First, the boundary
Everything inside the boundary gets assessed, documented and evidenced, so we agree on it before anything else. FISMA calls it the authorization boundary; CMMC calls it the assessment scope.
We prepare companies for FedRAMP, CMMC and FISMA assessments
Automata is a team of security engineers in Arlington, Virginia. We check your system against the controls your program requires, fix what falls short with your engineers, and write the System Security Plan and policies your assessor will read.
- CMMC Phase 2 suspended
- Phase 1 still applies: you assess yourself against NIST SP 800-171, and the Department of War (DoW) will run some assessments of its own.
- Prepare your self-assessment
What your provider covers
Physical security of the data center is the usual example. Where your cloud provider’s own assessment covers a control, your SSP records it as inherited.
e.g. PE-3, PE-6
What you share with the provider
The provider secures the platform and you configure it. Their customer responsibility matrix says which part of each control is yours.
e.g. SC-7, SC-28
What is yours
Accounts, application settings and how data is handled stay with you, even on a FedRAMP-certified service. Assessors test them directly.
e.g. AC-2, IA-2(1)
How an assessment works
Here is one example finding, privileged accounts without multi-factor authentication, followed from scoping to a verified fix.
Multi-factor authentication for privileged accounts
- Scope
- Review
- Prioritize
- Fix and retest
Status Not started
Scope
We list every system and service inside the boundary, and what each provider covers.
Review
We test each control against the live configuration, and ask your team how it is run day to day.
Prioritize
Every gap gets a risk rating and an owner, so the riskiest ones close first.
Fix and retest
We build the fix with your engineers, then test it again before it goes into the evidence package.
What we do
You can hire us for one gap assessment, or keep us through the fixes, the independent assessment and the monitoring afterward.
Gap assessment
We test your system control by control against NIST SP 800-53 or SP 800-171, depending on the program. Each finding names the control it fails.
Advisory servicesProgram selection and documentation
We work out which program and level apply to you, write the documents your assessor reviews, and prepare the people who will be interviewed.
Public-sector programsCloud and Microsoft 365 engineering
Landing zones, Zero Trust and network segmentation on AWS, Azure and Google Cloud, including their government regions, and Microsoft 365 moves to GCC High. We build with your engineers, in code where we can.
Engineering servicesSecurity operations
A virtual CISO to run the program, engineers who work as your IT and security team, and the monthly continuous monitoring that follows an authorization.
Operations servicesCheck your own system
Free tools built from the rule text. They run in your browser and send nothing to us.
Nethos
Your inventory, with the network paths attached.
An inventory that records how every asset is reached, so you can show what the internet can touch. Built to align with FedRAMP 20x reachability requirements.
More about Nethos