Every three years — or whenever an Authorization to Operate comes due — federal network teams scramble. Engineers spend weeks, sometimes months, manually gathering configuration data, chasing documentation, and assembling evidence packages for systems that have been running and changing since the last review. The ATO gets approved. The clock resets. And the network drifts.
This is not a security posture. This is a compliance performance.

In September 2025, the Department of Defense acknowledged exactly that. The Cybersecurity Risk Management Construct — CSRMC — replaces the legacy Risk Management Framework with a five-phase lifecycle built around continuous monitoring, automation, and a persistent authorization model called the continuous ATO. DoD’s own language is unambiguous: static checklists and snapshot-in-time assessments are no longer acceptable.

This session is a practitioner’s field guide to what CSRMC actually requires at the network layer — and what it takes to deliver it. Drawing on deployments across SOCOM, USAF, NETCOM, INDOPACOM, and DISA, the presenter maps each phase of the CSRMC lifecycle to the specific network assurance capabilities required to support it: continuous topology visibility, automated data collection for compliance monitoring, and mathematical verification that network behavior matches authorized intent.

Attendees will walk away with a clear, phase-by-phase picture of where the network team fits in CSRMC, what automation is required to support the continuous ATO model, where AI accelerates the process, and why human judgment remains the essential control in DoD environments.

This is a field report from someone who has lived in the CLI and the AO — aligned to the framework DoD just told you to implement.