Skip to content
Daniel TorresConnect

Case study 09 · Security control lookup engine

RMF KS Engine

Every source, one control at a time.

System-neutral release

Film uses rebuilt sample workbooks with paraphrased control text. The tool’s standard banner is cropped because the data is not real.

01Program challenge

Answering “what does this control require, and what evidence proves it” meant switching between the system baseline and two RMF Knowledge Service bodies of evidence, each split into one tab per control family.

During a framework transition, every control decision needs the current authority and the historical evidence side by side, or teams re-research the same control over and over.

02Leadership decision

Requirements
Aligned the input format to the published RMF TAG bodies of evidence and to the eMASS Control Information Export the team already uses.
Stakeholders
The authorization team first, then any program that wants to use it, which is why it carries no program names.
Trade-off
Parses only the control identity, status and implementation columns of the baseline, leaving out risk and continuous monitoring data to keep the card focused.

Key decisions

The baseline drives the join

If a control is in the system baseline, every Rev. 4 and Rev. 5 row for it appears, whatever the source formatting.

Keep evidence at CCI level

Rev. 4 rows are shown in full, never collapsed, to preserve the pairing between each CCI and its evidence.

Authority is read-only

Edits apply to the baseline only and are held in memory until export, never written back to the source files.

System-neutral by design

No program names are built in. The system is named at runtime from the export’s own banner rows.

03Engineering solution

  • Loads the control baseline and both RMF Knowledge Service exports, recognizing their real layouts, including one tab per family and merged banner rows.
  • One card per control: the system’s record of state, Rev. 5 authority with assignment values, CCIs and assessment procedures, and the full Rev. 4 CCI table with compelling evidence.
  • Worklist filters for Non-Compliant, Planned, Inherited, Common or Hybrid, controls with no Knowledge Service data, and controls new in Rev. 5.
  • Editable baseline fields, reviewer notes, session backup, and a multi-sheet Excel export written without any external library.
  1. Step 1

    Load the baseline and both Knowledge Service exports

  2. Step 2

    Search a control or work a filter

  3. Step 3

    Read state, authority and evidence on one card

  4. Step 4

    Edit, annotate and export the joined workbook

04Operational impact

One card answers what a control requires, what the system says about it, and what evidence will satisfy an assessor.

Controls with no Knowledge Service data read as an export vintage gap, so teams know to pull newer data rather than question the control.

Delivered first as an Excel lookup prompt for the team, then as the full browser engine.