Methodology
How a DASATECH engagement runs
Five phases, fixed deliverables, and a status you can read without asking. The sequence is the same whether the driver is an ATO, a prime’s flow-down or a customer questionnaire.
The five phases
Every engagement runs the same spine.
What changes between a FedRAMP package and an 800-171 gap assessment is the depth of each phase, not the order of them.
Scope
We start from the obligation (the contract clause, the framework, the customer requirement) and work backward to the boundary. Most cost overruns in this work trace to a boundary drawn too wide at the start, so we spend real time here before anyone signs anything.
Assess the gap
A preliminary assessment against the applicable baseline establishes where you genuinely stand. You get a prioritized gap list with effort estimates, which is enough information to decide whether to proceed, defer or reduce scope before committing to the full engagement.
Build and remediate
Documentation is written to your actual implementation through interviews with the people who operate the controls. Where controls are missing, we advise on implementation and review the result. We do not write a narrative for a control that is not there.
Assess and test
Controls are tested through examination, interview and technical testing. Findings are raised as they emerge, not saved for the report, so remediation can start immediately. Every finding is risk-rated and mapped to the control it affects.
Authorize and monitor
We support the authorization decision, answer reviewer questions, and stand up the continuous monitoring cadence that keeps the decision valid , covering scan review, POA&M maintenance, change management and annual assessment preparation.
Schedule
The phases overlap. That is the point.
Documentation and testing run concurrently so remediation begins while assessment is still in progress, rather than after a report lands.
A planning estimate. Actual duration depends on boundary size, evidence readiness and remediation effort.
Working principles
Four rules we hold to on every engagement.
- No surprises in the report. If we find something material, you hear it that week. A report should confirm what you already know.
- Evidence over assertion. A control is satisfied when we have seen it work, not when someone says it does.
- Write for the reader. Deliverables are written for the assessor, agency reviewer or prime who will actually read them.
- Leave capability behind. Your team should be able to run the next cycle with less of us, not more.
Reporting
What you see while the work is running.
Status and emerging findings
A short written status: what was tested, what is outstanding, what we found that you should start working on now.
Evidence tracker
A shared request log showing every artifact we need, who owns it, and whether it has landed. No end-of-project scramble.
Critical escalation
Anything with active exploitation risk is escalated to your named contact the day it is identified, ahead of any report.
Tell us what the contract requires. We’ll tell you what it takes.
A 30-minute scoping call is usually enough to size the gap, name the deliverables and give you a realistic date for authorization.