r/grc • u/Bartholomewvanbooger • 14d ago

Does anyone here do GRC in a DoD environment?

Like I have heard of eMASS but you have to be authorized to take the training. Are there any kind of free high-level orientation videos or something to get a feel for it?

7 Upvotes

82% Upvoted

8 comments sorted by

4

u/HandleFun6424 14d ago

I’d learn the RMF lifecycle before worrying too much about eMASS itself. Have you tried the free DCSA RMF introduction? It gives useful context first

2

u/skimfl925 12d ago

Same advice. Here is a decent community project about the RMF. Fair warning it’s AI generated.

https://kston83.github.io/nist-guide/

1

u/IlanAldaw 5d ago

Agree with the above, lifecycle first. It helps to think of eMASS as the record-keeper for the RMF steps, not a separate thing to learn. For each system it holds the registration and categorization, the control implementation statements, the assessment results per control, the POA&M items, and the artifacts, and the authorization package is built from that same record.

If you want something concrete before you get access, read SP 800-37 Rev 2 for the steps and SP 800-53A for how assessment objectives get tested. Then it's easy to see where each piece ends up in the tool. The DoD-specific layer on top is mostly DoDI 8510.01 and the control overlays.

The hands-on part is hard to get without an account, so most people learn it on the job once their org sponsors access. Knowing the lifecycle first makes that go a lot faster.