Dear Dr. RMF,
I work in an Army program and I feel like I am getting the hang of RMF, but when the heck do I schedule an independent assessment (SCA-V)?
Show Me the SCA-V
Dear Show Me the SCA-V,
When determining when to schedule a SCA-V assessment you’ll want to take several things into consideration. First you need to know when your current ATO expires. Next you’ll need to know a ballpark timeframe when your team will be ready for the assessment, but you’ll have to know this early enough in advance to get on the schedule. The SCA-V teams stay busy so expect to schedule several months prior to when you want the assessment done. Last but not least, make sure you have a budget in place for the SCA-V assessment!
Dear Dr. RMF,
I am a new doctoral student that is having a hard time nailing down a research topic. I work as an Information Systems Security Officer (ISSO) within the DoD, and I have experience with the RMF. I’m currently pursuing the Doctor of Information Technology degree with a specialization in Information Assurance and Cybersecurity. I have tried to find a research topic that focuses on RMF, but I have not been successful. Could you recommend a research topic within RMF? Any help would be greatly appreciated.
Elusive Research Topic
Dear Elusive Research Topic,
I feel your pain on this one as I was in your shoes not long ago. First off, you’ve probably already observed that not very much peer reviewed research has been done on RMF. The lack of research makes literature reviews challenging, but it also provides evidence of a significant gap in research. When I was trying to figure out my own dissertation topic, I even went as far as asking Dr. Ron Ross if he knew of any peer-reviewed RMF research. Dr. Ross emailed me back relatively quickly and indicated that he was not familiar with any peer reviewed research on the implementation of RMF.
Taking this all into consideration, I suggest thinking about the aspects of RMF that intrigue you or even frustrate you.
Once you’re zeroed in on a broad topic, start thinking about whether you are interested in qualitative or quantitative methods (don’t be scared of statistics), and establish your variables. Once that groundwork is done, you should have the general direction of your research topic.
Overall, you’re going to be spending a lot time analyzing the variables you select, so I suggest they are something that you are really passionate about. Also, don’t be shy about data collection. One of my biggest regrets of my dissertation research was not collecting enough varied data. If I had collected more data, I think I could publish more than a few articles from my data collection.
Good luck! Keep your eyes on the prize.
