ATO Compliance Templates
This folder is a review workspace for FedRAMP and ATO readiness documentation. It is not an authorization package, and nothing here should be represented as FedRAMP compliant, FedRAMP authorized, or ATO approved until an agency Authorizing Official accepts the final package after assessment.
The working assumption is a cloud SaaS built on the dmwd.io preferred stack: TypeScript, React, Astro SSR, Go Fiber services, Postgres and SQLite, Kubernetes, Helm, Argo CD, GitHub Actions, OpenTelemetry, Prometheus, and @dmwd-io/design-system. Target FedRAMP Moderate unless a completed FIPS 199 categorization requires High; build technical controls in a High-ready way where doing so is practical.
How to Use This Folder
- Start with document inventory to see what each file is for.
- Fill in ATO path and assumptions before editing control claims.
- Complete FIPS 199 and boundary because it drives the baseline.
- Use SSP working outline as the narrative backbone.
- Use control implementation matrix to connect controls, owners, evidence, and tooling.
- Use ATO tooling overview to decide which open-source tools to adopt or document as inherited.
Files
| File | Purpose | Primary Output |
|---|---|---|
| 00-document-inventory.mdx | Lists the templates package and maps drafts to official FedRAMP artifacts. | Work plan |
| 01-ato-path-and-assumptions.mdx | Records authorization path, target level, stakeholders, and open assumptions. | ATO strategy brief |
| 02-fips-199-and-boundary.mdx | Captures impact categorization, authorization boundary, data flows, and inherited services. | Boundary and impact worksheet |
| 03-system-security-plan-working-outline.mdx | Drafts the SSP sections you will later transfer into the official FedRAMP template. | SSP source material |
| 04-control-implementation-matrix.mdx | Maps high-impact NIST 800-53 families to implementation, evidence, tools, and gaps. | Control traceability matrix |
| 05-evidence-and-conmon-plan.mdx | Defines monthly evidence, scan outputs, dashboards, and continuous monitoring reviews. | ConMon operating plan |
| 06-poam-and-risk-register.mdx | Defines POA&M fields, severity, remediation windows, and risk acceptance rules. | POA&M templates register |
| 07-incident-contingency-and-dr-plan.mdx | Covers incident response, backup, restore, continuity, and disaster recovery evidence. | IR and contingency plan |
| 08-secure-sdlc-and-supply-chain-plan.mdx | Covers change control, code review, security testing, SBOMs, signing, and provenance. | Secure SDLC plan |
| 09-access-audit-and-data-protection-plan.mdx | Covers identity, access reviews, audit logging, crypto, privacy, and data retention. | Access and data protection plan |
| 10-ato-tooling-overview.mdx | Lists recommended tools, links, use, evidence, and adoption priority by category. | Tooling adoption table |
| 11-implementation-roadmap.mdx | Sequences the work into near-term, next, and later implementation steps. | Readiness roadmap |
| index.mdx | Adds a Storybook-visible dashboard for the templates package. | Storybook review page |
| 12-official-fedramp-package-map.mdx | Maps local template drafts to official FedRAMP artifacts. | Official package crosswalk |
| 13-policy-library.mdx | Defines the policy set needed behind the SSP. | Policy library |
| 14-operational-procedure-library.mdx | Defines repeatable procedures that produce evidence. | Procedure library |
| 15-evidence-automation-map.mdx | Maps tools and workflows to automated evidence outputs. | Evidence automation plan |
| 16-risk-acceptance-and-ao-brief.mdx | Frames residual risk and AO decision points. | AO brief |
| 17-ato-templates-book.mdx | Combines the Storybook-visible templates pages into one read-through document. | Storybook templates book |
| 18-control-family-coverage-checklist.mdx | Checks documentation coverage across every NIST SP 800-53 family. | Coverage audit |
| 19-record-template-library.mdx | Provides repeatable templates for recurring evidence records. | Evidence record templates |
Official Templates Still Required
These Markdown files are template content. For a real FedRAMP package, transfer approved content into the current official FedRAMP templates and coordinate the assessment materials with the agency sponsor and 3PAO.
| Official Artifact | FedRAMP Role | Local Template Source |
|---|---|---|
| System Security Plan | Main system and control narrative. | 03-system-security-plan-working-outline.mdx, 04-control-implementation-matrix.mdx |
| FIPS 199 Categorization | Sets Low, Moderate, or High baseline. | 02-fips-199-and-boundary.mdx |
| Control Implementation Summary | Shows control status and responsibility. | 04-control-implementation-matrix.mdx |
| Security Assessment Plan | 3PAO assessment plan. | 04-control-implementation-matrix.mdx, 05-evidence-and-conmon-plan.mdx |
| Security Assessment Report | 3PAO findings and results. | Produced by 3PAO; use 06-poam-and-risk-register.mdx for intake. |
| POA&M | Open findings and remediation commitments. | 06-poam-and-risk-register.mdx |
| Continuous Monitoring Package | Monthly scans, inventory, POA&M, and evidence. | 05-evidence-and-conmon-plan.mdx |
| Incident Response Plan | Incident handling and reporting. | 07-incident-contingency-and-dr-plan.mdx |
| Contingency Plan | Backup, recovery, continuity, and testing. | 07-incident-contingency-and-dr-plan.mdx |
| Privacy and Data Protection Documentation | Data inventory, minimization, retention, privacy controls. | 09-access-audit-and-data-protection-plan.mdx |