-: In this lesson, we're going to talk about timelines 2 2
because up to this point we haven't really talked about 3 3
how long does it take to get a package 4 4
through the RMF process. 5 5
Now, I told you that there's only seven steps 6 6
to the RMF process, and while that's true 7 7
those steps aren't equal in length. 8 8
For example, preparation might only take you a week or two, 9 9
but when you start getting 10 10
to something like the authorizing official in step six, 11 11
this can actually take you weeks or months. 12 12
In fact, when you're looking at the total amount of time 13 13
required to get a package through RMF, 14 14
it actually is going to vary 15 15
depending on a lot of different factors. 16 16
One of those is the size of the system 17 17
you're trying to get through the process. 18 18
We talked before about setting your authorization boundary. 19 19
If your boundary is set too large, 20 20
that means there's a lot of system elements 21 21
and possibly a lot of subsystems 22 22
that are going to be part of this overall system, 23 23
and that adds to the time and expense of going through RMF. 24 24
On the other hand, 25 25
if you have a very small authorization boundary 26 26
that's going to reduce 27 27
what is considered included in that system, 28 28
and that can help speed up your process 29 29
as you're going through RMF. 30 30
But even beyond the size of the system, 31 31
there are many other factors 32 32
that can either increase or decrease 33 33
the amount of time it takes to go through the RMF process. 34 34
For example, in the past I've worked on some systems 35 35
that were considered so critical to the war fighter 36 36
during an active war, 37 37
that we are able to push it through the RMF process 38 38
extremely quickly, 39 39
because everybody who's working on that package knew 40 40
that that thing had to get out to the field 41 41
as quickly as possible. 42 42
Now, that being said, 43 43
we still had to go through all of the different steps. 44 44
What we did, though, was we started greasing the skids 45 45
by talking to people ahead of us in the process, 46 46
to make sure that when the paperwork got to them 47 47
they were ready to execute that paperwork immediately, 48 48
and not letting it sit in their inbox 49 49
for a couple of weeks before they looked at it. 50 50
Now, I know that sounds kind of funny 51 51
but that is the truth, 52 52
a lot of times the paperwork is actually held up 53 53
because it's just sitting in somebody's queue, 54 54
and until you get them to actually take a look at it 55 55
they won't even be able to tell you 56 56
whether you did it right or wrong, 57 57
and so a lot of this comes down to having good soft skills. 58 58
I know we're all IT and cyber security people 59 59
and we think that soft skills don't matter sometimes, 60 60
but I will tell you they really, really do. 61 61
As I said, the normal timeline for this process 62 62
is going to be anywhere from 12 to 24 months, 63 63
but in the past I was able to get an RMF project through 64 64
in only five months, 65 65
and that was considered lightning fast for an RMF 66 66
for a system of that size. 67 67
How did I do it? 68 68
Well, I did it by using my soft skills 69 69
to ethically influence the time to completion 70 70
for this process. 71 71
Now, what I mean by that is, 72 72
when you're going through this process of RMF, 73 73
oftentimes you can influence 74 74
who the package is going to go through. 75 75
There's lots of different approvers 76 76
inside of large organizations, 77 77
and the organization I was in at the time, 78 78
we had five different approvers. 79 79
Well, I knew that approver number one 80 80
was actually really quick 81 81
and they were really motivated to do good work, 82 82
and do it fast because they were trying to get a promotion. 83 83
And at the same time, 84 84
I knew that authorizing official number five 85 85
basically had a couple of months until retirement 86 86
and they were just biding their time, 87 87
and so they were trying to do as little work as possible. 88 88
And so I knew if my package 89 89
ended up in the queue for authorizing agent number five 90 90
I was going to be waiting a long time, 91 91
so I went to the authorizing official number one 92 92
and I said, "Hey, I've got this package. 93 93
I've got a strict deadline, I have to get this done 94 94
and approved before six months from now. 95 95
Can you help me?" 96 96
And they said, "Sure, I'll go ahead 97 97
and pull it into my queue as soon as I see it as pending." 98 98
And so, as soon as I hit the submit button in the tool 99 99
it went into the pending queue, 100 100
and within about 10 minutes after that 101 101
it was assigned to authorizing official number one. 102 102
Now, did that mean they were going to look the other way 103 103
and push my package through 104 104
without doing their due diligence? 105 105
No, of course not, 106 106
they still did everything that needed to be done. 107 107
The only difference was, 108 108
as they looked at the 10 things in their queue, 109 109
they put mine to the number one position 110 110
and they put everybody else down 111 111
from number two through number 10, 112 112
and they got to wait a little bit longer 113 113
because my package was more important in this case. 114 114
So, my point in telling you this 115 115
is to realize that RMF can be a very long process, 116 116
after all, this is the federal government we're dealing with 117 117
and a lot of times things will simply sit 118 118
in people's cues along the way. 119 119
So, if you've done your preparation step 120 120
and you've done your categorization step, 121 121
and now you're trying to select the controls, 122 122
well, you may not be well suited to do that 123 123
and you may have a system administrator 124 124
who's going to be working with you on this, 125 125
but this isn't their full-time job 126 126
they've got a million other things they're doing 127 127
as a system administrator. 128 128
How do you get them to give you the attention you need? 129 129
Well, a lot of that is going to come down to soft skills. 130 130
So, as you start working through this process, 131 131
it's incumbent on you 132 132
to push your package through the process 133 133
that means you're constantly going 134 134
and looking at where is your package, what's holding it up, 135 135
and what is the next roadblock that you need to remove 136 136
to keep it moving through the process? 137 137
If you don't do that 138 138
it is very common to see packages that take 12, 18 139 139
or 24 months to go through the RMF process, 140 140
and you don't want that to happen 141 141
to your system or your package, 142 142
because now your system is going to be delayed 143 143
in terms of getting it fielded, 144 144
and that means nobody's able to use your system 145 145
and get the benefits that we want from that system, 146 146
which is the whole reason we built that system 147 147
in the first place. 148 148
So, keep in mind, when you're dealing with RMF 149 149
it can be a long process, it can be drawn out 150 150
but you can help speed that up by using your soft skills, 151 151
greasing the skids, and working across your organization 152 152
to make sure that as that package is moving 153 153
from step one to two, to three, to four, 154 154
to five, to six, to seven, 155 155
it continually moves through the process 156 156
and doesn't get stagnant sitting in somebody's inbox 157 157
for three or four months before they look at it. 158 158
And then when they look at it, they go, 159 159
"Oh, you missed something and kick it back to you," 160 160
and then you have to start that step over 161 161
and then resubmit it to that same person again. 162 162
So, remember, always use your soft skills 163 163
and keep those packages moving through the process, 164 164
by doing this you can get your RMF time down 165 165
to six to 12 months instead of the normal 12 to 24 months 166 166
as it moves its way through the process.