Industry Descriptor: A Premier Global Systems Integrator and Defense Contractor
The Challenge
As a prime contractor to the U.S. Federal Government, this organization faced a critical bottleneck in its internal system authorization process. Authorizations for a large portfolio of secure systems ran through a legacy, document-heavy process that sat apart from the rest of its risk program. Writing and reviewing security plans was slow and manual, the process was hard to see into, and it couldn’t scale with the business.
The Solution
C1Secure implemented SmartDACM natively within ServiceNow IRM, shifting the organization from a document-centric model to a data-driven, machine-readable authorization engine. We then retired the legacy system entirely, migrating every historical authorization record into one lifecycle engine that runs from inception to decommissioning.
Key project elements included:
- OSCAL-Native Integration: Automated security plan generation using the Open Security Controls Assessment Language (OSCAL) for machine-readable compliance.
- Workflow Digitalization: Fully digitalized the DER process to remove manual hand-offs and delays between engineering and compliance teams.
- Unified System of Record: Created a single, authoritative source for all policies, controls, and evidence across the entire federal business unit.
- Lifecycle Visibility: Dashboards and performance indicators for controls, attestations, and issue trends, giving stakeholders and leadership a live view of the program.
Impact:
- 94% Faster Reviews: Review time per authorization dropped from 8 hours to 30 minutes.
- SSP Authoring Cut in Half: System owners went from roughly 80 hours to 40 hours per security plan.
- One System of Record: The legacy solution is retired, and every authorization now lives in a single, governed platform.
- Scale and Repeatability: A standardized engine that applies across diverse federal programs and supports continuous compliance.
