Services
Five disciplines. One center of gravity.
WHAT WE DO
Five disciplines. One center of gravity.
Gravity Information Systems helps programs across the Air Force and the broader Department of War (DoW) earn and maintain their Authority to Operate. Our practitioners work inside the DoW Risk Management Framework every day, from categorization and control implementation through eMASS, POA&M management, and continuous monitoring. Gravity is the idea behind the name: we pull your people, systems, and processes into one orbit so program offices, engineers, and assessors work from the same operational picture.
Continuous Monitoring
Keep the ATO you earned through scans, reviews, and change analysis.
SERVICE
RMF & ATO
A defensible authorization package, built to the standard your AO and SCA expect.
We take your system through the DoW Risk Management Framework from categorization to authorization decision. Our job is to give the Security Control Assessor a package that is complete, consistent, and backed by evidence, so the Authorizing Official can make a risk decision without rework cycles. We support new systems needing an IATT or initial ATO, and fielded systems facing reauthorization.
What we deliver
- System categorization and control baseline selection per CNSSI 1253, with tailoring and overlays documented and justified
- Control implementation statements mapped to NIST SP 800-53 Rev 5, written to the system as built, not copied from a template
- System Security Plan (SSP) and supporting artifacts: boundary and data-flow diagrams, hardware/software lists, ports, protocols, and services, and required plans and policies
- Assessment preparation: STIG checklists, SCAP and ACAS scan results, and an evidence package organized for the SCA
- Support through assessment, including response to findings and input to the Security Assessment Report (SAR)
- Risk assessment and POA&M content ready for the AO’s authorization decision (IATT, ATO, or ATO with conditions)
- Security impact analysis for changes and reauthorization packages, following NIST SP 800-37 Rev 2 and DoDI 8510.01
Outcome
Your system reaches an authorization decision with a package the AO can sign and your team can maintain.
SERVICE
eMASS & POA&M Management
Your eMASS record reflects the real system, and your POA&M tells the truth.
eMASS is the system of record for your authorization, and an out-of-date record creates risk and delay at every review. We build and maintain your eMASS package, keep control status and artifacts current, and manage the POA&M as a working tool rather than a compliance afterthought. Program managers get a clear view of open risk, ownership, and schedule.
What we deliver
- eMASS system registration, package setup, and workflow management through submission, assessment, and authorization
- Control-by-control status, implementation narratives, test results, and artifacts kept current in eMASS
- POA&M development and upkeep: weaknesses, severity, resources, scheduled completion dates, and milestones with real owners
- Intake of findings from ACAS scans, STIG checklists, SCA assessments, and inspections into the POA&M
- Residual-risk statements and mitigations written for AO review
- Closure evidence assembled and attached so items can be validated and closed
- Status reporting to the program office on open findings, overdue milestones, and authorization expiration dates
Outcome
Your eMASS package and POA&M stay accurate and review-ready, with no surprises at reauthorization.
SERVICE
Continuous Monitoring (ConMon)
Keep the ATO you earned by watching the system between assessments.
An ATO is a point-in-time decision; continuous monitoring is what keeps it valid. We run the recurring work that NIST SP 800-37 Rev 2 and DoDI 8510.01 call for: scanning, configuration compliance, change review, and reporting to the AO. The result is a system whose security posture is known month to month, not rediscovered at the next assessment.
What we deliver
- A continuous monitoring strategy tailored to the system, defining control assessment frequency and reporting cadence
- Recurring ACAS vulnerability scans with results analyzed, prioritized, and tracked to remediation
- STIG and SCAP configuration compliance checks against current DISA benchmarks
- Tracking of TCNOs, IAVMs, and higher-headquarters cybersecurity directives for applicability and compliance
- Security impact analysis on proposed changes before they reach production
- Ongoing control assessments and updates to the SSP, POA&M, and eMASS record
- Periodic security posture reports for the ISSM, program manager, and AO
Outcome
Your system stays authorized and its risk posture is current whenever leadership or the AO asks.
SERVICE
ISSM / ISSO Support
Experienced ISSM and ISSO support from practitioners who do this work on Air Force programs today.
We provide hands-on ISSM and ISSO support to programs that need cybersecurity leadership embedded with their team. Our work is led by TS-cleared, CISSP-certified cybersecurity professionals, and our leadership performs ISSM duties on Air Force programs today. We fill a gap, support an existing cyber team, or stand up the function on a new program.
What we deliver
- ISSM/ISSO duties as defined in DoDI 8510.01: maintaining the security posture of assigned systems and serving as the program’s cybersecurity point of contact to the AO and SCA
- Hardware and software baseline management, and security review of new hardware, software, and connections before they are approved
- Review and enforcement of STIG compliance, account management, and audit requirements
- Development and upkeep of security documentation: SSP, incident response, configuration management, and contingency plans
- Coordination with engineers, system administrators, and the program office on remediation and change requests
- Preparation for assessments, inspections, and command cyber readiness reviews
- Support for classified and unclassified environments, consistent with our team’s clearances and the customer’s access requirements
Outcome
Your program has a cleared, credentialed cybersecurity lead who keeps systems compliant and the authorization on track.
SERVICE
CMMC Readiness
A clear path to CMMC 2.0 Level 2 for contractors handling CUI.
Defense contractors that handle Controlled Unclassified Information must meet NIST SP 800-171 and prepare for CMMC 2.0 Level 2 assessment. We assess where you stand today, build the documentation an assessor will ask for, and lay out a prioritized plan to close the gaps. We bring the same discipline we apply to DoW RMF packages to your environment.
What we deliver
- CUI scoping: identifying where CUI is stored, processed, and transmitted, and defining the assessment boundary
- Gap assessment against the 110 security requirements of NIST SP 800-171 Rev 2, using the NIST SP 800-171A assessment objectives
- System Security Plan (SSP) written to your actual environment
- Plan of Action and Milestones (POA&M) with prioritized remediation steps
- Calculation of your score under the DoD Assessment Methodology and support for posting it to SPRS
- Evidence collection and organization for a C3PAO assessment or self-assessment
- Review of DFARS 252.204-7012, -7019, -7020, and -7021 obligations as they apply to your contracts
Outcome
You know your SPRS score, your gaps, and the plan to reach CMMC 2.0 Level 2 readiness.
HOW WE WORK
How we work
1. Understand the mission and the system.
We start with the program’s mission, the system boundary, the AO’s expectations, and where the authorization stands today.
2. Assess and plan.
We review existing artifacts, scans, and eMASS records, identify gaps, and build a prioritized plan with clear owners and dates.
3. Build and integrate.
We produce the artifacts and do the work alongside your engineers, administrators, and program office, so security is built into how the system runs.
4. Sustain.
We keep the package, POA&M, and monitoring current, and report status so leadership always knows where the system stands.
TEAMING
Teaming
Gravity Information Systems is a small business with SDVOSB certification in progress. We are pursuing the SBA Mentor-Protégé Program and are open to teaming and subcontracting with prime contractors on Air Force, Space Force, and DoW cybersecurity work, including RMF, ATO, and eMASS efforts in the Tinker AFB area.
Ready to bring your program into orbit?
Tell us where your authorization stands. We’ll help you get it across the line.