Skip to content
Daniel TorresConnect

Case study 01 · Delta engine for eMASS artifacts

PARALLAX

See exactly what moved between two versions of a security package.

v0.13 · offline build · eight engines

Film shows PARALLAX comparing two synthetic Control Information Exports.

01Program challenge

An authorization package changes every week. Control information, test results, POA&Ms, STIG checklists, the SRTM and ACAS scans all move independently. Finding what changed between two exports meant opening both side by side and reading hundreds of rows.

A status that flips without anyone noticing, or a narrative edit that slips through, can reach an assessor or an authorizing official unreviewed. Leadership needs the drift itself, explained, not two raw exports.

02Leadership decision

Requirements
Started with one mode, two Control Information Exports keyed on Control ID, then expanded to test results, POA&Ms and checklist-to-CCI mapping as the team’s needs became clear.
Stakeholders
Built for the assessment and authorization team, the security manager and the leadership audience that receives the brief.
Trade-off
Chose a single offline file over a hosted application, giving up shared state in exchange for use on controlled data with no infrastructure.

Key decisions

Join on the identifier each export already uses

Control Acronym, AP Acronym, POA&M Item ID, CCI, host plus plugin. Row order never matters, so re-sorted exports still compare cleanly.

Match columns by header name, not position

eMASS template revisions move columns. Matching by name keeps the engine working across revisions.

Separate real change from formatting noise

Whitespace and line-break differences can be ignored, so reviewers spend their time on substantive edits.

Nothing leaves the browser tab

Strict CSP, no network calls and no telemetry, so the tool can be used on controlled data without a new authorization of its own.

03Engineering solution

  • Eight compare engines in one offline page: Control Info, Test Results, POA&M, STIG Mapper, SRTM Coverage, ACAS Scans, POA&M Generator and a PowerPoint Drift Brief.
  • A single drop zone that detects each file type and routes it to the right engine.
  • Field-level change detail, a family-by-family coverage map, and status movement matrices for implementation and compliance.
  • Exports: a delta workbook, a baseline workbook in the export’s own layout, and a native .pptx drift brief.
  1. Step 1

    Load the older and newer export

  2. Step 2

    Choose which sections and fields to compare

  3. Step 3

    Review counts, coverage map and field changes

  4. Step 4

    Export the delta workbook or the drift brief

04Operational impact

A reviewer sees changed, removed and added controls in seconds, then drills into the exact field that moved and its before and after values.

The drift brief turns the same comparison into a leadership-ready slide without a second round of manual work.

A start screen of comparison modes lets each user pick a task and upload only what it needs.