[{"id":"/","path":" ","title":"Platform One","description":"Platform One allows users to deploy a DevSecOps Software Factory and start solving software problems with a 90% solution day 1, instead of starting from nothing.","content":"CALLING ALL PARTY BUS CUSTOMERS AND POTENTIAL PARTY BUS PASSENGERS\nMark your calendars for the following dates. Party Bus will be hosting an \"Ask an Engineer\" Session the last Wednesday of each month through November.\nUpcoming Sessions\nJuly 27th\nAugust 31st\nSeptember 28th\nClick Here To Join The Session!\nWHAT CAN PLATFORM ONE DO FOR YOU?\nPlatform One (P1) is a modern cloud-era platform that provides valuable tooling, hosts CI/CD DevSecOps pipelines, and offers a secure Kubernetes platform for hosting microservices.\n\nAuthorization to go live with your application can be achieved faster than ever by using Iron Bank hardened containers and P1 pipeline security tools. The resulting Certificate to Field (CtF) and Continuous Authority to Operate (cATO) provides developers the ability to push validated code into production on an ongoing basis. This results in shorter development cycles, less debugging, and more rapid feature development.\nDownload DoD-wide approved containers or harden with Iron Bank\nDeploy your own software factory with Big Bang\nGet hands-on experience onboarding with Party Bus\nCNAP\nProvide access to development, testing, and production enclaves\nStay secured with our Cybersecurity team processes\nEXPLORE THE PRODUCTS\nHOW OUR TEAMS HELP\nManages Software Factories for development teams so they can focus on building mission applications\nDecouples development teams from factory teams with DevSecOps and Site Reliability Engineer (SRE) expertise\nHelps instantiate DevSecOps CI/CD pipelines / software factories in days at various classification levels\nBuilds and leverages the DoD hardened containers while avoiding one-size-fits-all architectures\nFully complies with the DoD Enterprise DevSecOps Initiative (DSOP) with DoD-wide reciprocity\nCentralizes the container hardening of 300+ enterprise containers (databases, development tools, CI/CD tools, cybersecurity tools, etc.)\nPLATFORM ONE AND KESSEL RUN JOINING FORCES\nDownload the Memo\nPLATFORM ONE, KESSEL RUN, WE “BELIEVE” SOFTWARE PRINCIPLES\n\nThe USAF's Platform One and Kessel Run teams have been hard at work to converge our technology, services, and data to ensure rapid application portability across key software systems that support our warfighters.\n\nTo do so, we believe it is important to document shared core beliefs that we are pursuing through collaboration of our limited pool of talented software personnel. These principles guide our collaboration, technology decisions, and engagement with industry.\n\nPLATFORM ONE AWARDS\n2020 DEFENSE ACQUISITION\nWORKFORCE AWARD WINNERS\nDavid Packard Excellence\nin Acquisition Award\nSoftware Innovation\nTeam Award\n2021 IMPROVEMENT AND\nINNOVATION AWARDS WINNERS\nTeam of the Year\nPlatform One\nWHO WE SERVE"},{"id":"/services","path":" services","title":"Platform One Services","content":"PLATFORM ONE ENTERPRISE SERVICES\n\nPlatform One provides additional pay-per-use services and contract vehicles to facilitate teams' adoption and move to DevSecOps. The list of services will continuously evolve.\n\nCUSTOM DEVELOPMENT SERVICES\nBuild and deliver new and accredited custom software applications (microservices) by leveraging the Platform One pipeline and following Platform One's DoD Continuous Authority to Operate (cATO) (pay per app)\nTo learn more about these capabilities, please contact af.cso@us.af.mil with Subject: \"Platform One Custom Development Services Question\"\nCLOUD NATIVE ACCESS POINT (CNAP)\nThe Cloud Native Acess Point is available on Cloud One to provide access to Development, Testing, and Production enclaves at IL-2, IL-4, and IL-5 that use Platform One DevSecOps environments by using an internet-facing Cloud-native Zero trust model\nTo learn more about these capabilities, please contact af.cso@us.af.mil with Subject: \"Platform One CNAP Question\"\nPLATFORM ONE CONTINUOUS INTEGRATION\nCONTINUOUS DELIVERY (CI/CD) WITH INFRASTRUCTURE AS CODE (IaC)\nTeams can use existing CI/CD pipelines hosted on Repo One with their current Infrastructure as Code (IaC) code\nIf a custom CI/CD pipeline is needed due to specific program mission needs, check out the Big Bang options\nTo learn more about these capabilities, please contact af.cso@us.af.mil with Subject: \"Platform One CI/CD Options Question\"\nPLATFORM ONE DEVSECOPS MANAGED TOOLS\nPlatform One Enterprise Chat provides a collaboration solutions suitable for connecting developer teams (pay per use): IL-4 (.mil email only) https://chat.il2.dso.mil \nPlatform One All Domain Common Environment (see above, pay per use)\nPlatform One Multi-Level Security Data Transfer (CDS/Diode) (pay per use)\nPlatform One Stack Exchange: knowledge sharing service for software developers and engineers (pay per use)\nTo learn more about these capabilities, please contact af.cso@us.af.mil with Subject: \"Platform One Managed Tools Question\"\nCLOUD NATIVE DNS\nPlatform one deploys a CNCF-graduated authoritative DNS server to provide a highly available, secure central way to manage DNS for dso.mil. This solution centralized DNS management for the organization and allowed us to execute DNS updates in minutes vs. weeks (for IL5)\nCloud-native, agnostic and elastic DNS capability with .MIL and non .MIL capabilities\nFully managed by configuration as code and Git mergers\nRuns on Kubernetes using coreDNS\nENTERPRISE COLLABORATION\nProvides secure collaboration tools to enable those who advance the mission\nMattermost - Communicate with your peers within the DoD anytime/anywhere\nJira - Plan, track, and manage your projects\nConfluence - Create, collaborate and organize all of your work in one place\nPLATFORM ONE TRAINING AND ONBOARDING OPTIONS\n\nCheck out the CSO DevSecOps / DAU training: DevSecOps Training Resources \n\nVirtual Platform One Learning Hub that provides self-service onboarding\n1-day training Session: Introduction to DevSecOps. Overview and understanding of the vision and activities\nOnboarding options for Party Bus\nTo learn more about these capabilities, please contact af.cso@us.af.mil with Subject: \"Platform One Training Question\"\nIDENTITY MANAGEMENT/SSO/PKI\nBrings Single Sign On with various DoD PKI options and MFA options\nBrings Person Entity (PE) and Non Person Entity (NPE) x509 certificate based authentication\nConnects to existing AF, DoD and DIB PKI capabilities\nProvide secure and cloud native, agnostic and elastic capability\nLeverages VAULT capability and provides automated certificate generation, Kubernetes native and allows for automated certificate rotation\nCan be used for code signing, container signing and NPE/PE authentication\nCentralizes/Aggregates logs and pushes to CSSP and vSO"},{"id":"/resellers","path":" resellers","title":"Platform One Official Resellers","content":"WHY A PLATFORM ONE RESELLER\n\nBy leveraging this fast track, applications can be approved to work on government systems faster than ever. Partnering with a Reseller means rapid environment deployment and priority access to platform updates, new services, better security*, continuous feedback, education, and training and container hardening.\n\nAuthorized Resellers are qualified service providers of the Department of Defense Enterprise DevSecOps Technology Stack. Use of Platform One Big Bang environments and Iron Bank Hardened containers enables more secure software operations, leading to continuous Authorization to Operate (cATO).\n\n*Platform One's technologies have been pen tested by the NSA, the US Air Force, and the US Navy.\n\nRequest For P1 Services\nCONNECT WITH OUR RESELLERS\nBOOZ ALLEN\n\nBooz Allen Hamilton, an innovator and pioneer in successful P1 capability implementations, brings credible experience in driving adoption of Agile DevSecOps, Software Factories, and P1 products and services in support of mission critical programs.\n\nLearn More\nBRAINGU\n\nAs P1 subject matter experts with experience in delivering Kubernetes-based DevSecOps platforms, BrainGu knows that the journey to transitioning from an existing legacy software solution to a Cloud-Native/DevSecOps solution can be difficult. We succeed in technology distribution because we respect the importance of the value that legacy technology brings.\n\nLearn More\nECS\n\nECS, ASGN's federal government segment, delivers advanced solutions in cloud, cybersecurity, data and artificial intelligence (AI), application and IT modernization, science, and engineering.\n\nLearn More\nNOVETTA\n\nNovetta, a part of Accenture Federal Services, brings nearly a decade of mission-focused, Agile-based DevSecOps experience to the most challenging National Security/DoD problems.\n\nLearn More\nREVACOMM\n\nRevaComm is a Hawaii-based, minority-owned, 8(a)SDB who has been instrumental not only in building, maintaining, educating, and onboarding Platform One customers to Party Bus, but also in playing a vital role in P1's Big Bang deployment for Party Bus.\n\nLearn More\nSEED INNOVATIONS\n\nSeed Innovations, LLC (Seed) is a woman-owned small business specializing in P1's adoption. Seed has been involved in the development of Party Bus, Big Bang, and Container Hardening (Iron Bank) over the last two years.\n\nLearn More\nWHO WE SERVE"},{"id":"/resources","path":" resources","title":"P1 Resources","description":"Information at your fingertips: guides, documents, and external links to help spread valuable knowledge pertaining to Platform One and the DoD.","content":"Platform One\nIron Bank\nBig Bang\nParty Bus\nCNAP\nCYBER\nDISA Container Guide\nDCCSR Repository\nDevSecOps/DAU Training\nDevSecOps Reference Design\nMemorandum Distribution\nP1 Tool Chain\nASK ME ANYTHING RECORDINGS AND PRESENTATIONS\nCheck out hot topics and presentation slides from previous AMA's currently available on software.af.mil\nExplore More\nSOFTWARE.AF.MIL DEVSECOPS TRAINING RESOURCES\nSelf-learning videos for all levels covering Kubernetes to Service Mesh, literature recommendations, and more.\nLearn More\nHAVE MORE QUESTIONS ABOUT PLATFORM ONE?\n\nIf you have P1 SSO access, click Get Answers to find most of your questions answered on the FAQ page. Click Contact Us for more specific inquiries.\n\nGet Answers\nRequest P1 SSO Access\nContact Us"},{"id":"/who-we-are","path":" who-we-are","title":"Who We Are","content":"WE CARE ABOUT THE PULSE OF OUR ORGANIZATION AND USE IT TO HELP CONTINUOUSLY IMPROVE OUR PROCESSES!\n- Andrew Belk, Chief People Officer\nVISION\n\nAccelerate the DoD's dominance by delivering innovative, trusted technologies today.\n\nMISSION\n\nTransform how the DoD delivers warfighter capability through innovative frameworks, collaborative culture, and secure software.\n\nVALUE STATEMENTS\n\nOur values were determined through a working session that was open-invite to the entire P1 team. The people defined what was important to them instead of having someone tell them what to value!\n\nEMPOWER\nEmpower individuals and teams with the trust to be accountable and grow Platform One into an organization that drives change personally and professionally.\nOBSESS\nObsessively know our customers and solve their challenges by delivering actual, functional solutions instead of arguing about requirements and process. Continue to improve the solution well into the future.\nVALUE\nWe. Value. Diversity. We are committed to Diversity and Inclusion. Employees in our inclusive environments feel appreciated for their unique characteristics and therefore comfortable sharing their ideas and other aspects of their true and authentic selves.\nNOURISH\nNourish a culture of open, safe, candid communication, and decision making at all levels. We accomplish this by a heightened sense of self-awareness and encourage people to know their own faults and continuously work to improve them. When engaged in conversation, seek to understand the other's point of view prior to attempting to change his or her opinions.\nCORE PRINCIPLES\nSCALE\n\nFeatures aren't complete until they are tested, automated, documented, and with training modules.\n\nMISSION OBSESSED\n\nObsessed over the code that will form the baseline for weapon systems across the DoD: ships, planes, tanks, and nukes.\n\nEVERYONE CODES\n\nWhat we do is code. All of us... even if it is 3 hours a week using Youtube videos. No exceptions.\n\nOWNERSHIP\n\nOwn every aspect of what you do, what you write, what you say, and what you use.\n\nSIMPLE AND ROBUST\n\nMake features as if 100,000 developers will use what you've developed.\n\nCONTINUAL LEARNING\n\nWe always look to improve our baseline and our brains.\n\nLIVE IN THE TRENCHES\n\nSuccess or failure is found in the details. Don't ignore them because you don't have time to understand.\n\nNO EGOS\n\nWe will never be the best at everything, so don't claim or try to be. Be open-minded about what others can bring to the table.\n\nINVEST IN PEOPLE\n\nThe best investment you can make is in yourselves. The next best investment you can make is in the people next to you.\n\nWE SERVE\n\nWe exist to help others succeed. When they succeed, we succeed. If you can help someone, do it.\n\nSHOOT FOR THE MOON\n\nBe bold and strive to make monumental changes that sound so crazy people won't believe you... even after you've done it.\n\nSMART DECISIONS\n\nEncourage decisions to be made by the individuals with the most information. If it's a technical decision, that means technical people, even if they are the lowest ranking.\n\nMEET THE LEADERSHIP TEAM\n\nOur leaders range in personality from the Pointy-haired boss from Dilbert to Bill Lumbergh from Office Space but, like, in a good way. They are instrumental in driving the vision for Platform One and our continued growth and improvement. They keep the mood nice and light-hearted while removing blockers and knocking down barriers for our teams. If you want to know why P1 is such a great place to work, learn about our leaders.\n\nLT COL BRIAN VIOLA\n\nMateriel Leader\n\nDUONG HANG\n\nDeputy Materiel Leader\n\nMAJOR CAMDON CADY\n\nChief of Operations and Chief Technology Officer\n\nKEVIN TWIBELL\n\nChief Information Security Officer\n\nPHILLIP \"CASPER\" RECORD"},{"id":"/products/party-bus/service-catalog","path":" products party-bus service-catalog","title":"Service Catalog","content":"CI/CD cATO PIPELINE FLOW\n\nTake your idea and get it to production using our pipelines and Certificate-to-Field (CtF). Click on the tools icon to see\nwhat tools are supported for that phase and the +/- for a quick explanation for that specific stage.\n\nPUSH TO REPOSITORY\n\nA developer will make\nchanges to necessary code\nand achieve revision control.\n\nCONTINUOUS INTEGRATION (CI)\n\nDockerfile scan \n\nDocker File Lint\nFind Unathorized Job\n\nBuild \n\nBuild\n\nUnit tests \n\nLint\nUnit Tests\n\nSca\n\nDependency Check\nFortify\nSonarQube Job\nTruffleHog Job\nCONTINUOUS DEPLOYMENT (CD)\nCONTINUOUS DELIVERY (CD) \n\nBuild image\n\nBuild Image\n\nScan image\n\nTwistlock Scan\n\nDeploy staging\n\nDeploy Staging\n\nE2e tests\n\nE2e Tests\nPen Tests\n\nRelease\n\nRelease Job (Production Only)\nSUPPORTED TOOLS\n\nThe following tools are available in the MDO (Production/Application) Environment where the PB customers live.\n\nCOLLABORATION TOOLS\nCONTAINERIZATION\nBUILD\nUNIT TESTS\nCONTINUOUS DELIVERY\nCONTINUOUS INTEGRATION\nCONTINUOUS DELIVERY\nWHAT DOES cATO ACTUALLY MEAN?\n\nWe, Platform One, build a Continuous ATO from multiple ATOs covering the infrastructure, platform, and deployment process. The infrastructure and platform ATOs cover a majority of NIST 800-53 RMF controls. The DoD CIO and DAF CSO have released multiple guidance documents related to the cATO, click the button below for more information.\n\nDSOP Documents\n\nOnce a team completes the Certificate to Field (valid for one year or until architecture is changed – major release) real-time deployments to production are enabled. The Certificate to Field (CtF) process uses SD Elements to answer the final NIST 800-53 RMF controls that are specific to the application. To be compliant with the DevSecOps Reference Design (PDF) and retain our ATOs, we pull approved images from Iron Bank.\n\nDevSecOps Reference\nSUPPORTED ENVIRONMENTS\n\nUsing CNCF Certified Kubernetes Distributions. (Rancher, Konvoy)\n\nENVIRONMENT\tDEVELOPMENT ENVIRONMENT SUPPORTED (DSOP)\tPRODUCTION (DEVELOPMENT) SUPPORTED (MISSION DEVOPS = MDO)\nIL2 (On C1D)\t\n\t\nIL4 (On C1D)\t\n\t\nIL5 (On C1D)\t\n\t\nS (On S-C2S)*\t\n\t\nTS/SCI (On C2S)*\t\n\n3Q21 (Gitlab, pipelines) Pilot**\n\n(Need license purchases for Anchore, Twistlock, Fortify, Elasticsearch)\n\nWidely supported DSOP environment in 3Q21\n\n*Note: CTF processes are not yet supported\n\n\t\n\n*Supported by ODIN\n\nSIPR/JWICS whitelisted services:\n\nUDL - Applications have the responsibility to develop a system account to pull data in, and push data out.\nC2IMERA\nWHAT IS AVAILABLE\n\nWhat is available for your development/collaboration environment and in the MDO (Production/Application) Environment\n\n***Supported technologies between the hours of 0800 CST-1800 CST M-F only.\nThese environments are available for use 24X7, but support is not guaranteed outside of these hours.\nPlatform One reserves the right to discontinue support to current services in interest of security and maintaining our cATO.\n\nFeature Type\t\nPB fully supported, part of the support agreement for PB customers. Part of the PB Managed Service\n\n\n\tIB approved containers, but not supported by PB.\n\nSee Guild - App Teams Mattermost Channel for community discussion \n\tAdditional Features\n\nRoadmap\n(in the future, unsupported at this time)\n\tNot Supported\n(IB rejected or Vendor lock-in)\nDSOP - this is what is available for your development/collaboration environment. PB maintains complete control over these capabilities. These features are not available for PB customer teams to configure, manage, or change. Application Teams will be given access to certain tools only. Anything beyond the cATO requirements is a roadmap item. See Party Bus Tech Stack for more info.\nPlatform Services: This is the PB platform. Services are not available for individual teams to configure. See Party Bus Tech Stack for more info.\tAll of Big Bang Core\n\nBig Bang Addons (except Nexus)\n\nSupported Fortify\nConfluence\nJira Big\nBang 3rd Party\n\nCommunity Supported:\nmysql\npostgres\nSee the Party Bus Tech Stack/PaaS/Release Notes (coming soon)\n\tNone at this time\tBig Bang Add-ons: Nexus, Anchore\tNone at this time\nPipeline Tools\n\nSee MDO Guidance for more information\t\nGitlab Premium\nFortify\nSonarqube\nTwistlock\nTrufflehog\nOWASP Dependency Check\nOWASP Zap\nArgoCD\nSDElements\n Launchboard (Beta)\n\t\t\t\nBackup\tVelero\t\t\t\nThis is what is available in the MDO (Production/Application) Environment. This is where the PB customers live.\nPersistent Storage Solutions**\t\n Amazon RDS (multi-tenant only)\nAurora PostgresSQL\nMySQL\nMinIO (Native Object Storage)\nCommunicate with S3 through MinIO - No direct link to S3\n\t\nAny Iron Bank image - to be used at customer risk, no Party Bus support is provided.\nProven Iron Bank approved customer integrations in their own BB environment.\n\t\nFileServer (CDN)\n\tAny and all provided cloud services (Lambda, S3 etc)\nLanguages\t\nNPM based\nTypeScript/JavaScript\nAngular\nReact\nNode.js\nVue\nJava (Maven or Gradle build engine)\nPython (built in python commands)\nGolang (built in go commands)\n.NET-Core (built in .NET-Core commands)\nC# with .NET 3/5 Framework beta\nC++ - beta (Toolset: gcc, g++ v.10, cmake, conan)\nRuby (bundler only, other Ruby package managers are not supported)\nPHP (Composer only, other PHP package managers are not supported)\nSee Pipeline Templates Repository\n\t\t\tRust (Fortify/Sonarqube cannot scan)\nSupported Message Queues\t\nKafka\n\t\nAny Iron Bank image - to be used at customer risk, no Party Bus support is guaranteed unless using the Party Bus Kafka Managed Service. RabbitMQ is a message queue option that customers have successfully self-managed.\nProven IB approved customer integrations in their own Big Bang environment.\n\tNone at this time\tAny and all provided cloud services unless otherwise specified (SNS/SQS)\n\nNifi - approved in IB, but due to authentication and installation issues, customers will not be able to install and use Nifi in the Party Bus environments.\nEmail Services\tNone at this time\tNone at this time\tTesting email options - release date TBD\tPB explicitly does not allow emails.\nWeb Servers\t\nOther Containerized Web Servers that are Iron Bank approved (e.g. NGINX, Tomcat, .php Apache)\n\t\nAny Iron Bank image - to be used at customer risk, no Party Bus support is guaranteed.\nProven Iron Bank approved customer integrations in their own Big Bang environment.\n\tNone at this time\tAny and all provided cloud services\n**Data distribution is subject to the data owner permissions. P1 does not offer a data platform for distribution. It is up to the Application to handle this data appropriately (JWT token). P1 does not offer any data cleaning, remediation, data spill etc. This is up to the application team. Direct Database access is not permitted.\nIngress is only allowed on 443.\nAll containers must come through Iron Bank. See the Iron Bank onboarding found here.\nUNSUPPORTED RDS/STORAGE\n\nAll the below are 'use at your own risk'.\n\nThis means the Product Team is responsible for backups and any data loss.\n\nMongoDb\n\nPlease reference the Unsupported Database Guidance\nUNSUPPORTED LANGUAGES\n\nRust\n\nUNSUPPORTED GENERAL\n\nMulti language project (One language per project is allowed)\n\nTECHNICAL FIT\n\nPlatform One expects a technical diagram and a dockerfile be provided at the technical fit meeting. The Party Bus anchors can assist in the creation of the technical diagram and dockerfile.\n\nBelow are examples.\n\nTechnical Diagram\nExample Dockerfiles\nARE YOU READY TO START YOUR PARTY BUS JOURNEY?\n\nView Community Contributions through the BBTOC.\n\nContact Us"},{"id":"/products/party-bus","path":" products party-bus","title":"The Party Bus","description":"The environment and services you need to develop and deploy your software application","content":"WHY PARTY BUS?\nPARTY BUS IS A cATO ENABLED DEVSECOPS SERVICE\nFor government software programs who need rapid development of approved, working mission applications to warfighter.\nWe provide a non-vendor locked, CNCF kubernetes based platform.\nWe provide a secure, multi-tenant, and multi-classification environment with Staging and Production capabilities.\nWe stand out by allowing our customers to field applications with cATO'd templatized pipelines\nONBOARDING ONTO PARTY BUS\n\nLeverage a Multi Tenant DevSecOps environment with our environment and services\n\nSERVICE CATALOG\n\nThe cost of each program office standing up their own DevSecOps environment can be saved by using Party Bus.\n\nCheck out the service catalog to see what is included when you are a Party Bus customer.\n\nView Our Services\nWHAT YOU'LL LEARN IN OUR WORKSHOPS\n\nGet hands-on experience and training with our rapid workshop to stand up a hello world pipeline with a templated app through Party Bus.\n\nAgile & UCD Methodologies\n\nPaired Programming\n\nTest-Driven Development\n\nCertificate to Field (CtF)\n\nExplore Onboarding Process\nParty Bus Process\nWE MOVE FAST, AND WE MOVE SMART\n\nThe Party Bus team will be measuring twice and cutting once. We believe the sooner we can get you squared away on our level of standards (which is high, why else would we invite you to join our elite team of products and services), the sooner you can serve the users and warfighters within DoD that need your product or solution yesterday.\n\nHAVE MORE QUESTIONS ABOUT PARTY BUS?\n\nClick Get Answers to find most of your questions answered on the FAQ page. Click Contact us for more specific inquiries.\n\nGet Answers\nContact Us\nAsk An Engineer"},{"id":"/products/party-bus/onboarding","path":" products party-bus onboarding","title":"Party Bus Onboarding","content":"PROCESS OVERVIEW\nINTAKE REQUEST\n\nOur Customer Success Team gains an understanding of your application\n\nCONDUCT TECHNICAL FIT\n\nCollaborate with Mission DevOps Engineers in a Technical Fit Session\n\nPRICING QUOTE\n\nCustomer Success and Acquisitions teams to finalize your pricing quote\n\nPARTY BUS WORKSHOP\n\nLearn the Party Bus way to onboard, provision, and procure pipelines and environment for your application and continuously deliver\n\nSTEPS TO PARTY BUS SUCCESS\n01.\nINTAKE REQUEST\n\nStep One Resources:\n\n• Intake/Contact P1 Request\n• Party Bus Service Catalog\n• Intake Questions \nWHAT IS PARTY BUS?\n\nParty Bus is a Multi-tenant continuous ATO'd, declaritve and opinionated environment. This means our team of engineers provision and configure pipelines for your team so you can focus on your software.\n\nEnsure Party Bus is the right fit for you and your team by reviewing our service catalog prior to a Tech fit session with one of our experts.\n\nDuring Intake our Customer Success Team will collaborate with you to provide all the essential information about the Party Bus, your application, and review the Party Bus Service Catalog.\n\nWHAT DO WE NEED FROM YOU?\nTeam Technical lead, Government POC, and development team members info.\nArchitecture diagram listing application containers, tech stack, APIs, DBs, frameworks and other dependancies.\nDocker containers (needed before pipelines are built)\n02.\nTECHNICAL FIT\n\nStep Two Resources:\n\n• Party Bus Service Catalog\n• Docker File Examples \nWHAT IS THE TECH FIT?\n\nOur team will contact you to schedule a Technical Fit with our PB Engineers. Together we'll review your tech stack, current architectural set-up, dependencies and usage requirements. This step ensures a true fit for your application and provides the best Party Bus experience.\n\nWHAT DO WE NEED FROM YOU?\n\nReview technical elements that are supported in the Party Bus Service Catalog resource.\n\nDURING THE TECHINCAL FIT:\n\nYou'll step us through your technical and architectural overview of your application. Bring Docker Files and prepare questions to ask Party Bus Anchors. Getting an understanding of your application allows us to get a perspective into the current state of the application, so we can suggest and adapt it for future state success.\n\nThe PB Anchors will determine the application is a good fit. If it is approved, then you'll move on to the Pricing Quote Phase.\n\nIf your application is not accepted, then a team member will communicate what adjustments are necessary to refactor your application, or outline why Party Bus may not be ideal for your application.\n\n03.\nPRICING QUOTE\n\nStep Three Resources:\n\n• Party Bus Service Catalog\nCONGRATULATIONS! THE APP IS A GOOD FIT!\n\nAfter the tech fit is complete, your Party Bus requirements are evaluated by our Customer Success and Acquisitions teams to finalize your pricing quote.\n\nYou will be assigned a Business Account Manager when your quote is complete. This individual will guide you through the steps to complete the contracting and payment processes.\n\n04.\nACCESS & PARTY BUS WORKSHOP\n\nStep Four Resources:\n\n• P1 SSO Self-Registration\n• 2875 Documents and Instructions \n• Party Bus Service Catalog\nYOU'RE ON THE PARTY BUS!\n\nAt this point, you're officially part of the Party Bus. Your project has been funded.\n\nOUR TEAM WILL PROVIDE ACCESS TO THE FOLLOWING TOOLS:\n\nGitlab; Mattermost; Jira; Confluence; Pipeline tools.\n\nDon't have access to your team's tools and pipelines? Email our team.\n\nNext, sign up for the required 3-Day Party Bus Onboarding Workshop:\n\nProduct teams and developers attend a 3-day session\nProduct Managers attend a 1-day session\n\n\n\nYou may need to associate your Platform One account with your CAC to access Party Bus Tools and Pipelines. Fill out paperwork if you don't have a CAC to associate with your account. See resources above.\n\nNEED ASSISTANCE?\n\nGet in touch with us\n\nContact us\n\nOr get in touch with a Platform One Contact\nor our Party Bus Onboarding Contact"},{"id":"/products/big-bang/onboarding","path":" products big-bang onboarding","title":"Big Bang Onboarding","content":"CUSTOMER ON-BOARDING GUIDES\n1 DAY WORKSHOP\n\nAn introduction to learn about Big Bang products and associated technologies.\n\n9/07/219/21/2110/05/2110/19/21\n1-WEEK ENGINEER COHORT\n\nAfter attending a workshop experience a deep dive into the Big Bang Deployment with hands on labs.\n\n9/28/2110/12/21\nWORKSHOP AND ENGINEER COHORT OVERVIEW\nBIG BANG WORKSHOP\n\nWHO SHOULD COME?\n\nEngineers & Developers interested in learning more about the Big Bang tech stack and how it can help you kick-start a software factory.\nView Workshop Prerequisites\n\nTOPICS COVERED\n\nPlatform One & Big Bang Introduction\nThe Core Big Bang Stack\nKubernetes Basics\nThe Big Bang model of GitOps\nMonitoring and Logging Capabilities\nIstio & Kubernetes Networking\nAdditional Big Bang Services & Apps\n\nHOW TO REGISTER\n\nPlease click the link below and enter the following password to register: BigBangWorkshop\nRegister For A Workshop\nBIG BANG ENGINEER COHORT\n\nWHO SHOULD COME?\n\nSRE/Operations Engineers interested in deploying a Big Bang Cluster into their own environment. Below is an overview of topics we cover during the course.\nView Engineer Cohort Prerequisites\n\nDay 1:\n\nOverview of Platform One\nBig Bang\nLab Access\nKubernetes Refresher\n\nDay 2:\n\nSecrets Management\nGit Repo Setup\nDeployment of Big Bang\n\nDay 3:\n\nSecurity Tools\nExtending Big Bang\n\nDay 4:\n\nTake Home Lab\nHAVE QUESTIONS ABOUT ONBOARDING SESSIONS?\nGet Answers\nContact Us"},{"id":"/products/big-bang","path":" products big-bang","title":"Big Bang","description":"Big Bang is a DevSecOps platform built from DoD hardened and approved packages deployed in a customer owned Kubernetes cluster.","content":"EMPOWERING YOU TO CREATE CUSTOM ENVIRONMENTS FOR YOUR MISSION\n\nBig Bang will help you build a custom software factory for your specific mission needs to enable faster development and deployment of your mission applications.\n\nTHE BIG BANG ADVANTAGE\nAVOID VENDOR LOCK\n\nBig Bang is Kubernetes distro-agnostic, meaning you can pick between Upstream, Rancher, Konvoy, Tanzu Kubernetes Grid, or OpenShift Container Partner.\n\nFASTER ATO VIA RECIPROCITY\n\nOur Platform is accredited DOD wide and we can work AO to AO to ensure reciprocity.\n\nWIDE RANGE OF TOOL CHOICES\n\nWe offer multiple tools at each stage of CI/CD pipeline. The tool choices can be customized to your preference and to the programming language of your choice.\n\nBIG BANG RESOURCES\nGETTING STARTED\n\nOur Platform is accredited DOD wide and we can work AO to AO to ensure reciprocity.\n\nQuick Start Guide\nPRODUCT RELEASE NOTES\n\nCheck out the latest Release Notes.\n\nRelease Notes\nOPEN SOURCE CONTRIBUTIONS\n\nWe are hard at work building an open-source platform but we need your help.\n\nGet Involved!\nLICENSING EXPECTATIONS\n\nOur core platform is open source with extensible enterprise-level capabilities. Please read our report on licensing expectations\n\nLicensing Info\nResellers\nTHE BIG BANG STAGES\n\nStage 1 - We create your DevSecOps (DSOP) Software Factory. We set this up for you.\n\nStage 2 - You use the DevSecOps (DSOP) Software Factory to build and deploy your mission applications. You run these pipelines to build and deploy mission applications any number of times.\n\nWE MOVE FAST,\nAND WE MOVE SMART.\n\nThe Big Bang team will deploy a Software Factory with tools that are built for your specific mission needs. We believe the sooner we can get you squared away on our level of automation and security standards (which is high, why else would we invite you to join our elite team of products and services), the sooner you can serve the users and warfighters within DoD that need your product or solution yesterday.\n\nREADY TO PROCURE BIG BANG SERVICES?\nContact Us"},{"id":"/products/iron-bank","path":" products iron-bank","title":"Iron Bank","description":"Iron Bank is Platform One's authorized, hardened, and approved container repository that supports the end to end lifecycle needed for modern software development.","content":"ANNOUNCEMENT!\n\nIron Bank is happy to announce the initial release of the Acceptance Baseline Criteria (ABCs) and Overall Risk Assessment (ORA) for Iron Bank containers. For additional information regarding this announcement, including links to the existing ABC and ORA documents, please see our README on Repo One.\n\nABC/ORA Documentation\nWHY IRON BANK?\nAutomates, secures, and accelerates the approval process of commercial and open source containers to be used within the DoD with DoD-wide reciprocity\nBrings accredited software to the DoD using processes and procedures that are faster and more efficient than other methods\nProvides continuous monitoring of approved images\nMaintains continuously updated containers so that developers have access to the latest tools\nProvides a toolbox of commonly used and secured capabilities for mission apps\nProvides end-to-end management of container justifications for known vulnerabilities and container approval process via Vulnerability Assessment Tool (VAT)\nAssists vendors with the hardening process of containers\nThe Iron Bank website offers a view of all approved applications and provides any necessary details in regards to the application\nRegistry One is a fully compliant Open Container Initiative registry. All containers found under the Iron Bank project are guaranteed to be approved\nRepo One is the central repository for the source code to create hardened and evaluated containers for the DoD\nHOW DO WE DO IT?\n\nWe work with the open source community and commercial vendors to centralize a hardened and approved version of an application that is easily accessible to the entire DoD. By leveraging our Certificate to Field (CtF) process, the DoD community can quickly and easily deploy applications at unprecedented speed.\n\nRegistry One\nPROCESS HIGHLIGHTS\n\nThe Iron Bank approval process centralizes and standardizes application hardening throughout the DoD. This information is stored in Repo One.\n\nEvery 12 hours applications are built and scanned again for findings\n\nApplications are continuously updated to the latest version\n\nBody of evidence that is public facing and readily available for use\n\nDISA STIGs, CIS benchmarks, and best practices applied\n\nExplore Iron Bank\nRepo One\nONBOARDING\n\nInterested in submitting a container to be hardened and published on Iron Bank and Registry One? Check out the Contributor Onboarding Guide and see how to successfully scan and harden your container(s) through the DevSecOps Platform.\n\nOnboarding Guide\nOnboarding Checklist\nHow To Justify/Address CVEs\nONBOARDING PROCESS\n\nWant to learn more about Iron Bank Onboarding Process? Watch this video to learn about the processes involved throughout the various stages of the hardening process. You can refer to the Onboarding Presentation below for reference during the video.\n\nOnboarding Presentation\nHOW DO I CONTRIBUTE CONTAINERS TO IRON BANK TO BE HARDENED?\n\nBefore contributing application containers, you should first make sure the application you are contributing is not already in the Iron Bank. If the application/container image does not exist, requests can be made with the Iron Bank Onboarding team for accreditation. Please complete the Iron Bank Onboarding Request.\n\nIron Bank Onboarding Request\nInternal Hardening Request\nIRON BANK GET UNSTUCK/AMA WORKING SESSIONS\n\nNeed some help with your containers getting through Iron Bank? Have questions on where things are at? Are you feeling stuck and want to figure out next steps? This is the meeting for you! Come meet with the Iron Bank leadership and engineers to get answers to your questions.\n\nRegister in advance for the meeting at the link below. After registering, you will receive a confirmation email containing information about joining the meeting.\n\nRegister Now\nIRON BANK ONBOARDING SESSIONS\nEvery Wednesday at 1530-1630 EST\n\nWe will be giving an overview of the Iron Bank process, and how to get an application through for the first 30 minutes and then we will be answering your questions. By the end of this meeting, you should know the next steps for you to take and where to find all the necessary documentation.\n\nRegister in advance for the meeting at the link below. After registering, you will receive a confirmation email containing information about joining the meeting.\n\nRegister Now\nIron Bank Diagram\nDO YOU HAVE FEEDBACK FOR IRON BANK?\n\nWe are always looking to improve our processes to meet our vendor's needs.\n\nLeave Feedback\nPULLING HARDENED CONTAINERS FROM REGISTRY ONE\n\nAll containers under the Iron Bank project are officially approved. See the following diagram on how to manually pull containers from Registry One. Automated pull capabilities coming soon.\n\nLaunch Registry One\n1. Click \"ironbank\" located under Project Name\n2. Click \"Repositories\" in the top menu bar\n3. Find an image to pull and click into the image\n4. Click the stacked document icon under \"Pull Command\" to copy the pull command to your clipboard\n5. Use the copied command in your terminal window\nPulling Containers\nHOW DO I USE A HARDENED CONTAINER AT A MULTI-SECURITY LEVEL?\n\nApplications are typically approved at multiple Impact Levels (IL). Each organization is welcome to accept reciprocity with our approvals, but may choose to do additional assessments such as an Intelligence Review. We are working on automatically transferring images from lower classification levels to higher classifications for immediate use.\n\nTHE IRON BANK PIPELINE\n\nEvery container must pass each phase of the Iron Bank pipeline to be available on Iron Bank and Registry One. Passing these six phases results in a container being signed and accredited.\n\nLearn More\nInitialization\nAntivirus Scan\nBuild\nScanning\nCheck CVEs\nPublish\nIron Bank Pipeline\nFEEDBACK FOR OUR ONBOARDING ON ANYTHING ELSE?\nOnboarding Feedback\nAMA Feedback\nHAVE MORE QUESTIONS?\n\nCheck out our FAQ page.\n\nFAQ"},{"id":"/products/iron-bank/getting-started","path":" products iron-bank getting-started","title":"Getting Started With Iron Bank","content":"STEP ONE: IMPORTANT FIRST STEPS\n1\n2\n3\n4\nIMPORTANT FIRST STEPS\n\nBefore moving on to the next section please make sure you have completed the following\n\nPlease reference this guide for what you need to do to be ready for Iron Bank.\nThe Iron Bank Onboarding Sessions are held every Wednesday from 1530-1630EST. You can register for an onboarding session in advance here.\nAlthough not required, you can join the AMA session to answer any questions you might have. These sessions are held every Wednesday from 1630-1730EST. You can also register for this session in advance by clicking here.\n\nNote: After registering for either meeting, you will receive a confirmation email containing information about joining the meeting.\n\nI have attended an onboarding session or have reviewed the virtual materials. *\n\nRead the above paragraph for more information. We highly recommend attending the onboarding session prior to submitting a container hardening request.\n\nYes\nNo\nOther:\nNext\nHAVE MORE QUESTIONS?\n\nCheck out our FAQ page.\n\nFAQ"},{"id":"/products/cnap","path":" products cnap","title":"Cloud Native Access Point","description":"CNAP is available on Cloud One to provide access to development, testing, and production enclaves at IL-2, IL-4, and IL-5","content":"CNAP CAPABILITIES\nBrings a full Zero Trust stack enforcing device state, user RBAC, and Software Defined Perimeter/Networks based on Google BeyondCorp concepts\nAllows access to Cloud One (AWS GovCloud and soon Azure Government) and Platform One without a bCAP or IAP\nAllows access from thick clients on BYOD, government owned devices (both mobile and desktop) while enforcing their device states by using AppGate as a zero trust client.\nAllows for VDI options for zero / thin clients\nEnables internet egress at IL5 in Dev enclaves\nBrings DMZ Network /Perimeter stack with break and inspect, IDS / IPS, WAF capability, full packet capture as an elastic Cloud based stack\nBrings Single Sign On with various DoD PKI options and IL2 MFA options.\nCentralizes/Aggregates logs and pushes to CSSP\nCNAP OVERVIEW\nMore Info\nAppGate\n\n**User will need P1 SSO access to view the pages\n\nMORE INFORMATION TO ENABLE YOUR MISSION\nAWS CNAP deployment overview\nCommon Components\nUse cases for IL-2 (Internet Accessible Workloads) and IL-4/5 (Non-Internet Accessible Workloads)\nGeneral Setup\nHAVE MORE QUESTIONS ABOUT CNAP?\n\nBehind the SSO, you'll be able to find most of your answers in the FAQ page categorized by Authentication, Client Connectivity, Monitoring, and much more! For more specific inquiries, click Contact Us.\n\nFAQ\nCONTACT US"},{"id":"/products/cybersecurity","path":" products cybersecurity","title":"CyberSecurity","description":"Platform One provides integrated cyber testing, monitoring, and event management for the infrastructure, platform, all enterprise services, and customer applications.","content":"ABILITY TO FIGHT AND WIN IS SOFTWARE DEPENDENT\nDEPENDENCIES\n\nThe capabilities of weapons systems and other critical systems are defined by the speed of software development and deployment\n\nCHALLENGES\n\nThe legacy approach to software development is a leading source of risk to DoD: it takes too long, is too expensive, and exposes warfighters to unacceptable risk\n\nINNOVATIONS\n\nModernize DoD software development to become safer, more automated and test driven by fundamentally changing the skillsets, processes, and platforms.\n\nPROGRAMS CAN SAVE WITH PLATFORM ONE\n\nThe Continuous Authorization approach saves program teams months of approval process time along with millions of dollars\n\n18 MONTHS\n\nPMOs/PEOs save per Program\n\n$12.5 MILLION\n\nSaved per 5 years of Program Planned time\n\n100 YEARS\n\nPlanned Program Time saved over 30+ Programs in P1’s first year\n\nLearn More\nTRADITIONAL AUTHORIZATION APPROACH\n\nAuthorize System\n\nSystem Development and Testing\nAuthorize System Security Controls\nAuthorize System\nOperate System\nINDUSTRY AVERAGE PERFORMANCE*\n\n(Traditional Development Approach)\n\nDeployment Frequency: 30-180 days\n\nLead Time for Changes: 30-180 days\n\nTime to Restore Service: 7-30 days\n\nChange Failure Rate: 46-60%\n\nCONTINUOUS AUTHORIZATION APPROACH\n\nAuthorize Platform, Process, Team\n\nAuthorize the Platform\nAuthorize the DevSecOps Process\nAuthorize the Team\n\nTeams that run the Platform\n\nTeams that Create, Build, Secure and Operate the Software Product\n\ncATO PERFORMANCE TARGETS*\n\n(Industry Elite DevSecOps Performance)\n\nDeployment Frequency: Multiple/day\n\nLead Time for Changes: Less than 1 day\n\nTime to Restore Service: Less than 1 hour\n\nChange Failure Rate: 0-15%\n\n*DORA Accelerate State Of DevOps Report\nDEVSECOPS LIFECYCLE FOR CtF AND cATO PROCESSES\n\nClick on the links below for an in-depth look into CtF requirements and cATO details\n\n SECURITY\n CONTROL GATE\n\nCertificate to Field (CtF) from Platform One is required to move your product into production within the Continuous Authority to Operate (cATO) framework.\n\nCtF Requirements\n\nThe cATO accredits the process, the people, and the culture that will continuously allow the delivery of applications through the rapid-delivery model and maintain the security required by the DoD.\n\nc\nATO Process\nHave more questions about platform one?\n\nClick Get Answers to find most of your questions answered on the FAQ page. Click Contact Us for more specific inquiries.\n\nFAQ\nCONTACT US"},{"id":"/products/cybersecurity/dsopTimeline","path":" products cybersecurity dsopTimeline","title":"DevSecOps","content":"RAPIDLY DELIVERING SOFTWARE INFLUENCES\nTHE ABILITY TO FIGHT AND WIN\nTraditionally, the legacy process has taken years and millions of invested dollars for applications to get deployed. Although vetted through the proper risk assessment and security processes, by the time an application is completed, security measures have been updated and accreditation becomes outdated. With Platform One, you will see exponential savings of time and money using the DevSecOps / Agile method, while still focusing on cybersecurity.\nTRADITIONAL LEGACY PROCESS\nTimeline of how long a mission application would take going from acquisition to deployment\nTHE CAPABILITIES OF WEAPONS SYSTEMS AND OTHER CRITICAL SYSTEMS ARE DEFINED BY THE QUICKNESS OF SOFTWARE DEVELOPMENT AND DEPLOYMENT\nTHE BENEFITS OF THE DEVSECOPS / AGILE PROCESS\n\nAgile processes focus on interative development cycles in which feedback is continuously reintegrated, while DevSecOps methodologies emphasize security at the earliest stages of development\n\nA CONTINUOUS CYCLE OF RESEARCH, DEVELOPMENT, TESTING, AND SECURITY\nCyber Scanning - 1\nSoftware Assurance - 2\nTesting - 3\nAccreditation - 4\nDevSecOps & Agile Savings"},{"id":"/products/cybersecurity/ctf","path":" products cybersecurity ctf","title":"Certificate to Field","description":"The CtF is the application-level accreditation that allows your application to run in a specific environment within the DoD.","content":"WHAT IS THE CERTIFICATE TO FIELD (CtF)?\nWHO NEEDS A CtF\n\nA CtF must be issued for all applications developed within Platform One to allow them to operate in a production environment at the specified Impact Level (IL) or classification within the DoD.\n\nDATA USAGE\n\nA CtF must also be issued for any application that uses production data regardless of environment (Test/Staging/Production), IL, or Classification.\n\nCtF EXPIRATION\n\nOnce a CtF is issued, it is good for one year from the date of issuance, unless the product moves to the next major version or implements an architectural change that would require modification of the controls being assessed.\n\nTHREE MAIN PARTS TO RECEIVING A MISSION APPLICATION CtF ACCREDITATION\nPASSING THE PIPELINE\nPlatform One will create and deploy a CI/CD pipeline to your repository comprised of a full suite of industry standard testing tools. This pipeline will make sure that your application code is secured and ready to be deployed to the DoD.\nYou will be able to see a visual representation of your pipeline on GitLab - the CI/CD section allows you to view each stage and its status (green check marks for passing, red Xs for failures). You can also view the output of each stage.\nWhen the time comes for CtF approval, the security team will review the pipeline and each individual stage to make sure that you have properly passed each stage without errors or warnings.\nHARDENED DOCKER IMAGES\nPlatform One provides an entire suite of hardened images available to teams through Iron Bank.\nHardened images are stripped-down versions of Docker images approved to be used within the DoD.\nHardened Docker images ensure the application you deploy into the Platform One Kubernetes clusters follows all security checks. Failure to do so results in the image-checking stage failing in the pipeline.\nExplore Iron Bank\nSDELEMENTS\nSDElements is a security questionnaire based on multiple NIST standards that ensures your application follows best security practices.\nThe questionnaire is comprised of questions about your application's tech stack, how it connects, how it sends data, etc.\nThere is 1 questionnaire per application service (UI, API, any other service your application runs).\nSDElements will generate 50+ questions that your team will need to answer to address and explain how your application tackles industry standard practices.\nHIGH-LEVEL CTF STEPS\n\nThe CtF process is comprised of three main phases and ends with a CtF meeting\n\n1. ONBOARDING\nStart your CtF journey and have your first engagement with the cybersecurity team. The cybersecurity team will provision all the required tools for CtF and explain each element to you so you understand what is required. The goal is to ensure there are no major roadblocks or hiccups down the road.\n2. WORK\nDuring this phase, you will work on your applications. You will leverage the tools provisioned in the cybersecurity onboarding process to ensure you meet the intent of the CtF while designing and developing your application's Minimal Viable Product (MVP).\n3. ASSESSMENT\nOnce you complete your MVP and all the items in your CtF checklist (more on this soon), the cybersecurity team will start their assessment of your application and its services. Expect some back-and-forth during this phase to address incomplete or vague items, or those that do not meet the intent of the control.\n4. CTF MEETING\nAfter the assessment is complete, your team will participate in the CtF meeting. The meeting includes all stakeholders and consists of a review of your application, its architecture, and the controls. The Platform One Chief Information Security Officer will then make the CtF issuance determination for the application.\nLearn More\nHAVE MORE QUESTIONS ABOUT PLATFORM ONE?\n\nClick Get Answers to find most of your questions answered on the FAQ page. Click Contact Us for more specific inquiries.\n\nFAQ\nCONTACT US"},{"id":"/products/cybersecurity/cato","path":" products cybersecurity cato","title":"cATO = CONTINUOUS AUTHORIZATION","description":"Continuous Authority to Operate (cATO) allows rapid delivery to the DoD","content":"WHAT IS CONTINUOUS AUTHORITY TO OPERATE (cATO)?\nTRUST\n\nTrust is established through assessments and authorizations of the process, the team, and the platform for managing the cyber risk of an application coming out of a software factory.\n\nRISK\nDETERMINATION\n\nApplication change risks are mitigated by the use of DevSecOps control gate pass/fail rules and security automation findings and analysis.\n\nSECURE\n\nIdempotence and immutability provide for consistent, repeatable, and secure application support infrastructure and near real-time visualization of the security posture.\n\nCOMPONENTS TO cATO\nFOCUS ON THE MISSION\ncATO places the focus on the mission software rather than the platform. Platform One was created so that DoD teams could focus primarily on their mission applications, rather than having to develop a platform and software factories.\nFEEDBACK & MONITORING\ncATO replaces the traditional linear authorization process and works in a continuous process. Security requirements are met due to continuous monitoring and always stay in compliance.\nDEVSECOPS\nDevSecOps (Development Security Operations) provides one of the main benefits of cATO. Automatically injected sidecar containers provide risk reduction alongside Kubernetes. Infrastructure as Code (IaC), continuous intregration, continuous deployment, and security throughout provides insight on risks.\nMVP'S STREAMLINE DEVELOPMENT\ncATO saves time in later development cycle, as risk and errors are continously reduced during deployment activities.\ncATO METHOD\ncATO PROCESS\n\nThe Continuous Authorization approach provides authorization of platform(s), processes and teams. The platform (including development, test, pre-production, and production environments) is assessed and authorized using Risk Management Framework (RMF) processes. The platform incorporates continuous monitoring with behavior modification/zero trust enforcement and integrated Tier 2 CSSP support.\n\nThe cATO process is adaptable to differences in component/change risk, urgent mission needs, and the AO's risk tolerance. cATO moves from compliance-driven risk management to data-driven risk management.\n\nAuthorizing the team allows review of the program office personnel experience, clearances, skills, and certification requirements. Critical team members are interviewed to assess their knowledge of the program office's DevSecOps continuous authorization process and their understanding of the AO's risk tolerance. Integrated training workshops and tabletop excercises are held to ensure that individual teams work collaboratively within the continuous authorization process. Ongoing team performance is monitored against the outcome metrics established for the program.\n\nHAVE MORE QUESTIONS ABOUT PLATFORM ONE?\n\nClick Get Answers to find most of your questions answered on the FAQ page. Click Contact Us for more specific inquiries.\n\nGet Answers\nCONTACT US"},{"id":"/residency","path":" residency","title":"Residency","description":"Are you ready to take the leap? Consider joining Platform One and the DevSecOps Initiative in the experience of a lifetime by joining us for a 6-month remote Residency. Here’s your chance to learn a skill, hone a talent, experience a different culture and put your fingerprints on the transformation of DoD in one of the most crucial moments yet.","content":"PURPOSE\nPlatform One is seeking applicants for our competitive 6-month residency program! This program is intended to build a cadre of DevSecOps users and professionals to accelerate DevSecOps adoption and capabilities within the DoD, and directly support the DoD DevSecOps initiative. Legacy software acquisition and development practices in the DoD do not provide the agility to deploy new software “at the speed of operations”. In addition, security is often an afterthought, not built in from the beginning of the lifecycle of the application and underlying infrastructure. DevSecOps is the industry best practice for rapid, secure software development.\nDevSecOps is an organizational software engineering culture and practice that unifies software development (Dev), security (Sec) and operations (Ops). The main characteristics of DevSecOps are automation, monitoring, and security application in all phases of the software lifecycle: plan, develop, build, test, release, deliver, deploy, operate, and monitor. In DevSecOps, testing and security are conducted earlier in the development process through automated unit, functional, integration, and security testing - this is a key DevSecOps differentiator since security and functional capabilities are tested and built simultaneously.\nRESIDENCY DETAILS\n\nProspective candidates are military (CONUS - Active Duty) and DoD Civil Service with the following skill sets:\n\nSOFTWARE DEVELOPMENT\nCYBER SECURITY\nDESIGN THINKING\nSOFTWARE PRODUCT MANAGEMENT\nACQUISITIONS / CONTRACTING\nSelected program residents will be full time employees at Platform One and will work remotely on one of the various Value Streams at Platform One: Big Bang, Party Bus, Iron Bank, CNAP, Cyber, or Acquisitions. Program residents will learn and participate in the best application development practices, learn to use, manage, and build DevSecOps pipelines, and develop an appreciation of the importance of design thinking in product development. Program residents with a cybersecurity background, will develop a deeper understanding of how cybersecurity is executed in accordance with the DoD\nDevSecOps Reference Design, will learn more about how Platform One manages its continuous Authority to Operate (cATO), and learn how to accredit mission applications using the Risk Management Framework. Program residents with Acquisition Program Management or Contracting experience (Contract Specialist and Contracting Officers) will learn more about how contracting vehicles like Small Business Innovate Research (SBIR), and Basic Ordering Agreements (BOA) contract vehicles enable the acquisition and scaling of talent, software licenses, and cloud services to enable service delivery at Platform One.\nVALUE STREAMS\n\nPlatform One will only be selecting a set quantity of residents to embed within our value streams as depicted below:\n\nDownload DoD-wide approved containers or harden with Iron Bank\nDeploy your own software factory with Big Bang\nGet hands-on experience onboarding with Party Bus\nCNAP\nProvide access to development, testing, and production enclaves\nStay secured with our Cybersecurity team processes\nAPPLICATION PROCESS\n\n28 February 2022 - 15 April 2022\n\n18 April 2022 - 22 April 2022\n\n25 April 2022\n\n29 April 2022\n\n2 May 2022\n\nApplication Submission Window\n\nInterviews will be conducted\n\nSelected residents will be notified\n\nProspective residents must send back Memorandum of Agreement signed by their Commanders to confirm their seat.\n\nConfirmed selectees will receive an acceptance letter from the Platform One Materiel Leader. Begin Residency.\n\nHOW TO APPLY\nWrite a single page Letter of Intent detailing your: Background, Experiences, Interests and goals, WHY this opportunity is important to you in further developing your DevSecOps knowledge, and What weapon or IT systems you hope to support in the future? Be sure to include your current branch of service and unit information on letter. Contracting Only: List your years of experience, warrant, and certification level.\n\nFill out skills matrix spreadsheet (N/A to Acquisitions/Contracting)\n\nSkills Matrix Sheet\n\nFill out your form, upload letters of intent, and skills matrix by clicking the “Apply Here” button below. Commander or equivalent approval is required to participate in this program.\n\nApply Here\n\nApply to the Residency, NLT 15 April 2022. Applications received after this date will not be considered.\n\nCOORDINATING INSTRUCTIONS\n\nSelected applicants must be able to start the six-month residency on 2 May, 2022. The program will last for 6 months and will be 100% Remote. There are no TDY costs associated with the residency program. Applicants must have at least 6 months left at their current duty station or service commitment to be eligible to apply. There is no payback tour incurred by participating in this opportunity.\n\nHAVE MORE QUESTIONS ABOUT THE RESIDENCY PROGRAM?\nCONTACT US"},{"id":"/contact-us","path":" contact-us","title":"Contact Us","content":"First Name\nLast Name\nSector\nGovernment Sponsoring Program*\n* required\nEmail*\n* required\nPhone*\n* required\nHow can we help?\nHow did you hear about Platform One?\nSend Info\n If you have a tech issue, please visit the Platform One Support Hub.\nLOOKING FOR THE RESIDENCY PROGRAM SIGN UP?\nResidency Program"},{"id":"/products/party-bus/ama","path":" products party-bus ama","title":"AMA","content":"CALLING ALL PARTY BUS CUSTOMERS AND POTENTIAL PARTY BUS PASSENGERS\nMark your calendars for the following dates. Party Bus will be hosting an \"Ask an Engineer\" Session the last Wednesday of each month through November.\nUpcoming Sessions\nJuly 27th\nAugust 31st\nSeptember 28th\nClick Here To Join The Session!"}]
\ No newline at end of file
[{"id":"/","path":" ","title":"Platform One","description":"Platform One allows users to deploy a DevSecOps Software Factory and start solving software problems with a 90% solution day 1, instead of starting from nothing.","content":"CALLING ALL PARTY BUS CUSTOMERS AND POTENTIAL PARTY BUS PASSENGERS\nMark your calendars for the following dates. Party Bus will be hosting an \"Ask an Engineer\" Session the last Wednesday of each month through November.\nUpcoming Sessions\nJuly 27th\nAugust 31st\nSeptember 28th\nClick Here To Join The Session!\nWHAT CAN PLATFORM ONE DO FOR YOU?\nPlatform One (P1) is a modern cloud-era platform that provides valuable tooling, hosts CI/CD DevSecOps pipelines, and offers a secure Kubernetes platform for hosting microservices.\n\nAuthorization to go live with your application can be achieved faster than ever by using Iron Bank hardened containers and P1 pipeline security tools. The resulting Certificate to Field (CtF) and Continuous Authority to Operate (cATO) provides developers the ability to push validated code into production on an ongoing basis. This results in shorter development cycles, less debugging, and more rapid feature development.\nDownload DoD-wide approved containers or harden with Iron Bank\nDeploy your own software factory with Big Bang\nGet hands-on experience onboarding with Party Bus\nCNAP\nProvide access to development, testing, and production enclaves\nStay secured with our Cybersecurity team processes\nEXPLORE THE PRODUCTS\nHOW OUR TEAMS HELP\nManages Software Factories for development teams so they can focus on building mission applications\nDecouples development teams from factory teams with DevSecOps and Site Reliability Engineer (SRE) expertise\nHelps instantiate DevSecOps CI/CD pipelines / software factories in days at various classification levels\nBuilds and leverages the DoD hardened containers while avoiding one-size-fits-all architectures\nFully complies with the DoD Enterprise DevSecOps Initiative (DSOP) with DoD-wide reciprocity\nCentralizes the container hardening of 300+ enterprise containers (databases, development tools, CI/CD tools, cybersecurity tools, etc.)\nPLATFORM ONE AND KESSEL RUN JOINING FORCES\nDownload the Memo\nPLATFORM ONE, KESSEL RUN, WE “BELIEVE” SOFTWARE PRINCIPLES\n\nThe USAF's Platform One and Kessel Run teams have been hard at work to converge our technology, services, and data to ensure rapid application portability across key software systems that support our warfighters.\n\nTo do so, we believe it is important to document shared core beliefs that we are pursuing through collaboration of our limited pool of talented software personnel. These principles guide our collaboration, technology decisions, and engagement with industry.\n\nPLATFORM ONE AWARDS\n2020 DEFENSE ACQUISITION\nWORKFORCE AWARD WINNERS\nDavid Packard Excellence\nin Acquisition Award\nSoftware Innovation\nTeam Award\n2021 IMPROVEMENT AND\nINNOVATION AWARDS WINNERS\nTeam of the Year\nPlatform One\nWHO WE SERVE"},{"id":"/services","path":" services","title":"Platform One Services","content":"PLATFORM ONE ENTERPRISE SERVICES\n\nPlatform One provides additional pay-per-use services and contract vehicles to facilitate teams' adoption and move to DevSecOps. The list of services will continuously evolve.\n\nCUSTOM DEVELOPMENT SERVICES\nBuild and deliver new and accredited custom software applications (microservices) by leveraging the Platform One pipeline and following Platform One's DoD Continuous Authority to Operate (cATO) (pay per app)\nTo learn more about these capabilities, please contact af.cso@us.af.mil with Subject: \"Platform One Custom Development Services Question\"\nCLOUD NATIVE ACCESS POINT (CNAP)\nThe Cloud Native Acess Point is available on Cloud One to provide access to Development, Testing, and Production enclaves at IL-2, IL-4, and IL-5 that use Platform One DevSecOps environments by using an internet-facing Cloud-native Zero trust model\nTo learn more about these capabilities, please contact af.cso@us.af.mil with Subject: \"Platform One CNAP Question\"\nPLATFORM ONE CONTINUOUS INTEGRATION\nCONTINUOUS DELIVERY (CI/CD) WITH INFRASTRUCTURE AS CODE (IaC)\nTeams can use existing CI/CD pipelines hosted on Repo One with their current Infrastructure as Code (IaC) code\nIf a custom CI/CD pipeline is needed due to specific program mission needs, check out the Big Bang options\nTo learn more about these capabilities, please contact af.cso@us.af.mil with Subject: \"Platform One CI/CD Options Question\"\nPLATFORM ONE DEVSECOPS MANAGED TOOLS\nPlatform One Enterprise Chat provides a collaboration solutions suitable for connecting developer teams (pay per use): IL-4 (.mil email only) https://chat.il2.dso.mil \nPlatform One All Domain Common Environment (see above, pay per use)\nPlatform One Multi-Level Security Data Transfer (CDS/Diode) (pay per use)\nPlatform One Stack Exchange: knowledge sharing service for software developers and engineers (pay per use)\nTo learn more about these capabilities, please contact af.cso@us.af.mil with Subject: \"Platform One Managed Tools Question\"\nCLOUD NATIVE DNS\nPlatform one deploys a CNCF-graduated authoritative DNS server to provide a highly available, secure central way to manage DNS for dso.mil. This solution centralized DNS management for the organization and allowed us to execute DNS updates in minutes vs. weeks (for IL5)\nCloud-native, agnostic and elastic DNS capability with .MIL and non .MIL capabilities\nFully managed by configuration as code and Git mergers\nRuns on Kubernetes using coreDNS\nENTERPRISE COLLABORATION\nProvides secure collaboration tools to enable those who advance the mission\nMattermost - Communicate with your peers within the DoD anytime/anywhere\nJira - Plan, track, and manage your projects\nConfluence - Create, collaborate and organize all of your work in one place\nPLATFORM ONE TRAINING AND ONBOARDING OPTIONS\n\nCheck out the CSO DevSecOps / DAU training: DevSecOps Training Resources \n\nVirtual Platform One Learning Hub that provides self-service onboarding\n1-day training Session: Introduction to DevSecOps. Overview and understanding of the vision and activities\nOnboarding options for Party Bus\nTo learn more about these capabilities, please contact af.cso@us.af.mil with Subject: \"Platform One Training Question\"\nIDENTITY MANAGEMENT/SSO/PKI\nBrings Single Sign On with various DoD PKI options and MFA options\nBrings Person Entity (PE) and Non Person Entity (NPE) x509 certificate based authentication\nConnects to existing AF, DoD and DIB PKI capabilities\nProvide secure and cloud native, agnostic and elastic capability\nLeverages VAULT capability and provides automated certificate generation, Kubernetes native and allows for automated certificate rotation\nCan be used for code signing, container signing and NPE/PE authentication\nCentralizes/Aggregates logs and pushes to CSSP and vSO"},{"id":"/resellers","path":" resellers","title":"Platform One Official Resellers","content":"WHY A PLATFORM ONE RESELLER\n\nBy leveraging this fast track, applications can be approved to work on government systems faster than ever. Partnering with a Reseller means rapid environment deployment and priority access to platform updates, new services, better security*, continuous feedback, education, and training and container hardening.\n\nAuthorized Resellers are qualified service providers of the Department of Defense Enterprise DevSecOps Technology Stack. Use of Platform One Big Bang environments and Iron Bank Hardened containers enables more secure software operations, leading to continuous Authorization to Operate (cATO).\n\n*Platform One's technologies have been pen tested by the NSA, the US Air Force, and the US Navy.\n\nRequest For P1 Services\nCONNECT WITH OUR RESELLERS\nBOOZ ALLEN\n\nBooz Allen Hamilton, an innovator and pioneer in successful P1 capability implementations, brings credible experience in driving adoption of Agile DevSecOps, Software Factories, and P1 products and services in support of mission critical programs.\n\nLearn More\nBRAINGU\n\nAs P1 subject matter experts with experience in delivering Kubernetes-based DevSecOps platforms, BrainGu knows that the journey to transitioning from an existing legacy software solution to a Cloud-Native/DevSecOps solution can be difficult. We succeed in technology distribution because we respect the importance of the value that legacy technology brings.\n\nLearn More\nECS\n\nECS, ASGN's federal government segment, delivers advanced solutions in cloud, cybersecurity, data and artificial intelligence (AI), application and IT modernization, science, and engineering.\n\nLearn More\nNOVETTA\n\nNovetta, a part of Accenture Federal Services, brings nearly a decade of mission-focused, Agile-based DevSecOps experience to the most challenging National Security/DoD problems.\n\nLearn More\nREVACOMM\n\nRevaComm is a Hawaii-based, minority-owned, 8(a)SDB who has been instrumental not only in building, maintaining, educating, and onboarding Platform One customers to Party Bus, but also in playing a vital role in P1's Big Bang deployment for Party Bus.\n\nLearn More\nSEED INNOVATIONS\n\nSeed Innovations, LLC (Seed) is a woman-owned small business specializing in P1's adoption. Seed has been involved in the development of Party Bus, Big Bang, and Container Hardening (Iron Bank) over the last two years.\n\nLearn More\nWHO WE SERVE"},{"id":"/resources","path":" resources","title":"P1 Resources","description":"Information at your fingertips: guides, documents, and external links to help spread valuable knowledge pertaining to Platform One and the DoD.","content":"Platform One\nIron Bank\nBig Bang\nParty Bus\nCNAP\nCYBER\nDISA Container Guide\nDCCSR Repository\nDevSecOps/DAU Training\nDevSecOps Reference Design\nMemorandum Distribution\nP1 Tool Chain\nASK ME ANYTHING RECORDINGS AND PRESENTATIONS\nCheck out hot topics and presentation slides from previous AMA's currently available on software.af.mil\nExplore More\nSOFTWARE.AF.MIL DEVSECOPS TRAINING RESOURCES\nSelf-learning videos for all levels covering Kubernetes to Service Mesh, literature recommendations, and more.\nLearn More\nHAVE MORE QUESTIONS ABOUT PLATFORM ONE?\n\nIf you have P1 SSO access, click Get Answers to find most of your questions answered on the FAQ page. Click Contact Us for more specific inquiries.\n\nGet Answers\nRequest P1 SSO Access\nContact Us"},{"id":"/who-we-are","path":" who-we-are","title":"Who We Are","content":"WE CARE ABOUT THE PULSE OF OUR ORGANIZATION AND USE IT TO HELP CONTINUOUSLY IMPROVE OUR PROCESSES!\n- Andrew Belk, Chief People Officer\nVISION\n\nAccelerate the DoD's dominance by delivering innovative, trusted technologies today.\n\nMISSION\n\nTransform how the DoD delivers warfighter capability through innovative frameworks, collaborative culture, and secure software.\n\nVALUE STATEMENTS\n\nOur values were determined through a working session that was open-invite to the entire P1 team. The people defined what was important to them instead of having someone tell them what to value!\n\nEMPOWER\nEmpower individuals and teams with the trust to be accountable and grow Platform One into an organization that drives change personally and professionally.\nOBSESS\nObsessively know our customers and solve their challenges by delivering actual, functional solutions instead of arguing about requirements and process. Continue to improve the solution well into the future.\nVALUE\nWe. Value. Diversity. We are committed to Diversity and Inclusion. Employees in our inclusive environments feel appreciated for their unique characteristics and therefore comfortable sharing their ideas and other aspects of their true and authentic selves.\nNOURISH\nNourish a culture of open, safe, candid communication, and decision making at all levels. We accomplish this by a heightened sense of self-awareness and encourage people to know their own faults and continuously work to improve them. When engaged in conversation, seek to understand the other's point of view prior to attempting to change his or her opinions.\nCORE PRINCIPLES\nSCALE\n\nFeatures aren't complete until they are tested, automated, documented, and with training modules.\n\nMISSION OBSESSED\n\nObsessed over the code that will form the baseline for weapon systems across the DoD: ships, planes, tanks, and nukes.\n\nEVERYONE CODES\n\nWhat we do is code. All of us... even if it is 3 hours a week using Youtube videos. No exceptions.\n\nOWNERSHIP\n\nOwn every aspect of what you do, what you write, what you say, and what you use.\n\nSIMPLE AND ROBUST\n\nMake features as if 100,000 developers will use what you've developed.\n\nCONTINUAL LEARNING\n\nWe always look to improve our baseline and our brains.\n\nLIVE IN THE TRENCHES\n\nSuccess or failure is found in the details. Don't ignore them because you don't have time to understand.\n\nNO EGOS\n\nWe will never be the best at everything, so don't claim or try to be. Be open-minded about what others can bring to the table.\n\nINVEST IN PEOPLE\n\nThe best investment you can make is in yourselves. The next best investment you can make is in the people next to you.\n\nWE SERVE\n\nWe exist to help others succeed. When they succeed, we succeed. If you can help someone, do it.\n\nSHOOT FOR THE MOON\n\nBe bold and strive to make monumental changes that sound so crazy people won't believe you... even after you've done it.\n\nSMART DECISIONS\n\nEncourage decisions to be made by the individuals with the most information. If it's a technical decision, that means technical people, even if they are the lowest ranking.\n\nMEET THE LEADERSHIP TEAM\n\nOur leaders range in personality from the Pointy-haired boss from Dilbert to Bill Lumbergh from Office Space but, like, in a good way. They are instrumental in driving the vision for Platform One and our continued growth and improvement. They keep the mood nice and light-hearted while removing blockers and knocking down barriers for our teams. If you want to know why P1 is such a great place to work, learn about our leaders.\n\nLT COL BRIAN VIOLA\n\nMateriel Leader\n\nDUONG HANG\n\nDeputy Materiel Leader\n\nMAJOR CAMDON CADY\n\nChief of Operations and Chief Technology Officer\n\nKEVIN TWIBELL\n\nChief Information Security Officer\n\nPHILLIP \"CASPER\" RECORD"},{"id":"/products/party-bus/service-catalog","path":" products party-bus service-catalog","title":"Service Catalog","content":"CI/CD cATO PIPELINE FLOW\n\nTake your idea and get it to production using our pipelines and Certificate-to-Field (CtF). Click on the tools icon to see\nwhat tools are supported for that phase and the +/- for a quick explanation for that specific stage.\n\nPUSH TO REPOSITORY\n\nA developer will make\nchanges to necessary code\nand achieve revision control.\n\nCONTINUOUS INTEGRATION (CI)\n\nDockerfile scan \n\nDocker File Lint\nFind Unathorized Job\n\nBuild \n\nBuild\n\nUnit tests \n\nLint\nUnit Tests\n\nSca\n\nDependency Check\nFortify\nSonarQube Job\nTruffleHog Job\nCONTINUOUS DEPLOYMENT (CD)\nCONTINUOUS DELIVERY (CD) \n\nBuild image\n\nBuild Image\n\nScan image\n\nTwistlock Scan\n\nDeploy staging\n\nDeploy Staging\n\nE2e tests\n\nE2e Tests\nPen Tests\n\nRelease\n\nRelease Job (Production Only)\nSUPPORTED TOOLS\n\nThe following tools are available in the MDO (Production/Application) Environment where the PB customers live.\n\nCOLLABORATION TOOLS\nCONTAINERIZATION\nBUILD\nUNIT TESTS\nCONTINUOUS DELIVERY\nCONTINUOUS INTEGRATION\nCONTINUOUS DELIVERY\nWHAT DOES cATO ACTUALLY MEAN?\n\nWe, Platform One, build a Continuous ATO from multiple ATOs covering the infrastructure, platform, and deployment process. The infrastructure and platform ATOs cover a majority of NIST 800-53 RMF controls. The DoD CIO and DAF CSO have released multiple guidance documents related to the cATO, click the button below for more information.\n\nDSOP Documents\n\nOnce a team completes the Certificate to Field (valid for one year or until architecture is changed – major release) real-time deployments to production are enabled. The Certificate to Field (CtF) process uses SD Elements to answer the final NIST 800-53 RMF controls that are specific to the application. To be compliant with the DevSecOps Reference Design (PDF) and retain our ATOs, we pull approved images from Iron Bank.\n\nDevSecOps Reference\nSUPPORTED ENVIRONMENTS\n\nUsing CNCF Certified Kubernetes Distributions. (Rancher, Konvoy)\n\nENVIRONMENT\tDEVELOPMENT ENVIRONMENT SUPPORTED (DSOP)\tPRODUCTION (DEVELOPMENT) SUPPORTED (MISSION DEVOPS = MDO)\nIL2 (On Cloud One)\t\n\t\nIL4 (On Cloud One)\t\n\t\nIL5 (On Cloud One)\t\n\t\nS (ODIN IL6)*\t\n\nDevSecOps Pipelines are available at IL6, cATO/CTF would need to be discussed with ODIN PM\n\n\t\nTS/SCI (ODIN JWICS)*\t\n\nDevSecOps Pipelines are available on JWICS, cATO/CTF would need to be discussed with ODIN PM\n\n\t\n\n* PlatformOne and ODIN Programs are working a formal MoA (Agreement) to leverage each other's environments and services.\n\nMore ODIN Info\nWHAT IS AVAILABLE\n\nWhat is available for your development/collaboration environment and in the MDO (Production/Application) Environment\n\n***Supported technologies between the hours of 0800 CST-1800 CST M-F only.\nThese environments are available for use 24X7, but support is not guaranteed outside of these hours.\nPlatform One reserves the right to discontinue support to current services in interest of security and maintaining our cATO.\n\nFeature Type\t\nPB fully supported, part of the support agreement for PB customers. Part of the PB Managed Service\n\n\n\tIB approved containers, but not supported by PB.\n\nSee Guild - App Teams Mattermost Channel for community discussion \n\tAdditional Features\n\nRoadmap\n(in the future, unsupported at this time)\n\tNot Supported\n(IB rejected or Vendor lock-in)\nDSOP - this is what is available for your development/collaboration environment. PB maintains complete control over these capabilities. These features are not available for PB customer teams to configure, manage, or change. Application Teams will be given access to certain tools only. Anything beyond the cATO requirements is a roadmap item. See Party Bus Tech Stack for more info.\nPlatform Services: This is the PB platform. Services are not available for individual teams to configure. See Party Bus Tech Stack for more info.\tAll of Big Bang Core\n\nBig Bang Addons (except Nexus)\n\nSupported Fortify\nConfluence\nJira Big\nBang 3rd Party\n\nCommunity Supported:\nmysql\npostgres\nSee the Party Bus Tech Stack/PaaS/Release Notes (coming soon)\n\tNone at this time\tBig Bang Add-ons: Nexus, Anchore\tNone at this time\nPipeline Tools\n\nSee MDO Guidance for more information\t\nGitlab Premium\nFortify\nSonarqube\nTwistlock\nTrufflehog\nOWASP Dependency Check\nOWASP Zap\nArgoCD\nSDElements\n Launchboard (Beta)\n\t\t\t\nBackup\tVelero\t\t\t\nThis is what is available in the MDO (Production/Application) Environment. This is where the PB customers live.\nPersistent Storage Solutions**\t\n Amazon RDS (multi-tenant only)\nAurora PostgresSQL\nMySQL\nMinIO (Native Object Storage)\nCommunicate with S3 through MinIO - No direct link to S3\n\t\nAny Iron Bank image - to be used at customer risk, no Party Bus support is provided.\nProven Iron Bank approved customer integrations in their own BB environment.\n\t\nFileServer (CDN)\n\tAny and all provided cloud services (Lambda, S3 etc)\nLanguages\t\nNPM based\nTypeScript/JavaScript\nAngular\nReact\nNode.js\nVue\nJava (Maven or Gradle build engine)\nPython (built in python commands)\nGolang (built in go commands)\n.NET-Core (built in .NET-Core commands)\nC# with .NET 3/5 Framework beta\nC++ - beta (Toolset: gcc, g++ v.10, cmake, conan)\nRuby (bundler only, other Ruby package managers are not supported)\nPHP (Composer only, other PHP package managers are not supported)\nSee Pipeline Templates Repository\n\t\t\tRust (Fortify/Sonarqube cannot scan)\nSupported Message Queues\t\nKafka\n\t\nAny Iron Bank image - to be used at customer risk, no Party Bus support is guaranteed unless using the Party Bus Kafka Managed Service. RabbitMQ is a message queue option that customers have successfully self-managed.\nProven IB approved customer integrations in their own Big Bang environment.\n\tNone at this time\tAny and all provided cloud services unless otherwise specified (SNS/SQS)\n\nNifi - approved in IB, but due to authentication and installation issues, customers will not be able to install and use Nifi in the Party Bus environments.\nEmail Services\tNone at this time\tNone at this time\tTesting email options - release date TBD\tPB explicitly does not allow emails.\nWeb Servers\t\nOther Containerized Web Servers that are Iron Bank approved (e.g. NGINX, Tomcat, .php Apache)\n\t\nAny Iron Bank image - to be used at customer risk, no Party Bus support is guaranteed.\nProven Iron Bank approved customer integrations in their own Big Bang environment.\n\tNone at this time\tAny and all provided cloud services\n**Data distribution is subject to the data owner permissions. P1 does not offer a data platform for distribution. It is up to the Application to handle this data appropriately (JWT token). P1 does not offer any data cleaning, remediation, data spill etc. This is up to the application team. Direct Database access is not permitted.\nIngress is only allowed on 443.\nAll containers must come through Iron Bank. See the Iron Bank onboarding found here.\nUNSUPPORTED RDS/STORAGE\n\nAll the below are 'use at your own risk'.\n\nThis means the Product Team is responsible for backups and any data loss.\n\nMongoDb\n\nPlease reference the Unsupported Database Guidance\nUNSUPPORTED LANGUAGES\n\nRust\n\nUNSUPPORTED GENERAL\n\nMulti language project (One language per project is allowed)\n\nTECHNICAL FIT\n\nPlatform One expects a technical diagram and a dockerfile be provided at the technical fit meeting. The Party Bus anchors can assist in the creation of the technical diagram and dockerfile.\n\nBelow are examples.\n\nTechnical Diagram\nExample Dockerfiles\nARE YOU READY TO START YOUR PARTY BUS JOURNEY?\n\nView Community Contributions through the BBTOC.\n\nContact Us"},{"id":"/products/party-bus","path":" products party-bus","title":"The Party Bus","description":"The environment and services you need to develop and deploy your software application","content":"WHY PARTY BUS?\nPARTY BUS IS A cATO ENABLED DEVSECOPS SERVICE\nFor government software programs who need rapid development of approved, working mission applications to warfighter.\nWe provide a non-vendor locked, CNCF kubernetes based platform.\nWe provide a secure, multi-tenant, and multi-classification environment with Staging and Production capabilities.\nWe stand out by allowing our customers to field applications with cATO'd templatized pipelines\nONBOARDING ONTO PARTY BUS\n\nLeverage a Multi Tenant DevSecOps environment with our environment and services\n\nSERVICE CATALOG\n\nThe cost of each program office standing up their own DevSecOps environment can be saved by using Party Bus.\n\nCheck out the service catalog to see what is included when you are a Party Bus customer.\n\nView Our Services\nWHAT YOU'LL LEARN IN OUR WORKSHOPS\n\nGet hands-on experience and training with our rapid workshop to stand up a hello world pipeline with a templated app through Party Bus.\n\nAgile & UCD Methodologies\n\nPaired Programming\n\nTest-Driven Development\n\nCertificate to Field (CtF)\n\nExplore Onboarding Process\nParty Bus Process\nWE MOVE FAST, AND WE MOVE SMART\n\nThe Party Bus team will be measuring twice and cutting once. We believe the sooner we can get you squared away on our level of standards (which is high, why else would we invite you to join our elite team of products and services), the sooner you can serve the users and warfighters within DoD that need your product or solution yesterday.\n\nHAVE MORE QUESTIONS ABOUT PARTY BUS?\n\nClick Get Answers to find most of your questions answered on the FAQ page. Click Contact us for more specific inquiries.\n\nGet Answers\nContact Us\nAsk An Engineer"},{"id":"/products/party-bus/onboarding","path":" products party-bus onboarding","title":"Party Bus Onboarding","content":"PROCESS OVERVIEW\nINTAKE REQUEST\n\nOur Customer Success Team gains an understanding of your application\n\nCONDUCT TECHNICAL FIT\n\nCollaborate with Mission DevOps Engineers in a Technical Fit Session\n\nPRICING QUOTE\n\nCustomer Success and Acquisitions teams to finalize your pricing quote\n\nPARTY BUS WORKSHOP\n\nLearn the Party Bus way to onboard, provision, and procure pipelines and environment for your application and continuously deliver\n\nSTEPS TO PARTY BUS SUCCESS\n01.\nINTAKE REQUEST\n\nStep One Resources:\n\n• Intake/Contact P1 Request\n• Party Bus Service Catalog\n• Intake Questions \nWHAT IS PARTY BUS?\n\nParty Bus is a Multi-tenant continuous ATO'd, declaritve and opinionated environment. This means our team of engineers provision and configure pipelines for your team so you can focus on your software.\n\nEnsure Party Bus is the right fit for you and your team by reviewing our service catalog prior to a Tech fit session with one of our experts.\n\nDuring Intake our Customer Success Team will collaborate with you to provide all the essential information about the Party Bus, your application, and review the Party Bus Service Catalog.\n\nWHAT DO WE NEED FROM YOU?\nTeam Technical lead, Government POC, and development team members info.\nArchitecture diagram listing application containers, tech stack, APIs, DBs, frameworks and other dependancies.\nDocker containers (needed before pipelines are built)\n02.\nTECHNICAL FIT\n\nStep Two Resources:\n\n• Party Bus Service Catalog\n• Docker File Examples \nWHAT IS THE TECH FIT?\n\nOur team will contact you to schedule a Technical Fit with our PB Engineers. Together we'll review your tech stack, current architectural set-up, dependencies and usage requirements. This step ensures a true fit for your application and provides the best Party Bus experience.\n\nWHAT DO WE NEED FROM YOU?\n\nReview technical elements that are supported in the Party Bus Service Catalog resource.\n\nDURING THE TECHINCAL FIT:\n\nYou'll step us through your technical and architectural overview of your application. Bring Docker Files and prepare questions to ask Party Bus Anchors. Getting an understanding of your application allows us to get a perspective into the current state of the application, so we can suggest and adapt it for future state success.\n\nThe PB Anchors will determine the application is a good fit. If it is approved, then you'll move on to the Pricing Quote Phase.\n\nIf your application is not accepted, then a team member will communicate what adjustments are necessary to refactor your application, or outline why Party Bus may not be ideal for your application.\n\n03.\nPRICING QUOTE\n\nStep Three Resources:\n\n• Party Bus Service Catalog\nCONGRATULATIONS! THE APP IS A GOOD FIT!\n\nAfter the tech fit is complete, your Party Bus requirements are evaluated by our Customer Success and Acquisitions teams to finalize your pricing quote.\n\nYou will be assigned a Business Account Manager when your quote is complete. This individual will guide you through the steps to complete the contracting and payment processes.\n\n04.\nACCESS & PARTY BUS WORKSHOP\n\nStep Four Resources:\n\n• P1 SSO Self-Registration\n• 2875 Documents and Instructions \n• Party Bus Service Catalog\nYOU'RE ON THE PARTY BUS!\n\nAt this point, you're officially part of the Party Bus. Your project has been funded.\n\nOUR TEAM WILL PROVIDE ACCESS TO THE FOLLOWING TOOLS:\n\nGitlab; Mattermost; Jira; Confluence; Pipeline tools.\n\nDon't have access to your team's tools and pipelines? Email our team.\n\nNext, sign up for the required 3-Day Party Bus Onboarding Workshop:\n\nProduct teams and developers attend a 3-day session\nProduct Managers attend a 1-day session\n\n\n\nYou may need to associate your Platform One account with your CAC to access Party Bus Tools and Pipelines. Fill out paperwork if you don't have a CAC to associate with your account. See resources above.\n\nNEED ASSISTANCE?\n\nGet in touch with us\n\nContact us\n\nOr get in touch with a Platform One Contact\nor our Party Bus Onboarding Contact"},{"id":"/products/big-bang/onboarding","path":" products big-bang onboarding","title":"Big Bang Onboarding","content":"CUSTOMER ON-BOARDING GUIDES\n1 DAY WORKSHOP\n\nAn introduction to learn about Big Bang products and associated technologies.\n\n9/07/219/21/2110/05/2110/19/21\n1-WEEK ENGINEER COHORT\n\nAfter attending a workshop experience a deep dive into the Big Bang Deployment with hands on labs.\n\n9/28/2110/12/21\nWORKSHOP AND ENGINEER COHORT OVERVIEW\nBIG BANG WORKSHOP\n\nWHO SHOULD COME?\n\nEngineers & Developers interested in learning more about the Big Bang tech stack and how it can help you kick-start a software factory.\nView Workshop Prerequisites\n\nTOPICS COVERED\n\nPlatform One & Big Bang Introduction\nThe Core Big Bang Stack\nKubernetes Basics\nThe Big Bang model of GitOps\nMonitoring and Logging Capabilities\nIstio & Kubernetes Networking\nAdditional Big Bang Services & Apps\n\nHOW TO REGISTER\n\nPlease click the link below and enter the following password to register: BigBangWorkshop\nRegister For A Workshop\nBIG BANG ENGINEER COHORT\n\nWHO SHOULD COME?\n\nSRE/Operations Engineers interested in deploying a Big Bang Cluster into their own environment. Below is an overview of topics we cover during the course.\nView Engineer Cohort Prerequisites\n\nDay 1:\n\nOverview of Platform One\nBig Bang\nLab Access\nKubernetes Refresher\n\nDay 2:\n\nSecrets Management\nGit Repo Setup\nDeployment of Big Bang\n\nDay 3:\n\nSecurity Tools\nExtending Big Bang\n\nDay 4:\n\nTake Home Lab\nHAVE QUESTIONS ABOUT ONBOARDING SESSIONS?\nGet Answers\nContact Us"},{"id":"/products/big-bang","path":" products big-bang","title":"Big Bang","description":"Big Bang is a DevSecOps platform built from DoD hardened and approved packages deployed in a customer owned Kubernetes cluster.","content":"EMPOWERING YOU TO CREATE CUSTOM ENVIRONMENTS FOR YOUR MISSION\n\nBig Bang will help you build a custom software factory for your specific mission needs to enable faster development and deployment of your mission applications.\n\nTHE BIG BANG ADVANTAGE\nAVOID VENDOR LOCK\n\nBig Bang is Kubernetes distro-agnostic, meaning you can pick between Upstream, Rancher, Konvoy, Tanzu Kubernetes Grid, or OpenShift Container Partner.\n\nFASTER ATO VIA RECIPROCITY\n\nOur Platform is accredited DOD wide and we can work AO to AO to ensure reciprocity.\n\nWIDE RANGE OF TOOL CHOICES\n\nWe offer multiple tools at each stage of CI/CD pipeline. The tool choices can be customized to your preference and to the programming language of your choice.\n\nBIG BANG RESOURCES\nGETTING STARTED\n\nOur Platform is accredited DOD wide and we can work AO to AO to ensure reciprocity.\n\nQuick Start Guide\nPRODUCT RELEASE NOTES\n\nCheck out the latest Release Notes.\n\nRelease Notes\nOPEN SOURCE CONTRIBUTIONS\n\nWe are hard at work building an open-source platform but we need your help.\n\nGet Involved!\nLICENSING EXPECTATIONS\n\nOur core platform is open source with extensible enterprise-level capabilities. Please read our report on licensing expectations\n\nLicensing Info\nResellers\nTHE BIG BANG STAGES\n\nStage 1 - We create your DevSecOps (DSOP) Software Factory. We set this up for you.\n\nStage 2 - You use the DevSecOps (DSOP) Software Factory to build and deploy your mission applications. You run these pipelines to build and deploy mission applications any number of times.\n\nWE MOVE FAST,\nAND WE MOVE SMART.\n\nThe Big Bang team will deploy a Software Factory with tools that are built for your specific mission needs. We believe the sooner we can get you squared away on our level of automation and security standards (which is high, why else would we invite you to join our elite team of products and services), the sooner you can serve the users and warfighters within DoD that need your product or solution yesterday.\n\nREADY TO PROCURE BIG BANG SERVICES?\nContact Us"},{"id":"/products/iron-bank","path":" products iron-bank","title":"Iron Bank","description":"Iron Bank is Platform One's authorized, hardened, and approved container repository that supports the end to end lifecycle needed for modern software development.","content":"ANNOUNCEMENT!\n\nIron Bank is happy to announce the initial release of the Acceptance Baseline Criteria (ABCs) and Overall Risk Assessment (ORA) for Iron Bank containers. For additional information regarding this announcement, including links to the existing ABC and ORA documents, please see our README on Repo One.\n\nABC/ORA Documentation\nWHY IRON BANK?\nAutomates, secures, and accelerates the approval process of commercial and open source containers to be used within the DoD with DoD-wide reciprocity\nBrings accredited software to the DoD using processes and procedures that are faster and more efficient than other methods\nProvides continuous monitoring of approved images\nMaintains continuously updated containers so that developers have access to the latest tools\nProvides a toolbox of commonly used and secured capabilities for mission apps\nProvides end-to-end management of container justifications for known vulnerabilities and container approval process via Vulnerability Assessment Tool (VAT)\nAssists vendors with the hardening process of containers\nThe Iron Bank website offers a view of all approved applications and provides any necessary details in regards to the application\nRegistry One is a fully compliant Open Container Initiative registry. All containers found under the Iron Bank project are guaranteed to be approved\nRepo One is the central repository for the source code to create hardened and evaluated containers for the DoD\nHOW DO WE DO IT?\n\nWe work with the open source community and commercial vendors to centralize a hardened and approved version of an application that is easily accessible to the entire DoD. By leveraging our Certificate to Field (CtF) process, the DoD community can quickly and easily deploy applications at unprecedented speed.\n\nRegistry One\nPROCESS HIGHLIGHTS\n\nThe Iron Bank approval process centralizes and standardizes application hardening throughout the DoD. This information is stored in Repo One.\n\nEvery 12 hours applications are built and scanned again for findings\n\nApplications are continuously updated to the latest version\n\nBody of evidence that is public facing and readily available for use\n\nDISA STIGs, CIS benchmarks, and best practices applied\n\nExplore Iron Bank\nRepo One\nONBOARDING\n\nInterested in submitting a container to be hardened and published on Iron Bank and Registry One? Check out the Contributor Onboarding Guide and see how to successfully scan and harden your container(s) through the DevSecOps Platform.\n\nOnboarding Guide\nOnboarding Checklist\nHow To Justify/Address CVEs\nONBOARDING PROCESS\n\nWant to learn more about Iron Bank Onboarding Process? Watch this video to learn about the processes involved throughout the various stages of the hardening process. You can refer to the Onboarding Presentation below for reference during the video.\n\nOnboarding Presentation\nHOW DO I CONTRIBUTE CONTAINERS TO IRON BANK TO BE HARDENED?\n\nBefore contributing application containers, you should first make sure the application you are contributing is not already in the Iron Bank. If the application/container image does not exist, requests can be made with the Iron Bank Onboarding team for accreditation. Please complete the Iron Bank Onboarding Request.\n\nIron Bank Onboarding Request\nInternal Hardening Request\nIRON BANK GET UNSTUCK/AMA WORKING SESSIONS\n\nNeed some help with your containers getting through Iron Bank? Have questions on where things are at? Are you feeling stuck and want to figure out next steps? This is the meeting for you! Come meet with the Iron Bank leadership and engineers to get answers to your questions.\n\nRegister in advance for the meeting at the link below. After registering, you will receive a confirmation email containing information about joining the meeting.\n\nRegister Now\nIRON BANK ONBOARDING SESSIONS\nEvery Wednesday at 1530-1630 EST\n\nWe will be giving an overview of the Iron Bank process, and how to get an application through for the first 30 minutes and then we will be answering your questions. By the end of this meeting, you should know the next steps for you to take and where to find all the necessary documentation.\n\nRegister in advance for the meeting at the link below. After registering, you will receive a confirmation email containing information about joining the meeting.\n\nRegister Now\nIron Bank Diagram\nDO YOU HAVE FEEDBACK FOR IRON BANK?\n\nWe are always looking to improve our processes to meet our vendor's needs.\n\nLeave Feedback\nPULLING HARDENED CONTAINERS FROM REGISTRY ONE\n\nAll containers under the Iron Bank project are officially approved. See the following diagram on how to manually pull containers from Registry One. Automated pull capabilities coming soon.\n\nLaunch Registry One\n1. Click \"ironbank\" located under Project Name\n2. Click \"Repositories\" in the top menu bar\n3. Find an image to pull and click into the image\n4. Click the stacked document icon under \"Pull Command\" to copy the pull command to your clipboard\n5. Use the copied command in your terminal window\nPulling Containers\nHOW DO I USE A HARDENED CONTAINER AT A MULTI-SECURITY LEVEL?\n\nApplications are typically approved at multiple Impact Levels (IL). Each organization is welcome to accept reciprocity with our approvals, but may choose to do additional assessments such as an Intelligence Review. We are working on automatically transferring images from lower classification levels to higher classifications for immediate use.\n\nTHE IRON BANK PIPELINE\n\nEvery container must pass each phase of the Iron Bank pipeline to be available on Iron Bank and Registry One. Passing these six phases results in a container being signed and accredited.\n\nLearn More\nInitialization\nAntivirus Scan\nBuild\nScanning\nCheck CVEs\nPublish\nIron Bank Pipeline\nFEEDBACK FOR OUR ONBOARDING ON ANYTHING ELSE?\nOnboarding Feedback\nAMA Feedback\nHAVE MORE QUESTIONS?\n\nCheck out our FAQ page.\n\nFAQ"},{"id":"/products/iron-bank/getting-started","path":" products iron-bank getting-started","title":"Getting Started With Iron Bank","content":"STEP ONE: IMPORTANT FIRST STEPS\n1\n2\n3\n4\nIMPORTANT FIRST STEPS\n\nBefore moving on to the next section please make sure you have completed the following\n\nPlease reference this guide for what you need to do to be ready for Iron Bank.\nThe Iron Bank Onboarding Sessions are held every Wednesday from 1530-1630EST. You can register for an onboarding session in advance here.\nAlthough not required, you can join the AMA session to answer any questions you might have. These sessions are held every Wednesday from 1630-1730EST. You can also register for this session in advance by clicking here.\n\nNote: After registering for either meeting, you will receive a confirmation email containing information about joining the meeting.\n\nI have attended an onboarding session or have reviewed the virtual materials. *\n\nRead the above paragraph for more information. We highly recommend attending the onboarding session prior to submitting a container hardening request.\n\nYes\nNo\nOther:\nNext\nHAVE MORE QUESTIONS?\n\nCheck out our FAQ page.\n\nFAQ"},{"id":"/products/cnap","path":" products cnap","title":"Cloud Native Access Point","description":"CNAP is available on Cloud One to provide access to development, testing, and production enclaves at IL-2, IL-4, and IL-5","content":"CNAP CAPABILITIES\nBrings a full Zero Trust stack enforcing device state, user RBAC, and Software Defined Perimeter/Networks based on Google BeyondCorp concepts\nAllows access to Cloud One (AWS GovCloud and soon Azure Government) and Platform One without a bCAP or IAP\nAllows access from thick clients on BYOD, government owned devices (both mobile and desktop) while enforcing their device states by using AppGate as a zero trust client.\nAllows for VDI options for zero / thin clients\nEnables internet egress at IL5 in Dev enclaves\nBrings DMZ Network /Perimeter stack with break and inspect, IDS / IPS, WAF capability, full packet capture as an elastic Cloud based stack\nBrings Single Sign On with various DoD PKI options and IL2 MFA options.\nCentralizes/Aggregates logs and pushes to CSSP\nCNAP OVERVIEW\nMore Info\nAppGate\n\n**User will need P1 SSO access to view the pages\n\nMORE INFORMATION TO ENABLE YOUR MISSION\nAWS CNAP deployment overview\nCommon Components\nUse cases for IL-2 (Internet Accessible Workloads) and IL-4/5 (Non-Internet Accessible Workloads)\nGeneral Setup\nHAVE MORE QUESTIONS ABOUT CNAP?\n\nBehind the SSO, you'll be able to find most of your answers in the FAQ page categorized by Authentication, Client Connectivity, Monitoring, and much more! For more specific inquiries, click Contact Us.\n\nFAQ\nCONTACT US"},{"id":"/products/cybersecurity","path":" products cybersecurity","title":"CyberSecurity","description":"Platform One provides integrated cyber testing, monitoring, and event management for the infrastructure, platform, all enterprise services, and customer applications.","content":"ABILITY TO FIGHT AND WIN IS SOFTWARE DEPENDENT\nDEPENDENCIES\n\nThe capabilities of weapons systems and other critical systems are defined by the speed of software development and deployment\n\nCHALLENGES\n\nThe legacy approach to software development is a leading source of risk to DoD: it takes too long, is too expensive, and exposes warfighters to unacceptable risk\n\nINNOVATIONS\n\nModernize DoD software development to become safer, more automated and test driven by fundamentally changing the skillsets, processes, and platforms.\n\nPROGRAMS CAN SAVE WITH PLATFORM ONE\n\nThe Continuous Authorization approach saves program teams months of approval process time along with millions of dollars\n\n18 MONTHS\n\nPMOs/PEOs save per Program\n\n$12.5 MILLION\n\nSaved per 5 years of Program Planned time\n\n100 YEARS\n\nPlanned Program Time saved over 30+ Programs in P1’s first year\n\nLearn More\nTRADITIONAL AUTHORIZATION APPROACH\n\nAuthorize System\n\nSystem Development and Testing\nAuthorize System Security Controls\nAuthorize System\nOperate System\nINDUSTRY AVERAGE PERFORMANCE*\n\n(Traditional Development Approach)\n\nDeployment Frequency: 30-180 days\n\nLead Time for Changes: 30-180 days\n\nTime to Restore Service: 7-30 days\n\nChange Failure Rate: 46-60%\n\nCONTINUOUS AUTHORIZATION APPROACH\n\nAuthorize Platform, Process, Team\n\nAuthorize the Platform\nAuthorize the DevSecOps Process\nAuthorize the Team\n\nTeams that run the Platform\n\nTeams that Create, Build, Secure and Operate the Software Product\n\ncATO PERFORMANCE TARGETS*\n\n(Industry Elite DevSecOps Performance)\n\nDeployment Frequency: Multiple/day\n\nLead Time for Changes: Less than 1 day\n\nTime to Restore Service: Less than 1 hour\n\nChange Failure Rate: 0-15%\n\n*DORA Accelerate State Of DevOps Report\nDEVSECOPS LIFECYCLE FOR CtF AND cATO PROCESSES\n\nClick on the links below for an in-depth look into CtF requirements and cATO details\n\n SECURITY\n CONTROL GATE\n\nCertificate to Field (CtF) from Platform One is required to move your product into production within the Continuous Authority to Operate (cATO) framework.\n\nCtF Requirements\n\nThe cATO accredits the process, the people, and the culture that will continuously allow the delivery of applications through the rapid-delivery model and maintain the security required by the DoD.\n\nc\nATO Process\nHAVE MORE QUESTIONS ABOUT PLATFORM ONE?\n\nClick Get Answers to find most of your questions answered on the FAQ page. Click Contact Us for more specific inquiries.\n\nFAQ\nCONTACT US"},{"id":"/products/cybersecurity/dsopTimeline","path":" products cybersecurity dsopTimeline","title":"DevSecOps","content":"RAPIDLY DELIVERING SOFTWARE INFLUENCES\nTHE ABILITY TO FIGHT AND WIN\nTraditionally, the legacy process has taken years and millions of invested dollars for applications to get deployed. Although vetted through the proper risk assessment and security processes, by the time an application is completed, security measures have been updated and accreditation becomes outdated. With Platform One, you will see exponential savings of time and money using the DevSecOps / Agile method, while still focusing on cybersecurity.\nTRADITIONAL LEGACY PROCESS\nTimeline of how long a mission application would take going from acquisition to deployment\nTHE CAPABILITIES OF WEAPONS SYSTEMS AND OTHER CRITICAL SYSTEMS ARE DEFINED BY THE QUICKNESS OF SOFTWARE DEVELOPMENT AND DEPLOYMENT\nTHE BENEFITS OF THE DEVSECOPS / AGILE PROCESS\n\nAgile processes focus on interative development cycles in which feedback is continuously reintegrated, while DevSecOps methodologies emphasize security at the earliest stages of development\n\nA CONTINUOUS CYCLE OF RESEARCH, DEVELOPMENT, TESTING, AND SECURITY\nCyber Scanning - 1\nSoftware Assurance - 2\nTesting - 3\nAccreditation - 4\nDevSecOps & Agile Savings"},{"id":"/products/cybersecurity/ctf","path":" products cybersecurity ctf","title":"Certificate to Field","description":"The CtF is the application-level accreditation that allows your application to run in a specific environment within the DoD.","content":"WHAT IS THE CERTIFICATE TO FIELD (CtF)?\nWHO NEEDS A CtF\n\nA CtF must be issued for all applications developed within Platform One to allow them to operate in a production environment at the specified Impact Level (IL) or classification within the DoD.\n\nDATA USAGE\n\nA CtF must also be issued for any application that uses production data regardless of environment (Test/Staging/Production), IL, or Classification.\n\nCtF EXPIRATION\n\nOnce a CtF is issued, it is good for one year from the date of issuance, unless the product moves to the next major version or implements an architectural change that would require modification of the controls being assessed.\n\nTHREE MAIN PARTS TO RECEIVING A MISSION APPLICATION CtF ACCREDITATION\nPASSING THE PIPELINE\nPlatform One will create and deploy a CI/CD pipeline to your repository comprised of a full suite of industry standard testing tools. This pipeline will make sure that your application code is secured and ready to be deployed to the DoD.\nYou will be able to see a visual representation of your pipeline on GitLab - the CI/CD section allows you to view each stage and its status (green check marks for passing, red Xs for failures). You can also view the output of each stage.\nWhen the time comes for CtF approval, the security team will review the pipeline and each individual stage to make sure that you have properly passed each stage without errors or warnings.\nHARDENED DOCKER IMAGES\nPlatform One provides an entire suite of hardened images available to teams through Iron Bank.\nHardened images are stripped-down versions of Docker images approved to be used within the DoD.\nHardened Docker images ensure the application you deploy into the Platform One Kubernetes clusters follows all security checks. Failure to do so results in the image-checking stage failing in the pipeline.\nExplore Iron Bank\nSDELEMENTS\nSDElements is a security questionnaire based on multiple NIST standards that ensures your application follows best security practices.\nThe questionnaire is comprised of questions about your application's tech stack, how it connects, how it sends data, etc.\nThere is 1 questionnaire per application service (UI, API, any other service your application runs).\nSDElements will generate 50+ questions that your team will need to answer to address and explain how your application tackles industry standard practices.\nHIGH-LEVEL CTF STEPS\n\nThe CtF process is comprised of three main phases and ends with a CtF meeting\n\n1. ONBOARDING\nStart your CtF journey and have your first engagement with the cybersecurity team. The cybersecurity team will provision all the required tools for CtF and explain each element to you so you understand what is required. The goal is to ensure there are no major roadblocks or hiccups down the road.\n2. WORK\nDuring this phase, you will work on your applications. You will leverage the tools provisioned in the cybersecurity onboarding process to ensure you meet the intent of the CtF while designing and developing your application's Minimal Viable Product (MVP).\n3. ASSESSMENT\nOnce you complete your MVP and all the items in your CtF checklist (more on this soon), the cybersecurity team will start their assessment of your application and its services. Expect some back-and-forth during this phase to address incomplete or vague items, or those that do not meet the intent of the control.\n4. CTF MEETING\nAfter the assessment is complete, your team will participate in the CtF meeting. The meeting includes all stakeholders and consists of a review of your application, its architecture, and the controls. The Platform One Chief Information Security Officer will then make the CtF issuance determination for the application.\nLearn More\nHAVE MORE QUESTIONS ABOUT PLATFORM ONE?\n\nClick Get Answers to find most of your questions answered on the FAQ page. Click Contact Us for more specific inquiries.\n\nFAQ\nCONTACT US"},{"id":"/products/cybersecurity/cato","path":" products cybersecurity cato","title":"cATO = CONTINUOUS AUTHORIZATION","description":"Continuous Authority to Operate (cATO) allows rapid delivery to the DoD","content":"WHAT IS CONTINUOUS AUTHORITY TO OPERATE (cATO)?\nTRUST\n\nTrust is established through assessments and authorizations of the process, the team, and the platform for managing the cyber risk of an application coming out of a software factory.\n\nRISK\nDETERMINATION\n\nApplication change risks are mitigated by the use of DevSecOps control gate pass/fail rules and security automation findings and analysis.\n\nSECURE\n\nIdempotence and immutability provide for consistent, repeatable, and secure application support infrastructure and near real-time visualization of the security posture.\n\nCOMPONENTS TO cATO\nFOCUS ON THE MISSION\ncATO places the focus on the mission software rather than the platform. Platform One was created so that DoD teams could focus primarily on their mission applications, rather than having to develop a platform and software factories.\nFEEDBACK & MONITORING\ncATO replaces the traditional linear authorization process and works in a continuous process. Security requirements are met due to continuous monitoring and always stay in compliance.\nDEVSECOPS\nDevSecOps (Development Security Operations) provides one of the main benefits of cATO. Automatically injected sidecar containers provide risk reduction alongside Kubernetes. Infrastructure as Code (IaC), continuous intregration, continuous deployment, and security throughout provides insight on risks.\nMVP'S STREAMLINE DEVELOPMENT\ncATO saves time in later development cycle, as risk and errors are continously reduced during deployment activities.\ncATO METHOD\ncATO PROCESS\n\nThe Continuous Authorization approach provides authorization of platform(s), processes and teams. The platform (including development, test, pre-production, and production environments) is assessed and authorized using Risk Management Framework (RMF) processes. The platform incorporates continuous monitoring with behavior modification/zero trust enforcement and integrated Tier 2 CSSP support.\n\nThe cATO process is adaptable to differences in component/change risk, urgent mission needs, and the AO's risk tolerance. cATO moves from compliance-driven risk management to data-driven risk management.\n\nAuthorizing the team allows review of the program office personnel experience, clearances, skills, and certification requirements. Critical team members are interviewed to assess their knowledge of the program office's DevSecOps continuous authorization process and their understanding of the AO's risk tolerance. Integrated training workshops and tabletop excercises are held to ensure that individual teams work collaboratively within the continuous authorization process. Ongoing team performance is monitored against the outcome metrics established for the program.\n\nHAVE MORE QUESTIONS ABOUT PLATFORM ONE?\n\nClick Get Answers to find most of your questions answered on the FAQ page. Click Contact Us for more specific inquiries.\n\nGet Answers\nCONTACT US"},{"id":"/residency","path":" residency","title":"Residency","description":"Are you ready to take the leap? Consider joining Platform One and the DevSecOps Initiative in the experience of a lifetime by joining us for a 6-month remote Residency. Here’s your chance to learn a skill, hone a talent, experience a different culture and put your fingerprints on the transformation of DoD in one of the most crucial moments yet.","content":"PURPOSE\nPlatform One is seeking applicants for our competitive 6-month residency program! This program is intended to build a cadre of DevSecOps users and professionals to accelerate DevSecOps adoption and capabilities within the DoD, and directly support the DoD DevSecOps initiative. Legacy software acquisition and development practices in the DoD do not provide the agility to deploy new software “at the speed of operations”. In addition, security is often an afterthought, not built in from the beginning of the lifecycle of the application and underlying infrastructure. DevSecOps is the industry best practice for rapid, secure software development.\nDevSecOps is an organizational software engineering culture and practice that unifies software development (Dev), security (Sec) and operations (Ops). The main characteristics of DevSecOps are automation, monitoring, and security application in all phases of the software lifecycle: plan, develop, build, test, release, deliver, deploy, operate, and monitor. In DevSecOps, testing and security are conducted earlier in the development process through automated unit, functional, integration, and security testing - this is a key DevSecOps differentiator since security and functional capabilities are tested and built simultaneously.\nRESIDENCY DETAILS\n\nProspective candidates are military (CONUS - Active Duty) and DoD Civil Service with the following skill sets:\n\nSOFTWARE DEVELOPMENT\nCYBER SECURITY\nDESIGN THINKING\nSOFTWARE PRODUCT MANAGEMENT\nACQUISITIONS / CONTRACTING\nSelected program residents will be full time employees at Platform One and will work remotely on one of the various Value Streams at Platform One: Big Bang, Party Bus, Iron Bank, CNAP, Cyber, or Acquisitions. Program residents will learn and participate in the best application development practices, learn to use, manage, and build DevSecOps pipelines, and develop an appreciation of the importance of design thinking in product development. Program residents with a cybersecurity background, will develop a deeper understanding of how cybersecurity is executed in accordance with the DoD\nDevSecOps Reference Design, will learn more about how Platform One manages its continuous Authority to Operate (cATO), and learn how to accredit mission applications using the Risk Management Framework. Program residents with Acquisition Program Management or Contracting experience (Contract Specialist and Contracting Officers) will learn more about how contracting vehicles like Small Business Innovate Research (SBIR), and Basic Ordering Agreements (BOA) contract vehicles enable the acquisition and scaling of talent, software licenses, and cloud services to enable service delivery at Platform One.\nVALUE STREAMS\n\nPlatform One will only be selecting a set quantity of residents to embed within our value streams as depicted below:\n\nDownload DoD-wide approved containers or harden with Iron Bank\nDeploy your own software factory with Big Bang\nGet hands-on experience onboarding with Party Bus\nCNAP\nProvide access to development, testing, and production enclaves\nStay secured with our Cybersecurity team processes\nAPPLICATION PROCESS\n\n28 February 2022 - 15 April 2022\n\n18 April 2022 - 22 April 2022\n\n25 April 2022\n\n29 April 2022\n\n2 May 2022\n\nApplication Submission Window\n\nInterviews will be conducted\n\nSelected residents will be notified\n\nProspective residents must send back Memorandum of Agreement signed by their Commanders to confirm their seat.\n\nConfirmed selectees will receive an acceptance letter from the Platform One Materiel Leader. Begin Residency.\n\nHOW TO APPLY\nWrite a single page Letter of Intent detailing your: Background, Experiences, Interests and goals, WHY this opportunity is important to you in further developing your DevSecOps knowledge, and What weapon or IT systems you hope to support in the future? Be sure to include your current branch of service and unit information on letter. Contracting Only: List your years of experience, warrant, and certification level.\n\nFill out skills matrix spreadsheet (N/A to Acquisitions/Contracting)\n\nSkills Matrix Sheet\n\nFill out your form, upload letters of intent, and skills matrix by clicking the “Apply Here” button below. Commander or equivalent approval is required to participate in this program.\n\nApply Here\n\nApply to the Residency, NLT 15 April 2022. Applications received after this date will not be considered.\n\nCOORDINATING INSTRUCTIONS\n\nSelected applicants must be able to start the six-month residency on 2 May, 2022. The program will last for 6 months and will be 100% Remote. There are no TDY costs associated with the residency program. Applicants must have at least 6 months left at their current duty station or service commitment to be eligible to apply. There is no payback tour incurred by participating in this opportunity.\n\nHAVE MORE QUESTIONS ABOUT THE RESIDENCY PROGRAM?\nCONTACT US"},{"id":"/contact-us","path":" contact-us","title":"Contact Us","content":"First Name\nLast Name\nSector\nGovernment Sponsoring Program*\n* required\nEmail*\n* required\nPhone*\n* required\nHow can we help?\nHow did you hear about Platform One?\nSend Info\n If you have a tech issue, please visit the Platform One Support Hub.\nLOOKING FOR THE RESIDENCY PROGRAM SIGN UP?\nResidency Program"},{"id":"/products/party-bus/ama","path":" products party-bus ama","title":"AMA","content":"CALLING ALL PARTY BUS CUSTOMERS AND POTENTIAL PARTY BUS PASSENGERS\nMark your calendars for the following dates. Party Bus will be hosting an \"Ask an Engineer\" Session the last Wednesday of each month through November.\nUpcoming Sessions\nJuly 27th\nAugust 31st\nSeptember 28th\nClick Here To Join The Session!"}]
