How to NOT burn out your Cyber staff when going through Accreditation
TLDR; do not make your smart Cyber people do Excel wizardry, documentation galore, and be paper pushers. Automate tasks so they can use their skills and brain more. Easy to say, hard to do — or is it? We show the problems and offer some solutions in this article. And ask you to prove us wrong!
The Problem
When you are going through an accreditation, whether it be RMF or FedRAMP or one of the other cyber compliance frameworks, it can be very stressful.
For a lot of people I know, “RMF” is a 4-letter word. Just like “ATO”. And a few other choice words uttered during those accreditations.
And if you have good, dedicated Cyber personnel that like performing a great job and doing Cyber work, then the accreditation process can be a turn off. It can even make them get burned out and look for other exciting cyber engineering type work.
The majority of issues we have seen and heard across 20+ years boils down to doing a lot of manual tasks, over and over, and pushing paper through MS Word and Excel documents. Not actual policy, procedure, cyber hygiene, or actual cyber security or cyber engineering. But doing all the paperwork.
And doing it over and over and over again. Repeatedly. It involves a lot of copy/paste hell! And reading PDFs. And the information has to be cross referenced with 3 other files (or more) every single time.
And guess what … replacing people is hard to do and expensive in general. Replacing good Cyber personnel is even harder and more expensive. And you may have spent good time and money investing in them, getting them up to where they were on knowledge and experience, and learning the organization. So it hurts a little more at that point.
We have to stop doing things like it is 1997 and use automation. Get into this century, this decade and this year!
The Solution (at least in part)
The solution specifically around RMF and FedRAMP is to use automation. And use it to the maximum extent you can. We wrote about that here in building your cyber security mesh architecture with a strong foundation in automation.
OpenRMF Professional by our company Soteria Software is specifically built with that in mind. Automation. Hyper automation. Across your whole team. Automate as much as you can from the scans you already have to do! And build your accreditation packages from that solid foundation up.
Ingest SCAP scans, checklists, patch scans, audit compliance scans, and more. Automation your plan of action and milestones (POAM) and link it to the latest data. Run reports and dashboards based on that latest data. And tie into your CSMA through the API.
Automate the tasks of tracking vulnerabilities, compliance to NIST controls and subcontrols, generating CKL and XLSX type files, and let cyber engineers do engineering! (As our value added reseller OMNI put so elequently!)
Then build in automation to scan and upload. Generate and track compliance as you go. Track continuous monitoring. And know exactly where you are based on your latest scans and updates from across your whole team.
Automate all of that as much as you can. That is how to reduce stress. Reduce blood pressure. Automate away non-value-added tasks where you can. And let your engineers, analysts, and Cyber personnel do what they are good at doing.
And where they can see for themselves how they add tremendous value!
It also keeps organizational knowledge in-house. It allows continuity and repeatability across teams. And it keeps your team in tact as much as possible by creating a more technically advanced environment around accreditation.
Where to find more
We have a lot of videos, blog articles, and other information on our website for you to learn more.
We even have a calculator to show savings in time/money/resources where you can use automation to its fullest capability. To show tangible results.
The intangible results of reducing stress, reducing anxiety, and keeping your cyber personnel and other IT personnel on-staff and keeping organizational knowledge you will have to value on your own!
Don’t just take our word for it.
Pull down a full copy to evaluate and see for yourself. Better yet, let your cyber folks and IT folks see for themselves.
