MUSA Classified System Builds Through DCSA Authorization
When a contract requires classified processing at your facility, the system has to be built, documented, and authorized by DCSA before anyone can use it. Elite Security Solutions LLC designs and builds multi-user standalone (MUSA) classified computing systems and carries them through the Risk Management Framework (RMF) process in the DCSA Assessment and Authorization Process Manual (DAAPM), through the eMASS package, to an authorization to operate (ATO).
Who this is for
- Cleared contractors with new classified work that requires processing classified information on site.
- Companies moving from relying on a customer's or prime's classified systems to their own in-house capability.
- Companies whose contracts require their own accredited capability rather than shared space.
- Cleared contractors that need a small multi-workstation configuration, including peer-to-peer setups.
- Companies that need to receive and respond to classified proposals. In addition to systems for contract work, ESS builds and tailors a MUSA for that purpose, commonly called a Proposal MUSA.
- Facilities moving to possessing status that need the classified system and the security program to come together on one schedule.
What's included
System design and scoping
- Selection of the system type and boundary under the DAAPM, based on users, workstations, classification level, and how the system will be used.
- Hardware and software requirements for the build.
- Coordination with your FSO on the physical area where the system will sit.
RMF documentation under the DAAPM
- System categorization and security control selection.
- System Security Plan (SSP) and supporting artifacts in the format DCSA expects.
- Plan of Action and Milestones (POA&M) for any items that remain open.
- Continuous monitoring strategy for the system after authorization.
Build and hardening
- Build of the workstations and system components.
- Hardening against the applicable DISA Security Technical Implementation Guides (STIGs).
- Audit logging and account management configured to the documented controls.
- Validation scans and evidence collection.
eMASS and DCSA authorization
- Preparation of the authorization package in eMASS.
- Security assessment support and response to DCSA comments.
- Support through DCSA's assessment and the authorization decision.
Your ISSM
Every contractor that processes classified information on its own systems appoints an Information System Security Manager (ISSM). Your company hires an internal ISSM to oversee and manage the system once it is authorized. ESS works alongside that person through the build so they take over a complete, documented system. Our builds are led by certified ISSMs, so your ISSM learns the system from people who have carried it through DCSA authorization.
After authorization
ESS's role ends at authorization. Your ISSM operates and maintains the system from there, with the full documentation package and procedures we hand over.
How it works
- Consultation and scoping. We confirm the contract requirement, classification level, number of users and workstations, and the space the system will occupy.
- RMF initiation and baseline build. We categorize the system, select controls, draft the SSP, register the system in eMASS, and build the baseline configuration.
- Security assessment. We harden the system to the applicable STIGs, run validation scans, collect evidence, and close or document any open items in the POA&M.
- ATO submission. We complete the eMASS package and support your ISSM and leadership through DCSA's review and assessment.
- Authorization and handoff. Once DCSA authorizes the system, your ISSM has the documentation and procedures to operate and maintain it.
Typical timeline
Timelines depend on the number of systems required and on DCSA's availability and response. We recently completed a build in 13 weeks, from contract signing to ATO issuance by DCSA. That is one result, not a guarantee; we give you a schedule for your system after scoping.
One firm for the program and the system
A classified system does not stand alone. The facility needs a clearance with safeguarding approval, an area that meets physical security requirements, trained cleared users, and a security program that DCSA will review. ESS's certified FSOs for Possessing Facilities run that side of the program, so the system and the program are planned and delivered together.
Frequently asked questions
What is a MUSA?
A multi-user standalone (MUSA) system is a classified information system used by more than one person that is not connected to other networks. It is one of the system types defined in the DCSA Assessment and Authorization Process Manual (DAAPM). Small multi-workstation configurations, such as peer-to-peer systems, follow the same RMF process with a different system boundary.
Who authorizes a classified system for a cleared contractor?
DCSA does. Under the DAAPM, the contractor submits the system's authorization package through eMASS, DCSA assesses it, and a DCSA Authorizing Official issues the authorization to operate. ESS prepares the system and the package and supports you through that process.
Do we need an ISSM?
Yes. A contractor that processes classified information on its own systems must appoint an Information System Security Manager. ESS works with your ISSM through the build and authorization and prepares them to maintain the system afterward.
Does our facility need to be cleared first?
Yes. Your company needs a facility clearance with safeguarding approval at the level of the classified work, and the system must sit in an area that meets the physical security requirements. If you are not there yet, ESS's facility clearance and FSO practice can take you through that step on the same plan.
Can a MUSA be built for classified proposals?
Yes. Companies that need to receive and respond to classified requests for proposals (RFPs) can have a system built and tailored for that purpose, commonly called a Proposal MUSA. It goes through the same DCSA authorization process.
How long does a MUSA build take?
It depends on the number of systems required and on DCSA's availability and response. We recently completed a build in 13 weeks, from contract signing to ATO issuance by DCSA. We give you a schedule for your system after scoping.
What happens after the system is authorized?
The system has to stay within its authorization. That means following the continuous monitoring strategy, reviewing audit logs, managing accounts, and updating documentation when the system changes. Your internal ISSM carries those duties. ESS's role ends when DCSA issues the authorization.
Talk to us about a classified system build
If a contract requires classified processing at your facility, start with a confidential consultation. We will scope the system and tell you what it will take to reach DCSA authorization. Use the contact form or call 910-797-6345.