OpenRMF^® Professional Compliance Overlays

The Overlays area allows Administrators to create and edit compliance overlays as well as the controls for those overlays. These overlays, when added to a system package, update the SSP information produced, as well as the Compliance generated for your framework. Overlays are combined with regular framework controls and any tailoring you have done based on your framework version for tracking, listing, comparing, and generating compliance. The controls in overlays usually have updated descriptions and supplemental text showing specific instructions for that control when used within that overlay.

Listing Overlays

When you go to the Administration level Overlay screen it displays any overlays and shows the title, description, list of controls and if it is active. On the far right of each listing is the ... menu to allow editing (if this is not a default overlay) of your overlay main information.

Creating Compliance Overlays

To create a new overlay you click the Create button. You enter a title and a description, then click the Save button. The screen reloads and shows your overlay. Click the title of the new overlay to go to the Controls listing of the overlay. Here you will add 1 or more controls for the overlay from the list of all controls available.

NOTE: Once a compliance overlay is created it can be marked active or inactive, but not removed just in case others are referencing it. Only active compliance overlays are used to determine compliance generation and SSP generation in a system package.

Editing an Overlay

To edit an overlay click the linked title or the ... menu beside it and select the Edit option. From here you can edit the title and description, as well as mark it Active or Inactive. Then click the Save button. This only saves it at this site-wide level. If any person has added an application-wide overlay to their system package, it does not update that added overlay to their system package. They must edit it at the system package level.

You can only edit an overlay you have created. You cannot edit any default overlays.

Adding a Control to an Overlay

To add a control to an overlay, click the Add button. Click into the Overlay Control dropdown and start to type the control family / number into the search box. The dropdown list filters accordingly. Click the control you wish to add.

When you select the control, the default control description and supplemental text is entered into the 2 remaining textbox fields. Add / update that text as required and then click the Save button.

When you add a control at this level, the list of controls at the top Overlay control are updated and sorted to include this new control.

Editing a Control in an Overlay

To edit a control, click the ... menu to the far right of that row and select Edit. The window opens showing the control (you cannot edit the control number) as well as the description and supplemental text. Update the 2 textboxes as required with the updated information and click the Save button.

You also can select Delete from the ... menu if you need to remove the control from this listing. Verify the deletion by clicking the OK button on the popup. The control is deleted and the listing is updated to show the remaining controls for this overlay.

When you delete a control at this level, the list of controls at the top Overlay control are updated and sorted to include this new control.

Exporting the Overlay List

To export the list of overlays, click the Export button. A Microsoft Excel *.xlsx file is downloaded listing all the overlays with relevant information.

Viewing an Overlay and its Control Listing

To view the overlay, click the linked title of the overlay. The overlay record screen shows with the main overlay information as well as the listing of all controls, their updated description and their updated supplemental text. From here you can also edit the overlay main description and title as well as mark it active or inactive if this is not a default overlay.

NOTE: you can only add, edit or delete controls in an overlay if it is not a default overlay. You must have created it to change any control or control listing.

Bulk Delete Controls in an Overlay

If you wish to bulk delete controls in your overlay, click the checkbox next to the control number to select it. Alternatively, you can click the checkbox at the top of the table column to select all controls on that screen. Then the bulk action list appears to the top right above the table. Select Bulk Delete and Apply. You verify the deletion to have all the controls that are selected deleted from this overlay.

When you bulk delete controls at this level, the list of controls at the top Overlay control are updated and sorted to include this new control.

Uploading a Control Listing for an Overlay

You can upload a list of controls versus adding one at a time. There is a sample file linked below. Click the Upload button from the Overlay record screen and then add your file to the area shown below. You can drag and drop the file or click into it to select in a file dialog. Click the Upload File button to upload and save the control records with your overlay.

For any controls already listed, the description and supplemental text are updated. If brand new, it adds all data for the control overlay record.

The control you use (e.g. AC-2, AC.L1-3.1.20, DE.AE-02) in this listing must already be loaded in the frameworks area of your installation. If not it will be skipped.

A sample file is available to start from in order to see the format and columns required. There are also samples of these files on the public GitHub repository available on the https://www.soteriasoft.com/ website under the Resources menu.

Export an Overlay and its Control Listing

To export an overlay record with the list of overlay controls, click the Export button from this page. A Microsoft Excel *.xlsx file is downloaded showing the overlay information as well as each control, description, and supplemental text used for this overlay.

Included Default Overlays

There are ten (10) overlays by default created at the Administrator level based on NIST 800-53 controls. These can be used within any system package and are included by default in the available listing. They cannot be removed. They can be added to a system package and from there can be edited or altered as required by that system package.

• CNSSI 1253 - The Committee on National Security Systems (CNSS) Instruction No. 1253, Security Categorization and Control Selection for National Security Systems, provides all Federal Government departments, agencies, bureaus, and offices with guidance on the first two steps of the Risk Management Framework (RMF), Categorize and Select, for national security systems (NSS).
• Privacy - Privacy and Personally Identifiable Information (PII) from NIST 800-53 rev 4 controls listing
• Classified Information - Security Controls that must be applied to the baseline for all classified systems.
• Electronic Physical Access Control Systems (ePACS) - Security Controls for ePACS use a combination of IT components and physical security elements (e.g., card readers, doors/locks) to enable access to real-world resources such as secured facilities or controlled areas within facilities.
• Joint Special Access Programs - Security Controls called out in the JSIG that specifically apply to Special Access Programs.
• Federal PKI - Security Controls called out for the Public Key Infrastructure
• DoD Impact Level 2, 4, 5, and 6 – These are overlays for FedRAMP compliance to track for levels of sensitivity and classification of data for cloud based accreditations.

---