Knox Systems Achieves FedRAMP High Authorization Through Partnership with FEMA

The Department of Defense (DoD) scans roughly 11 million devices on the DoD Information Network as part of its vulnerability management efforts across the defense enterprise. That effort uses the Assured Compliance Assessment Solution (ACAS) to assess systems against DoD security standards and identify known vulnerabilities.

Understanding how ACAS works, and what it requires indirectly, is necessary for any SaaS company serious about winning and retaining Defense contracts.

Key Takeaways

• ACAS shapes authorization. ACAS is a DoD-operated scanning tool used to assess systems connected to DoD environments.
• FedRAMP is foundational. Federal Risk and Authorization Management Program (FedRAMP) authorization provides the foundation for DoD Impact Levels 4 (IL4) and 5 (IL5).
• DoD adds overhead. DoD cloud authorization and Security Technical Implementation Guide (STIG) compliance can quickly add operational overhead.
• Inherited controls help. A pre-authorized FedRAMP boundary can take on much of the infrastructure-layer compliance burden.

DISA ACAS Is a DoD Internal Scanning Program That Shapes SaaS Authorization Outcomes

ACAS directly shapes whether a SaaS vendor earns and keeps DoD authorization. It is a DoD-operated scanning tool used to assess systems connected to DoD environments. It runs on Tenable's product stack, which includes:

• Tenable.sc: Central management console that aggregates scan data, dashboards, and reporting.
• Nessus scanners: Active vulnerability detection engine.
• Nessus Network Monitor: Passive traffic analysis component.

For SaaS vendors, your environment must be architected to be assessed against DoD security requirements during the PA process and on an ongoing basis.

How ACAS Creates Indirect Compliance Obligations for SaaS Vendors

DoD cloud policy allocates responsibility differently across Infrastructure as a Service (IaaS), Platform as a Service (PaaS), and SaaS:

Scanning Responsibility by Cloud Service Layer

• IaaS: The Mission Owner bears the most scanning responsibility.
• PaaS: Responsibility varies by contract.
• SaaS: The CSP is responsible for security of the cloud-based hardware, virtual machine environment, operating system, and application.

STIG Configuration Compliance Across a Typical SaaS Stack

Key points to understand about STIG compliance within ACAS:

• Two scan types: Vulnerability scans and compliance scans.
• Standards used: Compliance scans assess configuration against DoD baselines.
• Wide coverage: Findings typically span various layers of the application stack.

Costs That Compound on Top of FedRAMP Authorization

FedRAMP authorization is the prerequisite for DoD IL4 and IL5.

1. Scanning Cadence

FedRAMP requires monthly authenticated vulnerability scanning.

2. Dual Reporting Streams

Vendors with both civilian agency FedRAMP customers and DoD IL4/IL5 customers must maintain separate reporting streams.

3. Personnel Restrictions

The CC SRG requires CSP personnel with access to IL4 and IL5 data to be restricted to U.S. citizens, U.S. nationals, or U.S. persons.

4. Network Constraints

IL4 and IL5 connectivity must be routed through a DISA Cloud Access Point.

5. Compounding Operational Overhead

Continuous monitoring requires dedicated headcount and infrastructure.

How a Pre-Authorized FedRAMP Boundary Reduces the ACAS Compliance Surface

A pre-authorized FedRAMP boundary can take on much of the infrastructure-layer burden.

The Cost of Waiting Grows With Every Procurement Cycle

Every quarter a SaaS vendor delays FedRAMP authorization is a quarter of evolving compliance expectations, growing remediation backlogs, and lost opportunity.

FAQs About DISA ACAS and DoD SaaS Authorization

How Long Does It Typically Take to Get a DoD Provisional Authorization After FedRAMP?

Timelines vary by Mission Owner and impact level, but generally several additional months after FedRAMP authorization.

What Happens if an ACAS Scan Identifies a CAT I Finding in Production?

CAT I findings require immediate remediation or a formal risk acceptance with compensating controls.

Can a SaaS Vendor Use Its Own Vulnerability Scanner Instead of ACAS?

Vendors typically run their own scanners but must architect environments to produce evidence that aligns with ACAS expectations.

Does ACAS Apply Differently to IL4 Versus IL5 Environments?

IL5 environments carry tighter constraints around personnel, network routing, and sensitivity of findings.

How Often Do STIG Baselines Change, and What Does That Mean for Vendors?

DISA publishes quarterly STIG updates, so SaaS teams need ongoing maintenance.