RMF Categorization and Control Selection

The system and rmf commands use the platform’s public API. They do not calculate baselines or talk to eMASS locally.

Categorize a System

pretorin system categorize <system_id>
pretorin system categorize <system_id> --answers answers.json --preview
pretorin system categorize <system_id> --answers answers.json --complete
pretorin system categorize <system_id> --override trigraph=M-M-H --basis "AO decision basis"
pretorin system categorize <system_id> --clear-override trigraph
pretorin system emass-registration <system_id>

Interactive categorization walks the platform questionnaire group by group, asks only the questions whose show_when condition holds, and defaults each one to the stored answer. Before saving it shows what the answers derive and how many controls they would select, then asks to save. --answers accepts a JSON object keyed by question ID, or an object with an answers field; those answers are applied over the stored ones.

For declared overlays and the hosting vendor, Enter keeps the saved value. Enter none to clear it.

--preview shows the derived trigraph, NSS, impact level, overlays, missing questions, and expected selection size without saving anything. --complete marks the categorization complete.

The platform stores the full list of authorizing official overrides on every save, so the CLI always sends the stored overrides back. --override adds or replaces one (is_nss, trigraph, or cloud_impact_level) and needs a --basis. --clear-override removes one. The eMASS registration command is read only: it prints the platform’s System Registration mapping.

hosting.provider is a vendor ID. Supplying it links that vendor to the system; the next selection recompute can inherit from its responsibility matrix.

Inspect and Tailor Selection

Always name the framework. For the DoD RMF attachment, use dod-rmf:

pretorin system selection <system_id> --framework dod-rmf
pretorin system selection <system_id> --framework dod-rmf --status excluded
pretorin system selection <system_id> --framework dod-rmf --designation common
pretorin system selection vendors <system_id> --framework dod-rmf
pretorin system selection recompute <system_id> --framework dod-rmf
pretorin system selection tailor <system_id> --framework dod-rmf AU-12 exclude \
  --justification "AO tailoring decision"

Selection output includes owned, hybrid, inherited, and not applicable counts plus a page of controls with each one’s status, eMASS designation, provider, and basis. --status filters by why a control is in or out (baseline, dod_cloud_addition, overlay, manual, excluded). --designation filters by common (inherited), hybrid, or system_specific. --offset and --limit page the entries. vendors shows what each linked vendor offers and how many of this system’s controls it covers. Tailoring supports add, exclude, and clear; add and exclude require a justification. The platform owns the resulting selection and recompute state.

Vendor Responsibility Matrices

pretorin rmf seeded-catalogs
pretorin rmf crm-template > responsibility-matrix.csv
pretorin vendor import-crm <vendor_id> responsibility-matrix.csv
pretorin vendor inheritable-controls <vendor_id>
pretorin vendor seed <vendor_id> --catalog big-bang
pretorin vendor clear-inheritable <vendor_id>

import-crm uploads a vendor document with evidence_type=responsibility_matrix and prints the platform’s inheritance import report, including row problems. A 422 response means the matrix was unreadable and the platform stored nothing.