System & Application Security Plans (SSP)

Often true in theory. In practice a moderate-baseline SSP is 200–400 focused hours of interviewing, verifying, and writing, hours your ISSO already doesn't have, which is why the plan is stale in the first place. Avalon drafts and verifies; your ISSO reviews, corrects, and owns, spending their scarce hours on the judgment calls instead of the production work.

Ask when the plan was last rewritten rather than re-dated, and whether the same team that implemented the system also documented it. Self-documentation produces the blind spots assessors find. A discrete carve-out is low-risk to the incumbent relationship and gives the AO an independently produced artifact.

No vendor controls assessment outcomes, and any vendor who implies otherwise should worry you. What Avalon commits to in the SOW: completeness against the applicable baseline, narrative specificity to your system, implementation statuses that match observed reality, and delivery through an assessor-lens QA review.

Avalon says so before being asked. Mitigations offered in the same breath: the named authors' individual federal A&A track records, a small pilot task priced under the simplified acquisition threshold, fixed-price milestone payments so the government never pays ahead of accepted work, and a redacted sample control narrative so you can judge product quality before award.

No, the SSP is one input to the authorization package, not the authorization itself. It's what the assessor tests against and part of what the Authorizing Official signs on, but the assessment and the authorization decision remain government or accredited-third-party functions.

The opposite. An accurate plan with honest "planned" statuses and a real POA&M protects its signatories, a falsely clean plan is the liability, especially under the current DOJ Civil Cyber-Fraud enforcement climate.

Drafting acceleration is real, but unverified generated narratives are exactly the inaccuracy the current enforcement climate punishes. Avalon uses acceleration where it helps and verifies everything through interviews, configuration review, and assessor-lens QA before it ships.