Lifecycle guidance
NIST Risk Management Framework
SP 800-37 Rev. 2 · Final, December 2018
Use the RMF lifecycle to connect system categorization, selected controls, assessment evidence, authorization inputs and continuous monitoring.
ISSO · RMF · Assessment · Analysis
Security Work. Built Around Your Mission.
Cyber Defense Group delivers ISSO services, RMF support, security control assessment, vulnerability analysis and security policy analysis. We help mission teams keep requirements, evidence and remediation work connected.
Defined scope · Clear deliverables · Accountable follow-through
ISSO Services
Keep system security work current.Day-to-day information system security support, with clear documentation, evidence and follow-through.
Explore ServicesRMF Support
Connect requirements to evidence.Support the Risk Management Framework across preparation, categorization, control selection, implementation, assessment readiness and monitoring.
Explore ServicesSecurity Control Assessment
Make control findings traceable.Assess scoped controls using documented examination, interviews and testing, with findings tied to evidence.
Explore ServicesVulnerability Analysis
Turn findings into focused action.Analyze vulnerability information in the context of your assets, exposure and mission priorities.
Explore ServicesSecurity Policy Analysis
Make security responsibilities clear.Review security policies and procedures for gaps, consistency and alignment with applicable requirements.
Explore Services
Security documentation
Evidence-based assessment
Remediation follow-through
Cybersecurity Services
Start with a Question.
Find a Clear Answer.
Explore the documentation, assessment and analysis work that helps your team understand security requirements and act on findings.
ISSO Services
Day-to-day information system security support, with clear documentation, evidence and follow-through.
System security documentation
Maintain system security plans, control implementation statements and supporting artifacts as the system changes.
Continuous monitoring coordination
Organize evidence collection, control-owner follow-ups and recurring security status reporting.
POA&M and issue tracking
Track findings, owners, milestones and supporting closure evidence in a usable plan of action and milestones.
RMF Support
Support the Risk Management Framework across preparation, categorization, control selection, implementation, assessment readiness and monitoring.
Control and boundary documentation
Help document the system boundary, selected controls, tailoring decisions and control implementation responsibilities.
Authorization package support
Organize the system security plan, assessment inputs and remediation information for the responsible review team.
Lifecycle updates
Keep security artifacts and monitoring activities aligned with system changes and assessment results.
Security Control Assessment
Assess scoped controls using documented examination, interviews and testing, with findings tied to evidence.
Assessment planning
Define assessment objectives, methods, evidence requests and the rules of engagement with the system team.
Evidence-based assessment
Examine artifacts, interview responsible personnel and test agreed controls against applicable assessment procedures.
Findings and retest support
Document results in assessment records and reports; track remediation evidence and agreed retesting.
Vulnerability Analysis
Analyze vulnerability information in the context of your assets, exposure and mission priorities.
Finding validation
Review scan output, affected assets and available evidence to distinguish actionable findings from items needing validation.
Risk-based prioritization
Consider severity, known exploitation, exposure and business or mission impact when organizing remediation priorities.
Remediation tracking
Track owners, mitigation decisions and follow-up validation so unresolved issues remain visible.
Security Policy Analysis
Review security policies and procedures for gaps, consistency and alignment with applicable requirements.
Requirements and gap analysis
Map existing policy language to applicable organizational, agency and security-control requirements.
Policy and procedure revisions
Develop clear draft updates with defined responsibilities, review cycles and supporting procedures.
Implementation traceability
Connect policy expectations to control owners, evidence and exception or approval workflows.
ISSO Services
Day-to-day information system security support, with clear documentation, evidence and follow-through.
System security documentation
Maintain system security plans, control implementation statements and supporting artifacts as the system changes.
Continuous monitoring coordination
Organize evidence collection, control-owner follow-ups and recurring security status reporting.
POA&M and issue tracking
Track findings, owners, milestones and supporting closure evidence in a usable plan of action and milestones.
RMF Support
Support the Risk Management Framework across preparation, categorization, control selection, implementation, assessment readiness and monitoring.
Control and boundary documentation
Help document the system boundary, selected controls, tailoring decisions and control implementation responsibilities.
Authorization package support
Organize the system security plan, assessment inputs and remediation information for the responsible review team.
Lifecycle updates
Keep security artifacts and monitoring activities aligned with system changes and assessment results.
Security Control Assessment
Assess scoped controls using documented examination, interviews and testing, with findings tied to evidence.
Assessment planning
Define assessment objectives, methods, evidence requests and the rules of engagement with the system team.
Evidence-based assessment
Examine artifacts, interview responsible personnel and test agreed controls against applicable assessment procedures.
Findings and retest support
Document results in assessment records and reports; track remediation evidence and agreed retesting.
Vulnerability Analysis
Analyze vulnerability information in the context of your assets, exposure and mission priorities.
Finding validation
Review scan output, affected assets and available evidence to distinguish actionable findings from items needing validation.
Risk-based prioritization
Consider severity, known exploitation, exposure and business or mission impact when organizing remediation priorities.
Remediation tracking
Track owners, mitigation decisions and follow-up validation so unresolved issues remain visible.
Security Policy Analysis
Review security policies and procedures for gaps, consistency and alignment with applicable requirements.
Requirements and gap analysis
Map existing policy language to applicable organizational, agency and security-control requirements.
Policy and procedure revisions
Develop clear draft updates with defined responsibilities, review cycles and supporting procedures.
Implementation traceability
Connect policy expectations to control owners, evidence and exception or approval workflows.
Official Government Resources
Know the Requirement.
Use the Right Reference.
Practical starting points for ISSO, RMF, assessment, vulnerability and policy work. We establish which requirements apply to the agency, system, contract and service scope before using these references.
Planning guidance
NIST System Planning
SP 800-18 Rev. 2 · Final, June 2026
A reference for system security, privacy and supply-chain plans: system purpose, control implementation and assigned responsibilities.
Control catalog
NIST Security & Privacy Controls
SP 800-53 Rev. 5 · Release 5.2.0
Map scoped requirements and policy language to control objectives. Select and tailor controls for the system rather than treating the entire catalog as a universal checklist.
Assessment guidance
NIST Control Assessment
SP 800-53A Rev. 5 · Release 5.2.0
Plan evidence requests and examine, interview and test methods; record findings against the applicable assessment objectives.
Vulnerability and patch guidance
NIST Enterprise Patch Management
SP 800-40 Rev. 4 · Final, April 2022
Connect patch identification and prioritization to deployment planning and follow-up verification in the mission environment.
Federal cloud program rules
FedRAMP Cloud Security Resources
Consolidated Rules for 2026
Review the applicable Rev5 or 20x path, offering scope, stakeholder responsibilities and transition dates. Cloud program status and an agency’s authorization decision are distinct.
Federal standard
Federal Security Categorization
FIPS 199 · Final, February 2004
A standard for categorizing federal information and systems by potential confidentiality, integrity and availability impacts, within its defined scope.
Federal agency policy
OMB Information Resource Policy
Circular A-130 · July 2016 edition
Review agency governance, information-security and privacy responsibilities when tracing policy requirements to system procedures. Confirm current agency direction and contractual responsibilities.
Guidance, requirements and authorization have different roles.
Statutes establish legal obligations; agency policies and applicable federal standards define requirements within their scope. NIST guidance supports implementation and assessment. Contract terms, system type and agency direction determine applicability—these references are not a universal checklist.
FedRAMP’s current resources distinguish cloud-service certification from an agency Authorization to Operate (ATO). FedRAMP does not grant agency ATOs. These links describe resources used to scope work; they do not claim CDG certification, FedRAMP authorization, recognized-assessor status or government endorsement.
References checked . Versions, program rules and agency requirements can change; follow the official source for updates.
ISSO · RMF · Assessment · Vulnerability · Policy
Security Contracting & Policy.
Contracting and policy developments tied to system security work. Earlier coverage remains clearly marked as historical.
-
Derrick Coetzee / Wikimedia Commons · Image source · CC0 1.0 Universal Public Domain Dedication FedRAMP announces first full CR26-compliant 20x Class C certification
FedRAMP’s November 2 announcement reports the first full CR26-compliant 20x Class C certification, granted October 29. The milestone concerns cloud-security assessment, not an agency ATO or a contract award.
FedRAMP Source checked Nov 3, 2026 -
NOIRLab/NSF/AURA/T. Slovinský · Image source · CC BY 4.0 FedRAMP 20x Pilot Marketplace labels
From CDG’s Oct 23 company post: For contractors evaluating cloud services, that distinction matters. Check the exact offering’s current designation before relying on a vendor’s general certification claim.…
From CDG’s historical LinkedIn archive Archive checked Oct 26, 2026 -
Gail Porter/NIST · Image source · NIST public information; reuse with credit NIST leadership security handbook draft
From CDG’s Oct 23 company post: SP 800-100 Rev. 1 is an initial public draft aligned with CSF 2.0. It covers governance, risk management, incident response and continuous monitoring, helping leaders connect…
From CDG’s historical LinkedIn archive Archive checked Oct 26, 2026 -
Raysonho @ Open Grid Scheduler / Grid Engine · Image source · CC0 NIST DevSecOps draft resources
From CDG’s Oct 22 company post: NIST’s National Cybersecurity Center of Excellence is accepting feedback on updated DevSecOps project resources through November 9, 2026. Announced September 24, the material…
From CDG’s historical LinkedIn archive Archive checked Oct 26, 2026 -
Gail Porter/NIST · Image source · NIST public information; reuse with credit NIST ICT risk-governance draft
From CDG’s Oct 22 company post: Published October 22, SP 800-221 Revision 1 connects information and communications technology risk management with enterprise risk decisions and CSF 2.0’s Govern function. It…
From CDG’s historical LinkedIn archive Archive checked Oct 26, 2026 -
Trower, NASA · Image source · Public domain PHP security release advisory
From CDG’s Oct 22 company post: PHP's October 21 security release fixes CVE-2026-109618 and CVE-2026-109619 in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The vulnerabilities can allow remote code execution…
From CDG’s historical LinkedIn archive Archive checked Oct 26, 2026
Explore the latest updates
Experience Behind the Work
Cybersecurity Focus.
Practical Delivery.
Led by Lawrence Baranski III and William Hubbard III, Cyber Defense Group focuses on the work behind system security: maintaining documentation, assessing controls, analyzing vulnerabilities and turning policy requirements into clear responsibilities.
Common Questions
Cybersecurity Services
Your Questions, Answered.
What services does Cyber Defense Group provide?
We provide ISSO services, Risk Management Framework support, security control assessment, vulnerability analysis and security policy analysis. Each engagement defines the systems, responsibilities and deliverables in scope.
What can an engagement deliver?
Depending on the scope, deliverables can include updated security documentation, assessment plans and findings, evidence inventories, remediation tracking and draft policy revisions.
How do assessment and authorization responsibilities work?
Assessment scope, access and independence requirements are agreed before work begins. Authorization and risk-acceptance decisions remain with the responsible authorizing officials and system owners.
Let's Talk About Your Security Requirement
Define the Work.
Make the Next Step Clear.
Tell us which systems need support, the service area, expected deliverables and your timeline. We’ll discuss the scope and responsibilities with your team.
Discuss Your RequirementStart with your requirement, deliverables and timeline.