ATO Template Library.
Sources coming soon.

Secure By Design, from JSIG Tasks 2-2 and 3-2; NIST SP 800-53 Rev. 5 Release 5.2.0, SP 800-53A and SP 800-53B (NIST OSCAL data) · RMF S-1, S-2, I-2, A-3

All 1,014 Rev. 5 controls and enhancements with NIST's baseline marks and SP 800-53A methods, plus columns to record the CNSSI 1253 baseline, overlays, tailoring rationale, implementation and assessment result. A summary sheet counts status and results as you fill it in.

Secure By Design, from JSIG Task 5-1; CDSE POA&M Job Aid field names; NIST SP 800-30 risk scale · RMF A-6, M-3

Standard POA&M columns, one row per milestone, with the JSIG minimum (tasks, resources, milestones with percentage complete, scheduled dates) and a summary sheet.

Secure By Design, from JSIG sections 1.5.13 to 1.5.15; DCSA ISSM appointment letter layout · RMF P-1

Three memoranda, one page each, with the duties the JSIG assigns each role, who appoints them, and an acknowledgment block.

Secure By Design, from JSIG CM-3, CM-7 and CM-8 · RMF P-10, I-2

A hardware list with the JSIG CM-8 minimum fields and an approved software list (deny-all, permit-by-exception), each with CCB approval and integrity-check columns.

Secure By Design, from JSIG RMF Step 6 and CA-7; NIST SP 800-53 Rev. 5 CA-7; NIST SP 800-137 · RMF S-5, M-2, M-5

Roles, metrics, monitoring and assessment frequencies, analysis, reporting and change handling, organized by CA-7 a to g, with fill-in tables.

Secure By Design, from JSIG CM-2, CM-3, CM-4, CM-7, CM-8 and CM-9; NIST SP 800-53 Rev. 5 CM-9; NIST SP 800-128 · RMF I-1, M-1

Roles, configuration items, baselines, the CCB and the JSIG's site rules, a six-step change process with a worked change request, compliance monitoring and plan approval.

Secure By Design, from JSIG AC family; NIST SP 800-53 Rev. 5 AC family (51 controls) and SP 800-53B; NIST SP 800-46 Rev. 2 · RMF S-4, I-1, I-2

Roles, account types with a worked Tier 0 example, least-privilege and session settings, every AC control with its baseline, and plan approval.

Secure By Design, from JSIG AT family; NIST SP 800-53 Rev. 5 AT family (7 controls) and SP 800-53B; NIST SP 800-50 Rev. 1 · RMF S-4, I-1, I-2

Roles, training by audience with a worked all-users row, training records, every AT control with its baseline, and plan approval.

Secure By Design, from JSIG AU family; NIST SP 800-53 Rev. 5 AU family (28 controls) and SP 800-53B; NIST SP 800-92 · RMF S-4, I-1, I-2

Roles, the event list with a worked sign-in example, review, retention and protection, every AU control with its baseline, and plan approval.

Secure By Design, from JSIG CA family; NIST SP 800-53 Rev. 5 CA family (14 controls) and SP 800-53B; NIST SP 800-37 Rev. 2; NIST SP 800-53A Rev. 5 · RMF A-1, A-2, A-3, A-6, M-2

Roles, the assessment schedule with a worked initial assessment, interconnection and POA&M decisions, every CA control with its baseline, and plan approval.

Secure By Design, from JSIG CP family; NIST SP 800-53 Rev. 5 CP family (38 controls) and SP 800-53B; NIST SP 800-34 Rev. 1 · RMF S-4, I-1, I-2

Roles, recovery objectives with a worked directory example, backups and restore testing, every CP control with its baseline, and plan approval.

Secure By Design, from JSIG IA family; NIST SP 800-53 Rev. 5 IA family (29 controls) and SP 800-53B; NIST SP 800-63-4 · RMF S-4, I-1, I-2

Roles, identifiers and authenticators with a worked privileged-user row, device and service authentication, every IA control with its baseline, and plan approval.

Secure By Design, from JSIG IR family; NIST SP 800-53 Rev. 5 IR family (19 controls) and SP 800-53B; NIST SP 800-61 Rev. 3 · RMF S-4, I-1, I-2

Roles, incident categories and reporting with a worked spillage example, response steps and testing, every IR control with its baseline, and plan approval.

Secure By Design, from JSIG MA family; NIST SP 800-53 Rev. 5 MA family (13 controls) and SP 800-53B · RMF S-4, I-1, I-2

Roles, the maintenance schedule with a worked host example, tool and personnel rules, every MA control with its baseline, and plan approval.

Secure By Design, from JSIG MP family; NIST SP 800-53 Rev. 5 MP family (11 controls) and SP 800-53B; NIST SP 800-88 · RMF S-4, I-1, I-2

Roles, media handling with a worked transfer-media row, sanitization and destruction, every MP control with its baseline, and plan approval.

Secure By Design, from JSIG PE family; NIST SP 800-53 Rev. 5 PE family (30 controls) and SP 800-53B · RMF S-4, I-1, I-2

Roles, physical access by area with a worked server-room row, environmental protections, every PE control with its baseline, and plan approval.

Secure By Design, from JSIG PL family; NIST SP 800-53 Rev. 5 PL family (9 controls) and SP 800-53B; NIST SP 800-18 Rev. 1 · RMF S-4, I-2

Roles, the plans the package relies on with a worked SSP row, signed rules of behavior, every PL control with its baseline, and plan approval.

Secure By Design, from JSIG PM family; NIST SP 800-53 Rev. 5 PM family (32 controls) and SP 800-53B; NIST SP 800-39 · RMF P-1, P-2, P-3

Organization-level roles and resources with a worked example, program measures, every PM control (SP 800-53B assigns them to the organization, not a baseline), and plan approval.

Secure By Design, from JSIG PS family; NIST SP 800-53 Rev. 5 PS family (10 controls) and SP 800-53B · RMF S-4, I-1, I-2

Roles, position risk and screening with a worked administrator row, transfers and terminations, every PS control with its baseline, and plan approval.

Secure By Design, from JSIG PT family; NIST SP 800-53 Rev. 5 PT family (8 controls) and SP 800-53B; NIST SP 800-122; NIST Privacy Framework · RMF S-4, I-1, I-2

Roles, the PII inventory with a worked directory row, notice and consent, every PT control with a pointer to the SP 800-53B privacy baseline, and plan approval.

Secure By Design, from JSIG RA family; NIST SP 800-53 Rev. 5 RA family (14 controls) and SP 800-53B; NIST SP 800-30 Rev. 1 · RMF P-14, C-2, A-5, M-2

Roles, categorization and risk assessment decisions, vulnerability monitoring with a worked scan row, every RA control with its baseline, and plan approval.

Secure By Design, from JSIG SA family; NIST SP 800-53 Rev. 5 SA family (24 controls) and SP 800-53B; NIST SP 800-160 Vol. 1 Rev. 1 · RMF S-4, I-1, I-2

Roles, acquisition requirements with a worked licensing row, supported components, every SA control with its baseline, and plan approval.

Secure By Design, from JSIG SC family; NIST SP 800-53 Rev. 5 SC family (57 controls) and SP 800-53B; NIST SP 800-41 Rev. 1; NIST SP 800-52 Rev. 2 · RMF S-4, I-1, I-2

Roles, permitted paths with a worked VLAN example, transmission and key management, every SC control with its baseline, and plan approval.

Secure By Design, from JSIG SI family; NIST SP 800-53 Rev. 5 SI family (38 controls) and SP 800-53B; NIST SP 800-40 Rev. 4; NIST SP 800-83 Rev. 1 · RMF S-4, I-1, I-2

Roles, flaw remediation and malicious code with a worked update row, monitoring and integrity checks, every SI control with its baseline, and plan approval.

Secure By Design, from JSIG SR family; NIST SP 800-53 Rev. 5 SR family (16 controls) and SP 800-53B; NIST SP 800-161 Rev. 1 · RMF S-4, I-1, I-2

Roles, supply chain risks and controls with a worked hardware row, authenticity checks and disposal, every SR control with its baseline, and plan approval.