Odin RMF for Neuro-Symbolic Artificial Intelligence (AI) Agents for Cybersecurity ATO Development

Department of Navy (DON) and its Naval Warfare Center Training Systems Division (NAWCTSD) seek artificial intelligence (AI) to assist the cybersecurity workforce in developing and maintaining Authority to Operate (ATO) packages via the Risk Management Framework (RMF). The current RMF/ATO process is time and manpower intensive and provides few enabling technologies to ease the burden on cybersecurity personnel. Illumination Works (ILW) offers DON/NAWCTSD our Odin-Risk Management Framework (Odin-RMF) to provide AI-driven automation in executing RMF/ATO processes and generating ATO documents. Odin-RMF applies cutting edge AI techniques, including Large Language Models (LLMs) and Retrieval Augmented Generation (RAG) to input data, coupled with expert knowledge from the cybersecurity team to speed identification of baseline security controls, perform guided software risk assessments, develop security implementation guides, and generate initial text for completing ATO documents. Through the Phase I activities, ILW will determine the feasibility of Odin-RMF’s modular components in meeting DON/NAWCTSD’s need for assisted intelligence in RMF/ATO package creation as well as perform UI design and system architecture definition. ILW will experiment with LLMs, prompt engineering, and RAG constructs to identify the optimal approach to automatically identify baseline controls and generate the associated sections of one ATO document, the System Security Plan (SSP).