Home / Sectors / Federal Civilian
FISMA authorizations and the AI obligations now inside them.
Authorization lifecycle management for civilian agencies, AI governance framework development under the NIST AI RMF, and capture support for teams bidding work they have to secure afterwards.
Boundaries drawn before AI existed now have AI inside them
Most civilian systems carrying a FISMA authorization were categorised, assessed and authorized against a control baseline selected years ago. The AI capability added last quarter did not arrive with its own authorization. It arrived as a change inside an existing boundary, and OMB M-25-21 attached obligations to it that the original package never contemplated.
That is a reauthorization question, a significant change question and a control selection question at once. Treating it as a separate AI governance project produces a second set of artifacts that nobody reconciles with the system security plan an assessor will actually read.
Interconnected systems fail at the seams
Civilian agencies rarely run one system. They run portfolios of interconnected systems of record, each with its own authorization, its own boundary and its own inherited controls, joined by interconnection agreements that are frequently the least maintained artifact in the package. Authorization continuity across that portfolio is a different discipline from authorizing one system well.
We manage the lifecycle across the portfolio: categorisation, control selection and tailoring out of SP 800-53 Rev 5, assessment support, POA and M management, and the continuous monitoring that keeps an authorization from lapsing quietly between reviews.
Winning the work and then securing it
Teams bidding federal work have to describe a security approach they will later be held to. We support capture with technical volume writing grounded in what the delivery actually requires, which has the useful property of producing a proposal the delivery team can execute rather than one they have to renegotiate.
Traverge practitioners have worked authorization programs for the Federal Trade Commission, the Internal Revenue Service and the Federal Aviation Administration, alongside health portfolios at the Department of Veterans Affairs, the National Institutes of Health and the Defense Health Agency.
Where authorizations lapse
Continuity fails quietly, then all at once.
An authorization rarely fails at assessment. It degrades between them, and the degradation is only visible when somebody asks for evidence.
| Gap | How it surfaces |
|---|---|
| Interconnection drift | Agreements that describe a data flow two architectures ago, discovered when the connected system reauthorizes and asks you to confirm. |
| Inherited control decay | Controls inherited from a provider whose own certification has changed scope, leaving a gap neither party is monitoring. |
| POA and M accumulation | Items carried forward past their remediation dates until the register itself becomes the finding. |
| Unreported change | An AI feature, a new integration or a cloud migration shipped without a significant change analysis, so the authorized system and the running system diverge. |
| Evidence staleness | Continuous monitoring reported on a cadence that satisfies the calendar rather than the control, which holds until an assessor tests the date. |
Next step
Tell us what you hold today and what your agency customer expects next.
It starts with a gap analysis at no cost, and a scoped proposal follows.