ATO /Risk Management Framework Lead

The ATO / Risk Management Framework Lead plans and drives the path to an
Authorization to Operate (ATO) and then keeps the system authorized. ACF won't
let any production system, MIS, dashboard, portal, data repository, or external
facing platform that processes Federal information operate until ACF confirms
the authorization path, whether a full ATO, a provisional ATO, or a written ACF
OCIO determination that no ATO is required. ACF expects the ATO process to take
about six months, on a schedule the ACF OCIO approves no later than 30 days
after award. The lead builds the authorization package, coordinates assessment
and testing, resolves findings, runs continuous monitoring, and owns the
privacy and security activities Task 9 requires, including incident reporting
and the flow down of requirements to anyone CDIT brings onto the work. The lead
works most closely with the Cloud / Solution Architect, who designs the
environment the package describes.

Responsibilities

· Within
30 days after award, lead the draft Privacy Threshold Analysis and Privacy
Impact Assessment support package and the Data Security Plan for the COR and
the ACF OCIO reviewers, describing data flows, system boundaries, user roles,
encryption, access controls, audit logging, retention, destruction, incident
response, subcontractor access, and privacy protections (RFQ Task 9.4).

· Work
with the COR and ACF to determine the type and sensitivity of the CUI involved
and whether an ATO is required, and recommend the most efficient authorization
path among the ACF Tech ATO types, including inheritance from a FedRAMP
authorized environment and the ACF Authority to Use (ACF Tech Appendix D).

· Propose
the ATO schedule for ACF OCIO approval no later than 30 days after award and
manage the authorization effort to it (RFQ Task 10).

· Categorize
the system under FIPS 199 and FIPS 200 and select, tailor, and document the
NIST SP 800-53 control baseline for a Moderate system, applying NIST SP 800-18,
NIST SP 800-171, DISA STIG hardening guidance, OMB Memorandum M-05-22, and HHS
and ACF policy.

· Author
and maintain the authorization package deliverables listed below on the
schedule ACF Tech approves, including the annual System Security Plan update,
the annual assessment, the quarterly POA&M update, and the annual
contingency plan test.

· Coordinate
the security assessment with the assessor, support testing, track every
finding, and drive remediation or risk acceptance to closure.

· Document
the Zero Trust implementation approach and expected maturity level and manage
the quarterly Zero Trust scorecard submissions for the system (ACF Tech
Appendix B and Appendix C).

· Run
continuous monitoring under FISMA and NIST SP 800-137: monthly vulnerability
scans with an ACF Tech approved tool, patch management, log review, account
review, configuration management, and POA&M updates on the schedule ACF
OCIO approves. Report critical and high vulnerabilities to the COR and
remediate them within ACF approved timeframes (RFQ Task 10).

· Maintain
the authorization boundary and all security documentation throughout the period
of performance, and submit changes through ACF change control before
implementation.

· Own
incident reporting: any suspected or confirmed breach, cyber incident,
unauthorized disclosure, lost device, or exposure of information that isn't
public is reported immediately, within one hour at most, through CDIT and
Guidehouse to the Contracting Officer, the COR, and the ACF Incident Response
Team, with logs and evidence preserved and full cooperation with ACF and HHS
response (RFQ Task 9.5 and Section 4.0).

· Assess
whether any data the program collects, stores, transmits, or analyzes is
Protected Health Information and whether CDIT or any subcontractor is a HIPAA
business associate, and if so support the Business Associate Agreement and the
required safeguards (RFQ Task 9.6).

· Support
the Data Inventory and Data Minimization Plan before any data is collected,
confirming that no Social Security numbers or other high risk identifiers are
collected without written COR approval (RFQ Task 6.3).

· Complete
the electronic authentication risk assessment with the system owner and ISSO to
set the identity, authentication, and federated assurance levels (RFQ Section
4.0).

· Flow
the privacy, security, records, incident reporting, and training requirements
down to any subcontractor, consultant, or vendor CDIT uses, track the required
training certificates, and keep the records that show compliance (RFQ Tasks 9.2
and 9.3).

· Support
the Sustainability and Transition strategy with the security documentation,
data handling, and media sanitization under NIST SP 800-88 needed for a
complete and secure transfer at the end of the contract (RFQ Task 8).

Required qualifications

· Bachelor's
degree.

· At
least 7 years in federal information security, with hands on Risk Management
Framework work under NIST SP 800-37 and NIST SP 800-53.

· Has led
at least one federal system through assessment to a signed ATO, including
writing the System Security Plan, supporting the assessment, and managing the
POA&M.

· FedRAMP
knowledge, including control inheritance from an authorized cloud environment
and the customer responsibility matrix.

· Continuous
monitoring and vulnerability management with enterprise scanning tools,
including reading results and driving remediation.

· Working
knowledge of FISMA, the Privacy Act, HIPAA security requirements, and federal
incident reporting obligations.

· Clear
technical writing and the ability to coordinate assessors, developers, and
Government reviewers to a schedule.

· Public
Trust Tier 2 clearance, held or obtainable.

Desired qualifications (CDIT
additions, not conditions of the subcontract)

· CISSP,
CGRC (formerly CAP), CISM, or an equivalent security certification.

· Prior
ATO work at HHS or an HHS operating division, and familiarity with the HHS and
ACF security program and templates.

· Experience
with a governance, risk, and compliance tool used for federal authorization
packages.

· Experience
producing Zero Trust scorecards against the CISA Zero Trust Maturity Model.

· Privacy
credential such as CIPP/G, or experience preparing Privacy Threshold Analyses
and Privacy Impact Assessments.