Epic: Obtain an ATO for FAC

[JeanMarie-PM]

Must/required for assessment

Beta Give feedback

1. Initiate ATO meeting with Ryan Palmer
2. Have an ISSO assigned
3. Have a folder created
4. Complete FIPS 199 template
5. Complete DIA Template
6. Get PTA approved
7. Create architecture doc
8. Include New Relic in architecture for ATO #1006
   3 of 3
   MUST compliance +2
   
9. Document show-stopper controls #828
   MUST compliance +2
   
10. Create Privacy Impact Assessment #834
    MUST compliance +2
    
11. SSPP security control validation #1031
    MUST compliance +2
    
12. Set up DAP #1014
    MUST compliance +2
    
13. Set up and configure egress proxy services #1015
    6 of 6
    MUST compliance +2
    
14. Configure apps to use HTTPS egress-proxy #1064
    1 of 1
    MUST compliance +2
    
15. Create and deploy an SMTP egress-proxy #1071
    4 of 4
    MUST compliance +2
    
16. Address Ryan's SSPP comments #1161
    MUST compliance +2
    
17. Implement process to scan docker images #1027
    SHOULD compliance +2
    
18. FAC PenTest #1394
    9 of 9
    MUST compliance +2
    

    
19. Review GSA IT Security Procedural Guides site for FAC-LATO effort #1022
    2 of 2
    UNKNOWN compliance +2
    
20. Remove public_networks_egress ASG from spaces
21. Fill in data transfer agreement for Census/GSA transfer
22. Provision OracleDB for ETL
23. Update boundary diagrams to include ETL/Oracle DB
24. Update boundary diagrams to include ETL/S3 bucket
25. Configure apps to use SMTP egress-proxy #1070
    2 of 4
    MUST compliance +2
    
26. Document configuration management plan #1522
    1 of 4
    MUST compliance +2
    

    
27. FAC ATO Artifact Request: FAC Code Scan Results #1 #1397
    MUST compliance +2
    
28. Draft FAC Contingency Plan SOP #1677
    SHOULD compliance security +3
    

    
29. Create and record agreements with dependent systems #1020
    1 of 1
    SHOULD compliance +2
    
30. Set up a logging service #1019
    6 of 9
    SHOULD compliance +2
    
31. [Revisit 08/16] SSPP Updates incorporating FAC Info Exchange Agreement-S3 #1679
    SHOULD compliance security +3
    

    
32. Automate Security tab export to Google Sheets #1634
    0 of 2
    REVISIT compliance +2
    
33. Draft FAC Account Management SOP #1676
    COULD compliance security +3
    

[JeanMarie-PM]

Folder created: https://drive.google.com/drive/folders/1tvH6w0FzGGpoMcEHfBVnLqaadgN_r7n5?usp=sharing_eil_se_dm&ts=63a46476

[JeanMarie-PM]

Need the following doc to be reviewed. In particular, are there other information types that we need to include in Table 3.2? https://docs.google.com/document/d/1k5VxDeKqGS3svqZGgeNlX6HswWIXJ9Jhf67dhvZmze4/edit?usp=sharing
@mogul , can you take a look please, or let me know who can do this?

[mogul]

That looks accurate AFAIK.

[JeanMarie-PM]

Status on 02/15/23:

• DIA , FIPS-199 and PTA awaiting approval by Ryan Palmer.
• System architecture diagram has been updated and needs to be discussed with Ryan.

[JeanMarie-PM]

JM started working on PIA in archer. Waiting for Chris to get access to archer.

[mogul]

@jadudm can you please confirm that we are definitely going to be adding an Oracle DB to work with during ETL? If so I will roll all three of these into a separate issue.

[jadudm]

LATO obtained. Future work will be tracked through the board and future epics.