ATO Scoping Walkthrough

This is the platform’s Scope walkthrough done from the CLI, for the DoD RMF attachment (dod-rmf). The platform does every derivation, selection, and inheritance step; the CLI sends answers and reads the results back. The same steps work through MCP (attach_framework, put_system_categorization, set_scope_step_completion).

1. Attach DoD RMF

Create the system in the Pretorin platform, then attach the framework:

pretorin system frameworks add <system_id> dod-rmf --preview
pretorin system frameworks add <system_id> dod-rmf
pretorin context set --system <system_id> --framework dod-rmf

--preview shows what the platform would reuse from the organization’s other systems. add applies the platform’s default reuse selection (--no-reuse skips it) and waits for initialization (--no-wait returns the job ID). Preview output distinguishes the platform defaults from selected_for_attach, which is zero with --no-reuse. DoD RMF selects controls by categorization, so nothing is in scope yet.

2. See where the walkthrough stands

pretorin scope show

The walkthrough has five steps: narrative, scale, select controls, system spec, and review and approve. scope show lists each one, who completed it, and the next command. For a categorized framework it also shows the categorization’s state and the selection’s owned, hybrid, inherited, and not applicable counts.

3. Narrative and scale

pretorin scope populate --apply
pretorin scope step narrative
pretorin scope target-tier moderate
pretorin scope step guidance

4. Categorize and select controls

pretorin system categorize <system_id>
pretorin system categorize <system_id> --complete
pretorin system selection <system_id> --framework dod-rmf

The questionnaire derives the registration type, NSS, the C-I-A trigraph, the DoD cloud impact level, and the overlays. It previews the selection before saving. Naming the hosting provider links that vendor to the system. See RMF Categorization and Selection for overrides, tailoring, and filters.

5. Inherit from vendors

pretorin rmf seeded-catalogs
pretorin vendor import-crm <vendor_id> responsibility-matrix.csv
pretorin vendor systems attach <vendor_id> --system-id <system_id>
pretorin system selection vendors <system_id> --framework dod-rmf
pretorin scope step controls

A linked vendor’s offers become inherited or shared controls at the next selection recompute.

6. System spec

pretorin scope artifacts list
pretorin scope step system_spec

See Asset Inventory & System Spec.

7. Review and approve

Completing the scope and approving the control selection are human decisions, made in the platform. pretorin scope show reports both once they are done. Afterward, pretorin system emass-registration <system_id> prints the eMASS System Registration fields.