effectively throughout an application’s life cycle. At Second Front (2F), our implementation of RMF is designed to streamline this process for mission and application owners alike.
Benefit of using 2F
2F simplifies RMF adoption by minimizing the documentation and coordination needed to begin onboarding applications to the Game Warden platform. We provide early-stage support through our Mission Success team, ensuring customers understand their shared responsibilities throughout the process. Our goal is to give you confidence and clarity from day one.
Prepare¶
In this first phase, the Mission Owner (MO) determines the appropriate Department of Defense (DoD) Impact Level (IL) for the application—IL2, IL4, or IL5—based on the sensitivity of the data involved. This ensures the application is hosted in an appropriately secure environment.
2F collaborates with mission owners to understand the nature of the data and how the application will be used. For example, this may include:
- An application processing government data for analysis
- A system optimizing flight plans using Controlled Unclassified Information (CUI)
This phase also includes identifying key risk management roles on both the customer and 2F sides, outlining a shared responsibility model, and defining continuous monitoring processes.
Additionally, 2F will meet with the application owner to assess the system’s handling of CUI.
Categorize¶
In the Categorize phase, the application and mission owner jointly assess the application’s potential impact on confidentiality, integrity, and availability. This determines the system's risk level—low, moderate, or high—and confirms the applicable ILs (e.g., IL2–IL5).
In the government’s RMF process, this step also includes:
- Documenting the categorization decision
- Having the categorization reviewed and approved by an Authorizing Official (AO)
At 2F, this step mirrors the government’s process but is streamlined for faster execution.
The government application of the categorization step of RMF informs organizational risk management processes and tasks by determining the adverse impact in terms of the loss of confidentiality, integrity, and availability of systems and the information processed, stored, and transmitted by those systems. It involves documenting the security categorization of the system and information, completing the categorization decision, and having it reviewed and approved by the authorizing official.
Select¶
In the Select phase, the appropriate NIST 800-53 Rev. 4 security controls are chosen based on the application's categorization and environment. These controls are:
- Tailored to each application and mission owner
- Classified as system-specific, hybrid, or common
- Allocated to system components accordingly
2F also develops a continuous monitoring strategy and supports the development of the Body of Evidence (BoE) to document selected controls and responsibilities.
Game Warden accreditation
- Accredited to DoD IL5
- Deployable to IL6 via DAF CLOUDworks/ODIN
- In-process for FedRAMP High Baseline
Implement¶
In this phase, the selected controls must be implemented and reflected in the system’s security and privacy plans. The application and MOs are expected to implement all assigned controls and update documentation accordingly.
The 2F security team enforces NIST 800-53 security controls and provides both a shared responsibility model and a customer risk management matrix. These resources help application and mission owners clearly understand which security controls are already covered by the Game Warden platform—and which ones they are responsible for. By clarifying this division of responsibility, customers can focus on the controls that directly impact their application and move efficiently through the steps required for production deployment.
The key difference between how 2F and the government implement the RMF lies in responsibility for security controls. In a traditional government process, the application and MOs are responsible for implementing all required controls—often over 600—which can be time-consuming and resource-intensive. With the Game Warden platform, many of these controls are already handled by the platform itself. As a result, customers have fewer controls to address, allowing them to move their application into production and become operational much faster.
Assess¶
During the Assessment phase of the RMF, government stakeholders evaluate whether security controls are properly implemented, functioning as intended, and meeting system and organizational security and privacy requirements. This phase includes:
- Selecting qualified assessors
- Creating assessment plans
- Addressing any vulnerabilities or deficiencies identified (e.g., from scans)
- Developing a Plan of Action and Milestones (POA&M) to track and resolve outstanding control issues
2F’s security assessors collaborate closely with the application owner to integrate the application into the development environment. They use a suite of security tools to scan for and identify various levels of Common Vulnerabilities and Exposures (CVEs). Once the scans are complete, the assessors work with the application owner to remediate any security findings. After all issues are addressed, the assessors generate a Deployment Passport, which includes a Certificate to Field (CtF)/Software Approval, marking the application ready for deployment.
Onboarding an application through 2F enables customers to work directly with our security assessor team to integrate your application into the Game Warden development environment, perform vulnerability scans, and address any findings. This collaborative process results in the issuance of a Deployment Passport and a CtF/Software Approval, authorizing the application for production use.
In contrast, the traditional government approach typically assigns an assessment team only for review—leaving application and mission owners fully responsible for implementing controls and resolving vulnerabilities. As a result, the standard Authority to Operate (ATO) process often takes significantly longer to reach production readiness.
Authorize¶
During the Authorization phase, the government AO reviews a comprehensive authorization package. This package typically includes the executive summary, BoE, assessment reports, and a plan of action with milestones (POA&M). Based on the evidence provided, the AO decides whether to grant an ATO or deny the request.
During this phase, the 2F security team submits the Deployment Passport to the AO for review and approval. Once the AO signs off on the Deployment Passport, the application owner is authorized to transition their application from the development environment into staging and production.
The key advantage of using 2F over traditional government processes is the significantly shorter timeline to reach production. By partnering closely with the 2F security team, application owners can typically move into production in less than 90 days from the initial contract award. This accelerated pace is achieved through hands-on support throughout the RMF process, culminating in a Deployment Passport that is reviewed and approved by the AO.
Monitor¶
During the Monitoring phase, the government places full responsibility for ongoing security monitoring of the application and hosting environment on the application owner. As a result, application owners often need to hire a large internal team or contract external resources to manage continuous monitoring and compliance.
Our security team provides continuous monitoring for applications hosted on the Game Warden platform. Container scans are run 24/7 using the platform’s integrated security suite. Scan results are shared with both the application owner and the Second Front security team to ensure transparency. When vulnerabilities are detected, detailed guidance is provided to help determine how each issue should be remediated or mitigated based on its risk and context.
The biggest advantage for application owners using 2F and the Game Warden platform is the ability to inherit the platform’s robust security posture. Our security assessor team continuously reviews the results of vulnerability scans run on application containers. As a result, application owners don’t need to build or manage their own security tooling—the Game Warden platform provides integrated monitoring and assessment out of the box.