Acme Federal System
1. FIPS 199 Categorization
| Information type | C | I | A |
|---|---|---|---|
C.2.8.7 Information Sharing SP 800-60 | Moderate | Moderate | Low |
C.3.5.1 System Development SP 800-60 | Low | Moderate | Low |
D.14.2 General Information | Low | Low | Low |
Overall impact computed as the high-water mark across all information types: Moderate.
2. System Description
Acme Federal System (AFS) is a web-based case-tracking application that supports inter-agency information sharing for the Acme Program Office. AFS ingests structured records from authorized partner agencies, routes them through a workflow engine, and presents them to authenticated government users for review and adjudication.
2.1 Architecture overview
Three-tier architecture: React single-page application, containerized Node.js API behind an authenticated API gateway, and a managed PostgreSQL database. All compute runs in the FedRAMP-Moderate-authorized Lovable Federal Cloud (LFC). External partner submissions arrive over mTLS via the API gateway.
2.2 Authorization boundary
The authorization boundary includes the AFS web application, API services, application database, key management service, audit log pipeline, and operator administrative interfaces hosted in LFC. Partner agency systems and end-user workstations are outside the boundary.
2.3 Operating environment
LFC us-gov-east region; production isolated from development and staging by separate accounts. Bastion-less access via identity-aware proxy with PIV-backed authentication.
2.4 Interconnections
- Partner Agency Submission API — System-to-system mTLS · Inbound case submissions from authorized partner agencies.
- Enterprise SIEM — Audit forwarding · Outbound audit log forwarding to the enterprise SIEM.
3. Control Implementation
ACAccess Control
[needs information: implementation narrative not yet drafted]
AFS account management is performed by the ISSO and delegated System Administrators through the AFS Identity Console. Account types are Standard (case reviewer), Privileged (administrator), Service (system-to-system), and Emergency (break-glass). All account creations require a signed access request and supervisor approval recorded in the access management system. Standard accounts are reviewed quarterly; Privileged accounts are reviewed monthly. Accounts inactive for 35 days are automatically disabled; accounts inactive for 90 days are removed. Separation of personnel triggers same-day deprovisioning via the HR-to-AFS connector.
[needs information: implementation narrative not yet drafted]
[needs information: implementation narrative not yet drafted]
[needs information: implementation narrative not yet drafted]
[needs information: implementation narrative not yet drafted]
[needs information: implementation narrative not yet drafted]
[needs information: implementation narrative not yet drafted]
[needs information: implementation narrative not yet drafted]
ATAwareness and Training
[needs information: implementation narrative not yet drafted]
[needs information: implementation narrative not yet drafted]
[needs information: implementation narrative not yet drafted]
AUAudit and Accountability
[needs information: implementation narrative not yet drafted]
AFS generates audit records for authentication, authorization decisions, case lifecycle events, and administrator actions. Audit records are forwarded to the enterprise SIEM via the LFC audit pipeline. Coverage of read-only access events (queries, exports) is in progress and tracked as a POA&M item.
- [needs information] Audit coverage for read-only query and export events is not yet implemented
[needs information: implementation narrative not yet drafted]
[needs information: implementation narrative not yet drafted]
This control is inherited from the Lovable Federal Cloud FedRAMP-Moderate authorization package. See the LFC SSP, control AU-9, for implementation details. AFS configures the platform feature in accordance with LFC customer responsibilities.
[needs information: implementation narrative not yet drafted]
CMConfiguration Management
[needs information: implementation narrative not yet drafted]
This control is inherited from the Lovable Federal Cloud FedRAMP-Moderate authorization package. See the LFC SSP, control CM-2, for implementation details. AFS configures the platform feature in accordance with LFC customer responsibilities.
[needs information: implementation narrative not yet drafted]
[needs information: implementation narrative not yet drafted]
[needs information: implementation narrative not yet drafted]
CPContingency Planning
[needs information: implementation narrative not yet drafted]
[needs information: implementation narrative not yet drafted]
AFS will use the LFC managed-database point-in-time recovery feature for the application database, with periodic logical exports to encrypted object storage in a separate account. Backup verification will be performed quarterly.
- [needs information] Backup frequency and retention period not yet defined
- [needs information] Off-site storage region not yet selected
- [needs information] Restoration test cadence not yet scheduled
[needs information: implementation narrative not yet drafted]
IAIdentification and Authentication
[needs information: implementation narrative not yet drafted]
Identification and authentication of organizational users is satisfied jointly by AFS and the Lovable Federal Cloud identity-aware proxy. Users authenticate to LFC using PIV credentials; LFC asserts a signed identity token to AFS over an authenticated channel. AFS verifies the token signature, maps the user to an AFS account, and enforces application-level role authorization. Multifactor authentication for privileged accounts is enforced by the LFC identity layer (PIV + cryptographic token).
[needs information: implementation narrative not yet drafted]
[needs information: implementation narrative not yet drafted]
IRIncident Response
[needs information: implementation narrative not yet drafted]
[needs information: implementation narrative not yet drafted]
[needs information: implementation narrative not yet drafted]
RARisk Assessment
[needs information: implementation narrative not yet drafted]
[needs information: implementation narrative not yet drafted]
[needs information: implementation narrative not yet drafted]
SCSystem and Communications Protection
[needs information: implementation narrative not yet drafted]
This control is inherited from the Lovable Federal Cloud FedRAMP-Moderate authorization package. See the LFC SSP, control SC-7, for implementation details. AFS configures the platform feature in accordance with LFC customer responsibilities.
Transmission confidentiality and integrity is inherited from the Lovable Federal Cloud platform, which terminates TLS 1.2+ with FIPS 140-validated cryptographic modules at the platform edge and enforces mTLS for all internal service-to-service traffic. See the LFC SSP, control SC-8, for implementation details.
[needs information: implementation narrative not yet drafted]
This control is inherited from the Lovable Federal Cloud FedRAMP-Moderate authorization package. See the LFC SSP, control SC-13, for implementation details. AFS configures the platform feature in accordance with LFC customer responsibilities.
This control is inherited from the Lovable Federal Cloud FedRAMP-Moderate authorization package. See the LFC SSP, control SC-28, for implementation details. AFS configures the platform feature in accordance with LFC customer responsibilities.
SISystem and Information Integrity
[needs information: implementation narrative not yet drafted]
[needs information: implementation narrative not yet drafted]
[needs information: implementation narrative not yet drafted]
[needs information: implementation narrative not yet drafted]
4. Roles & Responsibilities
| System Owner | Jane Patel | jane.patel@acme.gov | Acme Program Office |
| Authorizing Official | Lt. Col. M. Reyes | m.reyes@acme.gov | |
| ISSO | D. Okafor | d.okafor@acme.gov | |
| ISSM | S. Whitfield | s.whitfield@acme.gov |
Appendix A. OSCAL Export Readiness
This SSP exports to OSCAL SSP JSON v1.x. Sign in to export or hand off to the OSCAL Bridge for machine-readable validation.
Disclaimer. Reflects user-provided and user-confirmed information. Requires ISSO/ISSM review and does not constitute an ATO. Verify against current baseline (800-53 Rev 5 / FedRAMP) and program requirements.