Back to Insights
Case StudyBlog Post

Securing the Future: Comprehensive RMF Support at the U.S. Air Force Academy

RR

Ray Rafaels

Principal Engineer & Published Author

March 10, 20267 min read

Introduction: The USAFA Mission and IT Complexity

The United States Air Force Academy (USAFA) requires a resilient, compliant IT infrastructure to train future leaders. Axcend partners with the USAFA to deliver comprehensive Risk Management Framework (RMF) tasks, proving rigorous security doesn't impede academic operations. Balancing an open academic network with strict DoD security mandates requires a highly tailored approach to authorization.

The Axcend Approach to DoD Risk Management Framework

We execute all RMF Steps, adapting the standard NIST SP 800-37 lifecycle to the unique enclave architecture of the USAFA. We methodically select NIST 800-53 security controls and deploy expert Security Controls Assessor Representatives (SCARs) to perform in-depth control assessments.

The Integrated RMF Lifecycle at USAFA

1
01. Categorize

Identify mission impact (FIPS 199/200). Define system boundaries and authorization applicability.

2
02. Select

Baseline NIST 800-53 controls. Tailor overlays for DoD IL4/IL5 data strictures.

3
03. Implement

Deploy technical security solutions and document system security plans (SSP).

4
04. Assess

Independent SCAR evaluations. STIG compliance checks and penetration testing.

5
05. Authorize

Develop POAMs to address residual risk. Achieve Authority to Operate (ATO).

6
06. Monitor

Continuous vulnerability scanning. Active ISSO management and change validation.

Axcend's engineers work directly with system owners to ensure boundary definitions are accurate, avoiding unnecessary compliance overhead or the accidental exposure of unclassified systems to higher-tier data flows.

Precision Assessments: The Role of the SCAR

Our SCAR evaluations mirror real-world adversarial environments rather than performing "paper compliance." Our teams validate technical controls utilizing DISA STIGs and SRGs.

Axcend Assessment Matrix Coverage

Documentation
SSP, SAR, POAMs
Infrastructure
OS & Network STIGs
SaaS & Cloud
FedRAMP Validation
Applications
Fortify & SAST/DAST

Our assessments quickly reveal out-of-date cryptographic libraries or insecure protocols. We collaborate directly with Academy development teams to engineer remediation strategies, translating raw security findings into actionable engineering sprints.

Continuous Monitoring: Security Beyond the ATO

True security demands continuous vigilance. We conduct continuous monitoring powered by advanced vulnerability scanners and cyber toolsets, including ACAS and HBSS telemetry integration.

Continuous Monitoring Architecture

EndpointsServersCloudACAS / NessusValidation EngineeMASS SystemsPOAM Generation &Risk Reporting

Our embedded technical support ensures deviations in your posture are caught and corrected early. We integrate directly into operational tempos, actively mitigating vulnerabilities and reporting compliance through the DoD chain of command.

Our partnership with the USAFA proves that security and agility are not mutually exclusive. By applying deep technical expertise, we secure the systems that forge tomorrow's leaders.

RR

Ray Rafaels

Author

Principal Engineer & Published Author · Axcend, Inc.

Ray Rafaels is the founder and principal engineer of Axcend, Inc. He holds active certifications including CISSP, CEH, AWS, and PMP, and has authored three technical books on cloud computing and NIST 800-53 security controls used by government and commercial security teams worldwide.

Apply This in Practice

Ready to implement these frameworks in your environment?

Axcend's engineers apply these exact frameworks on active federal engagements. Let's talk about what a practical implementation looks like for your mission.