The Department of the Air Force and U.S. Space Force are accelerating software delivery to support mission execution across an increasingly interconnected operational environment. However, many cybersecurity authorization processes remain rooted in compliance-centric workflows that were designed for periodic assessments rather than continuous software delivery. As programs pursue Continuous Authorization to Operate (cATO) and DevSecOps adoption, security teams face a growing challenge: maintaining real-time visibility into cyber risk while reducing the manual effort required to prepare and sustain authorization packages. 

This presentation examines an operational case study involving the deployment of Vanguard, an automated cyber assurance platform operating within a DoD Impact Level 6 (IL6) development environment. The implementation was designed to address a common challenge across Air Force and Space Force programs: security evidence exists throughout the DevSecOps pipeline, but assembling that evidence into actionable authorization artifacts remains a labor-intensive, largely manual process that struggles to keep pace with modern release cycles. 

The case study demonstrates how vulnerability scans, STIG assessments, software bills of materials (SBOMs), asset inventories, container security findings, and CI/CD pipeline artifacts were automatically ingested, correlated, and mapped to NIST SP 800-53 Rev. 5 controls to create a continuously updated security evidence model. Rather than treating cybersecurity compliance as a periodic documentation exercise, the implementation transformed security artifacts into continuously available authorization evidence that supports authorization readiness, continuous monitoring, and mission-informed risk management. 

The presentation will further explore how automated analysis was used to evaluate the completeness, consistency, traceability, and evidentiary sufficiency of RMF documentation and supporting artifacts. By maintaining direct traceability between security findings and source evidence, the implementation enabled security teams to identify documentation gaps, validate implementation claims, improve authorization package quality, and reduce cybersecurity rework before formal assessment activities occurred. 

The presentation will also explore how locally hosted AI capabilities operating entirely within the security boundary were leveraged to assist with control gap analysis, evidence sufficiency assessments, security documentation generation, and impact assessments without exposing sensitive information to external cloud-based services. AI-generated findings remained advisory and subject to human review and attestation, preserving established RMF governance and authorization authorities while accelerating analysis and reducing manual effort. 

Attendees will gain practical insights into how automated cyber assurance can reduce manual compliance effort, improve authorization readiness, strengthen continuous monitoring, enhance evidence traceability, and support Department of the Air Force objectives for mission-speed software delivery. The lessons learned from this operational IL6 deployment provide a practical framework for transitioning from compliance-centric cybersecurity activities toward continuous, data-driven cyber assurance in support of cATO objectives. 

• Explain why traditional compliance-centric RMF processes struggle to support modern Air Force and Space Force software delivery models and cATO objectives. 
• Describe how automated evidence collection, evidence sufficiency analysis, control correlation, and human-attested AI findings can improve authorization readiness while reducing manual cybersecurity workload. 
• Evaluate approaches for implementing AI-assisted cyber assurance within IL6 and air-gapped environments while maintaining governance, accountability, and protection of sensitive information. 
• Apply lessons learned from an operational IL6 deployment to establish a scalable foundation for continuous authorization, documentation readiness, and mission-focused cyber assurance. 

The Department of Defense has formally recognized that traditional authorization approaches do not scale to modern software delivery. Many programs continue to rely on manual evidence collection, spreadsheet-driven compliance tracking, and periodic assessments that produce only a point-in-time view of security posture. 

Key challenges include compliance not equaling continuous visibility, significant analyst time spent managing artifacts, difficulty determining whether available evidence sufficiently supports control implementation claims, continuous monitoring struggling to keep pace with release velocity, and the inability to use many commercial AI-enabled compliance solutions within IL6 and air-gapped environments. 

The Vanguard implementation was designed to address these challenges by treating cybersecurity evidence as operational data rather than documentation. 

Operating entirely within the security boundary, Vanguard continuously ingests and correlates ACAS/Nessus vulnerability scans, STIG assessments, SBOMs, container findings, asset inventories, and DevSecOps pipeline artifacts. These data sources are automatically mapped to NIST SP 800-53 Rev. 5 controls, providing a continuously updated view of control implementation and security posture. 

The platform further analyzes documentation completeness, evidence sufficiency, and control implementation consistency while maintaining traceability between findings and source artifacts. This capability enables cybersecurity teams to identify documentation readiness gaps earlier in the authorization lifecycle and reduce costly rework prior to formal review activities. 

The platform also leverages locally hosted AI capabilities to assist with system impact analysis generation, SSP narrative development, assessment narrative drafting, control gap identification, evidence sufficiency analysis, and authorization readiness assessments. AI-generated findings remain subject to human review and attestation, ensuring that cybersecurity governance, risk decisions, and authorization authority remain with designated personnel. 

This case study demonstrates a practical approach to transitioning from compliance-centric cybersecurity activities toward automated, data-driven cyber assurance. 

Rather than viewing RMF as a periodic documentation exercise, the implementation shows how security evidence generated throughout the software lifecycle can become the foundation for continuous monitoring, authorization readiness, documentation quality assessment, and mission-informed risk management. 

For Air Force and Space Force organizations pursuing DevSecOps, cATO, and operational agility, the lessons learned from this IL6 deployment provide a blueprint for reducing manual effort, improving security visibility, strengthening evidence traceability, reducing authorization rework, and enabling faster delivery of secure capabilities to the warfighter.