4.1 Developing the Implementation Strategy: Resourcing, Funding and Timeline
Key Takeaways
- An implementation strategy sequences controls by risk reduction and technical dependency rather than by control identifier order.
- Resource planning must cover financial, personnel, and technical resources, since a funded control with no qualified operator is not an implemented control.
- Foundational controls such as identity, logging, and configuration management must precede the controls that depend on them.
- The organization must establish defined frequencies for compliance documentation reviews and for security and privacy training, because undated obligations are not auditable.
- Effectiveness measures are defined during strategy development so that implementation can be judged against a stated criterion rather than declared complete by assertion.
Developing the Implementation Strategy: Resourcing, Funding and Timeline
CGRC task 4.1 names four dimensions explicitly — resourcing, funding, timeline, effectiveness. Domain 4 carries the heaviest weight on the exam at 17%, and this task is the reason: it is where a paper baseline becomes a funded, scheduled, staffed programme of work. A control set that is perfectly selected and never resourced produces nothing but POA&M entries.
1. Sequencing: Dependency Before Identifier Order
The most common implementation failure is working through the control catalog in identifier order — AC, then AT, then AU — because that order has no relationship to how systems are actually built. Controls have technical dependencies, and implementing a dependent control before its foundation produces rework.
| Wave | Controls | Why It Must Come First |
|---|---|---|
| 1. Foundation | IA-2/IA-5 (identity, authenticator management), AU-2/AU-3 (audit events and content), CM-2 (baseline configuration), CM-8 (component inventory) | Nearly everything else depends on knowing what exists, who is acting, and what the approved state is |
| 2. Protection | AC-2/AC-3/AC-6 (accounts, enforcement, least privilege), SC-7 (boundary protection), SC-8/SC-28 (transmission and storage protection) | Access decisions require an identity source; least privilege requires an account model |
| 3. Detection & Response | SI-4 (system monitoring), AU-6 (audit review and analysis), IR-4 (incident handling) | Monitoring requires log sources; incident response requires detection |
| 4. Assurance & Sustainment | CP-4 (contingency testing), CA-7 (continuous monitoring), AT-2/AT-3 (training) | These verify and sustain everything built above |
Least privilege (AC-6) cannot be meaningfully implemented before an account management model (AC-2) exists. Audit review (AU-6) has nothing to review until audit generation (AU-3) produces records. Sequencing by dependency eliminates a whole category of avoidable rework.
Prioritize by Risk Reduction, Not by Ease
Within a wave, sequence by risk reduction per unit of effort. Controls addressing high-likelihood, high-impact exposure on internet-facing components come before controls addressing theoretical risk on isolated components. The failure mode the exam tests is a team that implements the twenty easiest controls first to show progress, leaving the highest-risk gaps open longest — a strategy that looks productive on a status report and leaves the actual risk untouched.
[!IMPORTANT] Controls that will not be ready by authorization are not omissions — they are planned items. They belong in the initial POA&M with a scheduled completion date, resources, and milestones, and the resulting residual risk is presented to the Authorizing Official as part of the authorization decision. Silently deferring a control is a finding; documenting it as a scheduled item with accepted interim risk is normal governance.
2. The Three Resource Types
The blueprint returns to resourcing again in Domain 5 (task 5.6), and both places use the same triad. Planning only for money is the classic gap.
| Resource | Includes | Typical Failure |
|---|---|---|
| Financial | Licences, hardware, professional services, assessment costs, recurring subscription and support | Funding acquisition but not the recurring operating cost, so the control lapses at renewal |
| Personnel | Engineering effort to build, operational staff to run, specialist skills, and the time of people whose main job is something else | Buying a SIEM with no analysts to triage its alerts — a tool that generates unread alerts is not a detective control |
| Technical | Infrastructure capacity, network paths, storage for log retention, test environments, integration interfaces | Enabling verbose audit logging without provisioning storage for the mandated retention period |
Federal funding has a life cycle of its own. Security requirements must enter the capital planning and investment control process during the budget cycle that precedes the work — typically a year or more ahead. A control identified after the budget is set generally waits for the next cycle unless it can be funded from operating reserves, which is precisely why late discovery of a control requirement is so costly. This is the concrete mechanism behind the general principle that early life-cycle integration is cheaper.
3. Establishing Review and Training Frequencies
The third bullet of task 4.1 requires that frequency be established for compliance documentation reviews and training. An obligation with no stated interval cannot be assessed — the assessor has no criterion against which to judge timeliness — so undated obligations reliably become findings.
| Obligation | Typical Frequency | Anchor Control |
|---|---|---|
Policy and procedure review (the -1 control in each family) | Annually, plus on significant change | AC-1, AU-1, CM-1, … |
| System Security Plan review and update | Annually, plus on significant change | PL-2 |
| Security and privacy awareness training | On hire, then annually | AT-2 |
| Role-based training for privileged and security roles | On assignment, then annually | AT-3 |
| Incident response training and testing | Annually | IR-2, IR-3 |
| Contingency plan training and testing | Annually (test scope varies by impact level) | CP-3, CP-4 |
| Account review and recertification | Commonly quarterly for privileged accounts | AC-2 |
| Control assessment per the monitoring strategy | By control volatility | CA-7 |
Two rules govern these values. First, where a regulation, overlay, or organizational policy prescribes a frequency, that value is used — it is not a local judgment call. Second, the frequency is an organization-defined parameter recorded in the SSP, which means it simultaneously creates the obligation and defines the assessment objective. "Reviewed periodically" is unassessable; "reviewed at least annually" is testable.
[!NOTE] Significant change is a second trigger, not a replacement for the interval. Nearly every review obligation is phrased as "at least annually and whenever a significant change occurs." Teams that treat change-driven review as a substitute for the calendar interval fail the control on the calendar criterion.
4. Defining Effectiveness Before You Begin
The word effectiveness in task 4.1 is doing real work. A control is not complete when it is installed; it is complete when it is implemented correctly, operating as intended, and producing the desired outcome — the same three-part standard SP 800-53A applies at assessment. Defining that criterion during strategy development means the implementation team builds toward the standard the assessor will apply, instead of discovering the gap at Step 4.
For each significant control, the strategy should state:
- The outcome the control is meant to produce ("privileged access is granted only to currently authorized personnel").
- The measure that demonstrates it ("percentage of privileged accounts with a current, approved authorization record").
- The evidence that will be produced, and where it will be retained.
- The threshold that distinguishes effective from deficient.
This is also how the continuous monitoring strategy gets its metrics. Controls whose effectiveness measure is automatically computable become continuously monitored; controls requiring manual evidence gathering are assessed on a defined interval. Deciding this at strategy time rather than at Step 6 avoids retrofitting instrumentation into systems that were never built to emit it.
Communicating the Strategy
The implementation strategy is a coordination artifact as much as a plan. Engineering teams need the sequence and dependencies; the business owner needs the timeline and any operational impact; the Authorizing Official needs to know which controls will be deferred and what interim risk that creates; the Security Control Assessor needs to know when components will be ready for assessment. Publishing the strategy is what prevents the most avoidable schedule failure in the RMF — an assessment scheduled against a system whose controls are not yet in place.
An implementation team plans to deliver AC-6 (least privilege) in the first sprint, deferring AC-2 (account management) to a later phase because the account model requires stakeholder negotiation. What is the primary flaw in this sequencing?
An organization funds the purchase and deployment of an enterprise SIEM to satisfy SI-4 and AU-6, but assigns no analysts to review its output. Which resource-planning failure does this represent, and what is the consequence?
A system security plan states that security policies are 'reviewed periodically and whenever significant changes occur.' Why will an assessor cite this as a deficiency?