The Enterprise Mission Assurance Support Service (eMASS) is a government-owned, web-based application used by the U.S. Department of Defense (DoD) and other federal agencies to manage and automate the process of assessing, authorizing, and maintaining the cybersecurity posture of IT systems.
Its primary purpose is to serve as the official repository and management tool for the Risk Management Framework (RMF), which is the process used to grant an Authorization to Operate (ATO) for any system connected to the DoD's Global Information Grid (GIG).
By automating and standardizing RMF procedures, eMASS provides a centralized, enterprisewide view of cybersecurity compliance, enhancing situational awareness and mitigating risk across the vast DoD and its contracting partners.
The core functions of eMASS
1. Automation of the Risk Management Framework (RMF)
The RMF is a rigorous, six-step process for managing cybersecurity risk within the federal government. eMASS is designed to guide users through these steps in a structured, efficient manner, automating much of the documentation and workflow.
The RMF steps within eMASS include:
- Categorize: System owners use eMASS to categorize an information system based on the potential impact of a security breach, which determines the baseline level of security controls required.
- Select Controls: The application automatically selects the baseline security controls from NIST Special Publication 800-53 based on the system's impact level. Users can then tailor and customize these controls to fit their specific system architecture.
- Implement: System security practitioners document how each control is implemented. eMASS serves as a repository for all related artifacts, such as policies, procedures, and architectural diagrams.
- Assess: Security Control Assessors (SCAs) use eMASS to validate and test the implemented security controls. The tool stores test results and tracks findings to ensure compliance.
- Authorize: The Authorizing Official (AO) reviews the security authorization package within eMASS, which contains the system security plan, assessment report, and a Plan of Action and Milestones (POA&M). The AO uses this information to make a risk-based decision to issue an ATO.
- Monitor: After receiving an ATO, eMASS supports continuous monitoring by tracking system changes, vulnerability data, and other risk factors to ensure the system remains compliant.
2. Centralized repository for cybersecurity data
eMASS serves as the authoritative source for all cybersecurity compliance data for a given system. This centralization allows for clear, enterprisewide visibility into security posture and standardizes how information is stored. Key functions include:
- Asset management: The tool's Asset Manager allows system owners to record detailed information about hardware, software, and network devices, and to upload vulnerability scans and Security Technical Implementation Guide (STIG) checklists.
- Vulnerability tracking and POA&M: eMASS automatically correlates vulnerabilities found by scanning tools, mapping them to specific security controls. This data populates a Plan of Action and Milestones (POA&M), which tracks and prioritizes security weaknesses that need to be addressed.
- Inheritance: Systems can inherit security controls from other authorized systems or common controls, reducing duplicate effort and providing a clearer view of the enterprise's security architecture.
3. Integrated collaboration and workflow management
Cybersecurity compliance is a collaborative process involving many roles, from system owners and engineers to security assessors and authorizing officials. eMASS automates the workflow between these different user roles, ensuring clear communication and a consistent process. It provides a single platform for geographically dispersed teams to coordinate their efforts on security assessments.
4. Enterprise-level reporting and dashboards
To support decision-making, eMASS generates a variety of reports and dashboards that provide stakeholders with a comprehensive view of the organization's security posture. This includes reporting on the monthly SECDEF Cybersecurity Scorecard metrics and other reports required by RMF and FISMA. These reports enable managers to readily identify vulnerabilities, track progress on remediation, and make informed decisions about cybersecurity resources.
The significance of eMASS for the DoD and cleared contractors
The use of eMASS is not optional for most DoD organizations and their contractors. For cleared industry partners working within the National Industrial Security Program (NISP), the Defense Counterintelligence and Security Agency (DCSA) maintains a specific instance of eMASS to manage RMF compliance. The tool's impact includes:
- Strengthening the DoD's cybersecurity posture: By enforcing a strict, auditable process for obtaining an ATO, eMASS reduces the risk of cyberattacks and helps secure the military's information systems and networks.
- Increasing efficiency: The automation features of eMASS streamline the laborious compliance process, reducing the time and resources required to achieve and maintain an ATO. This allows cybersecurity personnel to focus more on security and less on paperwork.
- Ensuring mission assurance: The "Mission Assurance" in its name refers to the confidence that a system will perform its intended function in the face of cyber threats. By properly enforcing RMF, eMASS helps guarantee the reliability and security of IT systems vital to military and government operations.