Insights & Articles
Practical writing on DoD compliance, RMF, STIG management, ATO preparation, and government software development, from the team that builds this stuff for a living.
ATO & Federal Contracting
You Won the SBIR. Now What? Understanding the ATO.
A practical guide for SBIR awardees on what an Authorization to Operate means, why it matters, what the RMF process involves, and how to prepare before deployment into a government environment.
Read Article →RMF & Compliance
POA&M Automation for DoD Programs: What It Is, Why It Matters, and How to Do It Right
A practical guide to automating Plans of Action and Milestones in DoD RMF programs, what manual POA&M management costs you, and why a POA&M that is not generated from the same authorization record as your SSP and SAR will always drift away from them.
Read Article →STIG Compliance
Free STIG Tools for DoD Compliance: What They Do, Where They Fall Short
A practical look at STIG Viewer, SCC, OpenSCAP, STIG Manager and OpenRMF, what each one actually does, where each one stops, and why checklist state is not the same thing as an authorization record.
Read Article →RMF & Compliance
The Hidden Cost of Open Source Compliance Tools for DoD Programs
Open source compliance tools are free to download but not free to operate. What DoD programs actually spend when they build their RMF workflow around open source software, and the honest question you should be asking before you go that route.
Read Article →