HomeMission AreasCritical Technology ProtectionIndustrial Security Field Operations (IO)NISP Authorization Office (NAO)RMF News

Industrial Security

RMF News

The NISP Instance of the Enterprise Mission Assurance Support
By Nao News | May 6, 2019

The NISP instance of the Enterprise Mission Assurance Support Service (eMASS) is now the official system of record for Assessment and Authorization (A&A) actions.   In addition to completing all the NISP eMASS Account prerequisites (SAAR, Cyber Awareness Challenge Training, and eMASS Computer Based Training), Industry users must complete the New User Registration in the NISP eMASS instance:  https://emass-nisp.csd.disa.mil/. Once the New User Registration is complete, Industry user accounts can be activated.  The NISP eMASS Account and Access Procedures Job Aid is posted on the NISP eMASS Information and Resource Center: https://www.dss.mil/ma/ctp/io/nao/rmf/. Note:  DISA has identified an issue with New User Registration when accessing NISP eMASS via an ECA.  DISA is implementing a patch that will resolve this issue by May 10th. If you have any questions or concerns, please contact the NAO eMASS Mailbox at: dss.quantico.dss.mbx.emass@mail.mil

Executive Order directing transfer of investigative mission signed by President
By | April 25, 2019

Consistent with the Executive Order signed on April 24, 2019, the Department of Defense (DoD) will begin a phased transition of the investigations conducted by the National Background Investigations Bureau (NBIB) to DoD. This action will include the transfer of personnel and resources from NBIB to DSS, as authorized by the president of the United States. The transfer of NBIB's operations, personnel, and resources to DoD will commence not later than June 24, 2019 with the transfer completed by Oct. 1, 2019. DSS will be renamed the Defense Counterintelligence and Security Agency (DCSA) and serve as the primary Federal entity for conducting background investigations for the Federal Government. DCSA will also serve as the primary Department of Defense component for the National Industrial Security Program and shall execute responsibilities relating to continuous vetting, insider threat programs, and any other responsibilities assigned to it by the Secretary of Defense. NBIB and DSS have and will continue to work in an integrated manner to minimize disruptions to existing missions while beginning the transfer process.

NISP Enterprise Wide Area Network Job Aid now available
By | April 16, 2019

The NISP Authorization Office (NAO) has created a job aid for cleared industry partners interested in pursuing an authorized NISP Enterprise Wide Area Network (eWAN) for their organization. The job aid outlines the requirements for participation in the eWAN program, and provides guidance toward successful creation of an eWAN proposal, System Security Plan (SSP), and test and authorization planning. The job aid can be found on the NAO Risk Management Framework Site (https://www.dss.mil/ma/ctp/io/nao/rmf/) under "Resources.

DSS Assessment and Authorization Process Manual (DAAPM) Version 2.0
By | April 8, 2019

The NISP Authorization Office (NAO) released theDSS Assessment and Authorization Process Manual (DAAPM) Version 2.0. The updated version is posted on the NAO Risk Management Framework site(https://www.dss.mil/ma/ctp/io/nao/rmf/) under "Policy and Guidance". DAAPM Version 2.0 becomes effective on May 6, 2019, and supersedes all previous versions of the DAAPM and ODAA Process Manuals. If you have questions or concerns, contact your assigned Information Systems Security Professional (ISSP). If you have specific questions about the format, content, or want to provide general comments, send those to dss.quantico.dss hq.mbx.odaa@mail.mil


NAO delays release of the Enterprise Mission Assurance Support Service (eMASS)
By | Feb. 14, 2019

The DSS NISP Authorization Office (NAO) has postponed the eMASS transition until May 6, 2019. Cleared industry partners should continue to work with their ISSPs and Team Leads to complete the required eMASS training and request a NISP eMASS account to ensure readiness for the transition. Job aids are posted on the NISP eMASS Information and Resource Center.

With the postponement of the eMASS transition, the DSS Assessment and Authorization Process Manual (DAAPM) Version 2.0 will be delayed. The revised release date is April 8, 2019, with an effective date of May 6, 2019.

Industry partners should continue to submit all System Security Plans (SSP) and supporting artifacts via the ODAA Business Management System (OBMS).

Questions and inquiries regarding eMASS are handled through the NAO eMASS mailbox: dss.quantico.dss.mbx.emass@mail.mil. Questions and inquiries regarding the DAAPM are handled through the NAO mailbox: dss.quantico.dss-hq.mbx.odaa@mail.mil.

NISP Enterprise Mission Assurance Support Service (e-MASS) Job Aid for training guidance and system access
By RMF | June 19, 2018
The NISP Authorization Office has created a job aid for cleared industry to obtain access and sponsorship to the NISP eMASS. These instructions will allow NISP partners to access and complete the required DISA computer-based training beginning on July 2, 2018. You can find the job aid here.
Release of DAAPM 1.3
By RMF | May 24, 2018

The DSS NISP Authorization Office (NAO) is announcing the upcoming release of the DSS Assessments and Authorization Process Manual (DAAPM) 1.3 in its continuing effort to provide users with the most up-to-date requirements of the Risk Management Framework (RMF) process. This version update revolves around two specific areas of interest and goes into effect on June 4, 2018. Version 1.3 supersedes all previous versions of the DAAPM.

First area of interest is the inclusion of a recommended 90 day submission period for RMF packages. This change is located at the beginning of Section 6, which has been renamed to "Assessment and Authorization Implementation Guidance." The rationale for the change is to ensure that both Industry and DSS allow time to sufficiently work the packages before and after submission.

Next area of interest is defining who (cleared Industry or DSS) has responsibility for each step of the process. Contained in Section 6 is a walk-through of each RMF step with tasks and who is responsible for those tasks. In summary, Industry is responsible for Step 1, Step 2, Step 3, the first part of Step 4 and the first part of Step 6. DSS is responsible for the second part of Step 4, Step 5 and the second part of Step 6. Additionally, the flowchart in Section 5 is updated to reflect ownership of each step. Finally, the Concurrence Form has been eliminated. The intent of these updates is to eliminate confusion.
DSS Authorized Warning Banner
By Nao News | Feb. 16, 2018
Industry indicated that the DSS Authorized Warning Banner does not display as shown in the DSS Assessment and Authorization Process Manual (DAAPM). The issue is due to the use of the semi-colons. In order to resolve this matter, Industry is authorized to use a comma in place of the semi-colon. If you have questions or concerns, please contact your assigned Information Systems Security Professional (ISSP). If you have specific questions about the format or content of the DSS Authorized Warning Banner, please provide comments and questions to dss.quantico.dss-hq.mbx.odaa@mail.mil.
DSS Assessment and Authorization Process Manual (DAAPM) Version 1.2 Released
By RMF | Nov. 17, 2017
On November 17, 2017, the DSS NISP Authorization Office (NAO) released the DAAPM Version 1.2. The updated version is posted under the "Policy and Guidance" section. If you have questions or concerns, contact your assigned Information System Security Professional (ISSP). If you have specific questions about the format, content, or want to provide general comments, send those to dss.quantico.dss-hq.mbx.odaa@mail.mil.
NCMS 2017 - Questions and Answers
By RMF | Aug. 17, 2017
The NISP Authorization Office has provided responses to the most frequently asked questions at this year's NCMS conference. The content provided will answer many of the most common and pressing questions industry has regarding the transition of their classified information systems to the Risk Management Framework (RMF). To access the document, please scroll down to the bottom of this page under "Resources" and click on the "NCMS 2017 Questions & Answers" link.
Windows Configuration Toolkit GPO
By RMF | June 5, 2017
The NISP Authorization Office (NAO) has released the Windows Configuration Toolkit GPO to assist industry in the baseline technical configuration of systems using the Windows 10 operating system. The tool can be accessed and downloaded via OBMS and is located in the Headquarters section of the ODAA Bulletin Board, alongside the SCAP and STIG resources. For more detailed instructions, please reference the Job Aid titled "NAO Configuration Toolkit Job Aid" located on this webpage under the "Toolkits" section.
Risk Management Framework - Phase 2
By RMF | May 19, 2017
Effective January 1, 2018, all NISP partners and cleared industry will fully transition to Risk Management Framework. All Information Systems (IS) authorizations must be executed via the RMF Assessment and Authorization process. The RMF Assessment and Authorization process is promulgated in the DSS Assessments and Authorization Process Manual (DAAPM).
RMF Information System (IS) OBMS Submissions
By RMF | April 7, 2017
Effective immediately - Submissions for IS that are updating from NISPOM regulations to NIST RMF regulations are new submissions. Industry should submit in OBMS as a new system. If Industry submits as a re-submission, DSS will reject the re-submission and direct the ISSM to submit as a new system.
NAO Windows Configuration Toolkit now available
By RMF | March 31, 2017
NAO has released the Windows Configuration Toolkit GPO to assist industry in the baseline technical configuration of systems using the Windows 7 (x86/x64) operating system. The tool can be accessed and downloaded via OBMS and is located in the Headquarter section of the ODAA Bulletin Board, alongside the SCAP and STIG resources. For more detailed instructions, please reference the Job Aid titled "NAO Configuration Toolkit Job Aid" located on this webpage under the "Toolkits" section.
DSS Assessment and Authorization Process Manual (DAAPM) V1.1 Released
By RMF | March 31, 2017
The NISP Authorization Office (NAO) has released the updated DSS Assessment and Authorization Process Manual (DAAPM) v1.1 effective 31 March 2017. The updated document is located on this webpage under the "Policy and Guidance" section
NAO discontinues emailing authorization decision status updates
By RMF | March 2, 2017
Effective immediately, the NISP Authorization Office (NAO) will discontinue sending emails to contractors for authorization decision updates. Industry is reminded to check OBMS for status updates and copies of the authorization decision supporting artifacts.
DSS makes SCAP content available to industry via OBMS
By RMF | Feb. 23, 2017

The DSS NISP Authorization Office (NAO), in collaboration with the Defense Information Systems Agency and the Space and Naval Warfare Systems Command, has made the Security Content Automation Protocol (SCAP) Compliance Checker available to industry via OBMS. Installation files for the SCAP Compliance Checker are posted in the "ODAA Bulletin Board" section of OBMS for all supported operating systems. For additional information, please view the updated SCAP Job Aid posted on the DSS Risk Management Framework website. Applying for sponsorship through MAX.gov is no longer necessary as all PKI-protected SCAP content is available within OBMS.

If you have questions or concerns, please contact your assigned Information Systems Security Professional (ISSP). If you encounter issues accessing the SCAP content on OBMS, contact DSS NAO at dss.quantico.dss-hq.mbx.odaa@mail.mil.

DSS Automated System Security Plan (SSP)
By RMF | Jan. 23, 2017
On January 23, 2017, DSS has released the new System Security Plan (SSP) template in Excel format for RMF plan submissions.
DSS & NISP Partners Transition To Risk Management Framework
By RMF | Sept. 29, 2016

Effective October 3, 2016, all NISP partners and cleared industry will transition to Risk Management Framework. All expiring accreditations and requests of new accreditations for stand-alone systems must be submitted to DSS using RMF guidelines.

The DSS RMF is promulgated in the DSS Assessments and Authorization Process Manual (DAAPM). The DAAPM provides guidance, templates, security controls, System Security Plan (SSP) Templates and other artifacts necessary for the RMF transition and necessary to meeting mandated implementation timelines.

This RMF Information and Resource center provides implementation guidance and procedures for the management of all facilities, networks and systems under DSS cognizance. Contact your regional Authorizing Official (AO) with questions.

DSS Authorization and Assessment Process Manual (DAAPM) Release
By RMF | Aug. 25, 2016
The release of the DAAPM begins our transition of the National Industrial Security Program (NISP) Certification and Accreditation (C&A) process to Risk Management Framework (RMF). This transition will align our authorization process for cleared Industry’s classified systems with other Federal Agencies, the Intelligence Community and the Department of Defense. The intent of RMF is to improve information security, improve our risk management processes and to promote reciprocity.