Automated Software Assessment & Monitoring Tool (TRACER)

AFWERX Autonomy Prime (AFRL/RGP) aims to create a rapid autonomy testing and transition capability and to remove roadblocks that prevent rapid, affordable, and iterative testing of autonomy in aircraft. Autonomy Prime will solve this problem by providing an agile enterprise cloud environment that enables rapid delivery of information systems and applications on par with industry's most advanced technology and practices. This would enable a premier software architecture for Autonomy and the Replicator program, available to all branches of the Department of Defense (to include the US Space Force) and services hundreds of individual systems deployed within its boundaries. In addition to the technical challenges of deploying, maintaining, and scaling these systems, Autonomy Prime also faces the challenge of how to maintain Cybersecurity and Risk Management compliance for their own and their customer's system accreditations. Traditionally, it takes 12-18 moths and over $2 million dollars for the average system to satisfy their compliance requirements and achieve Authority to Operate (ATO). The scale of Autonomy Prime's future operations precludes the use of this antiquated and resource-heavy approach so a new approach is needed.  Rise8 will support Autonomy prime by developing Tracer, a Cybersecurity and Risk Management compliance platform that automates the testing and documentation of Autonomy Prime as well as customer system compliance elements. Not only will an automated platform virtually eliminate the manual workload placed on Autonomy Prime personnel, it will enable the automated inheritance of compliance data so that Autonomy Prime customers can streamline the creation and management of their ATO packages as well.  Tracer will utilize the Open Security Controls Assessment Language (OSCAL) in order to easily communicate with external systems that support the greater RMF automation effort. Tracer will integrate with GitHub to regularly pull control data directly from the NIST repository, and can push completed packages directly to eMASS without the need for any human input. It will also break down the monolithic RMF control set into subsets that are much easily digestible and inheritable. This will cut out the majority of the burden placed both on Autonomy Prime system managers as well as development teams that utilize the Autonomy Prime services.  This solution will significantly accelerate the pace at which new capabilities can be deployed to operational environments while simultaneously reducing the overall cost of acquisition and sustainment. As a result, Information systems across the DoD will be more timely, responsive, and secure.