Adding System Packages
You must be an Administrator or SystemPackage Administrator to add a new system package. When you add a new System Package in OpenRMF® Professional the Add menu option is under System Packages and there is an New button on the system package listing page. This takes you to the add page and lists several fields to fill in.
You must enter a system package title, a unique system package key, and the description of the system package. If this is an RMF package you can also choose the confidentiality, integrity, and availability levels (C-I-A) that dictate the low, moderate and high levels for matching to NIST Controls in the Risk Management Framework process. If this is FedRAMP you choose that appropriate level. And if this is StateRAMPTM you choose the appropriate level for that. For a Custom framework you choose tailoring and overlays once you go into the System Package itself.
New System Package Wizard
Using the New System Package Wizard, you can specify the title, system key acronym, version and description on the first tab. You also can specify to add your current user to the “SystemOwner” permission in the new system package so it immediately shows on your dashboard listing for system packages. Then click the Next button at the bottom right to go to the next page. Enter compliance, then more descriptive information, point of contact information, as well as authorization specific information.
When done click the Create System Package button and your new package is created. You are presented with quick links to go to your dashboard, add overlays or tailor your security controls, or start to upload data quickly.
Add a System Package Form-Based
This is the alternative way to add a new system package. You have the same fields to enter they are just all on one form to view at once.
Near the bottom of the add page is an area to add the Authorization Type (ATC, ATO, IATT, Type Accreditation) as well as the current status, date, and comments for the authorization (if any). When all data is filled out that you have for the new system package, click the Save Changes button.
System Package Keys
The system key is unique across all system packages for this installation no matter if the system package is active or marked read-only. And it cannot be used more than once. It must be only letters (a to z lowercase), numbers (0 to 9) or the - dash as a special character. You cannot use other special characters or the space character. All system package keys are forced to be lowercase as well and must be unique per installation.
A Mention on Licensing
When you request a license for OpenRMF® Professional you are given a license file and a key file. When matched together and uploaded into the application, this opens up the ability to create, add, edit, and delete checklists and system packages. There is a maximum system packages number included in this license that tells you the maximum number of active system packages you can have at one time.
This is related to the Read-Only mechanism of making a system package read-only and inactive. To add a new system package when you are at your maximum, you either have to request an updated license for the correct number of system packages. Or you have to mark a system package as read-only, which cannot be undone.