Implementation Roadmap

This roadmap turns the template documents into implementation work. Sequence the work by evidence value: first prove the boundary and baseline, then automate evidence, then close deeper control gaps.

Phase One: Package Foundation

Work Item	Outcome	Owner	Exit Criteria
Confirm ATO path	Agency Authorization path is documented.	System Owner	Sponsor, AO, ISSO, and package owner are named.
Complete FIPS 199	Baseline is justified.	Security	Confidentiality, integrity, and availability impacts are approved.
Draw boundary and data flows	Assessment scope is clear.	Platform Engineering	Boundary diagram and data-flow diagram are reviewed.
Build initial POA&M	Known gaps are visible.	Security	Every open gap has owner and due date.
Assign document owners	Drafts can mature into controlled artifacts.	System Owner	Each file in this folder has owner and reviewer.

Phase Two: Evidence Automation

Work Item	Outcome	Owner	Exit Criteria
Add SBOM generation	Every release has dependency inventory.	Platform Engineering	Syft emits CycloneDX or SPDX artifact.
Add artifact signing	Releases are attributable and verifiable.	Platform Engineering	cosign signs release images or artifacts.
Add provenance	Builds can be traced to source and workflow.	Platform Engineering	SLSA or in-toto attestation is retained.
Add secret scanning	Secrets are blocked before merge.	Security	gitleaks or equivalent runs in CI.
Add vulnerability scanning	Findings are repeatable and triaged.	Security	Trivy, Grype, or OSV reports are retained.
Add ConMon issue template	Monthly review is repeatable.	Security	First monthly package is produced from real artifacts.

Phase Three: Kubernetes and Runtime Controls

Work Item	Outcome	Owner	Exit Criteria
Add Kyverno policies	Admission controls enforce baseline expectations.	Platform Engineering	Policy reports show pass and fail states.
Run kube-bench	Cluster hardening is measured.	Platform Engineering	CIS report is attached to ConMon package.
Add runtime detection	Suspicious runtime behavior creates alerts.	Operations	Falco or equivalent alerts are tested.
Add network policies	Workloads are segmented.	Platform Engineering	Default-deny and explicit allow policies are reviewed.
Verify Argo CD evidence	Deployments are traceable.	Platform Engineering	Sync history is retained with release records.

Phase Four: Access, Audit, and Data Protection

Work Item	Outcome	Owner	Exit Criteria
Select identity pattern	Authentication and MFA path is clear.	Security	IdP, MFA, and privileged-access policy are documented.
Define role matrix	Authorization and least privilege are reviewable.	Application Engineering	Roles, permissions, owners, and review cadence are approved.
Implement access reviews	Stale and excessive access are controlled.	Security	First review issue is closed with evidence.
Define audit schema	Security events are consistent.	Application Engineering	Audit schema is implemented and tested.
Confirm retention	Audit and backup retention are defensible.	Operations	Retention settings are exported.
Confirm FIPS posture	Crypto claims are accurate.	Platform Engineering	Module validation or inherited evidence is linked.

Phase Five: Assessment Readiness

Work Item	Outcome	Owner	Exit Criteria
Convert SSP draft	Official template has real implementation statements.	Security	SSP sections are filled from template docs.
Build control evidence index	Assessors can find artifacts quickly.	Security	Each control points to evidence location.
Run mock assessment	Gaps are found before 3PAO testing.	Security	Findings are added to POA&M.
Freeze assessment scope	Boundary, version, and services are stable for testing.	System Owner	Scope change process is active.
Prepare 3PAO package	Assessment can start.	Security	SSP, POA&M, inventory, scans, diagrams, and policies are ready.

Definition of Ready for 3PAO

• FIPS 199 is approved.
• Boundary diagram and data-flow diagrams are approved.
• SSP draft is complete in official template format.
• Control matrix has no unowned rows.
• Monthly ConMon package exists.
• POA&M is active and current.
• CI/CD produces scan reports, SBOM, signature, and provenance.
• Access review evidence exists.
• Incident and contingency exercises have evidence.
• Inherited controls have provider package evidence.

Near-Term Backlog

Priority	Backlog Item	Why It Matters
1	Complete 02-fips-199-and-boundary.mdx.	All baseline decisions depend on it.
2	Fill 04-control-implementation-matrix.mdx with real owners and statuses.	Prevents vague control claims.
3	Add CI evidence tools from 10-ato-tooling-overview.mdx.	Fastest path to repeatable evidence.
4	Create first ConMon issue using 05-evidence-and-conmon-plan.mdx.	Proves monthly operations before assessment.
5	Move every open gap into 06-poam-and-risk-register.mdx.	Makes readiness work trackable.