From Months to Minutes: Transforming Cyber Security Assessments with Generative AI

This project aims revolutionize the Department of the Air Force’s (DAF) approach to the Risk Management Framework (RMF). By automating RMF compliance procedures, documentation, risk assessments, and monitoring, Ask Sage addresses critical gaps in cybersecurity governance, enhancing mission assurance while significantly reducing cost and time investments. The platform will integrate with eMASS, either through direct API integration or by allowing users to upload exported packages, to streamline the assessment of RMF artifacts such as System Security Plans (SSP), Security Assessment Reports (SAR), Plans of Action and Milestones (POA&M), and security test results. Key capabilities of Ask Sage include automated document analysis, intelligent control validation, risk analysis, continuous monitoring integration, POA&M management, and risk mitigation planning. The platform will leverage AI-powered parsing agents, GenAI, and AI-driven risk scoring to ensure compliance with security controls and identify gaps or inconsistencies. Additionally, the system will feature a security policy and standards knowledge base, a GenAI-driven RMF knowledge assistant, and explainability and auditability features to maintain transparency and accountability. The project will be executed over a 12-month period, starting with a kickoff call and followed by requirements gathering, system design, API integration feasibility study, development of core modules, continuous monitoring integration, and user interface development. The final phase will include user training, documentation, and project closure.