User Manual & ATO Walkthrough

What is iLAB SecureX?

The platform that turns months of manual ATO work into weeks of automated, evidence-driven compliance.

iLAB SecureX is an automated Authority to Operate (ATO) platform built for DoD and federal government systems. It replaces the traditional manual process — where ISSOs spend 6 to 18 months writing control narratives by hand, taking screenshots of configurations, and formatting 500-page documents — with a live, evidence-driven workflow.

The platform does three things that no manual process can:

1. Collects evidence automatically — 6 pluggable adapters connect directly to your AWS infrastructure, source code repositories, vulnerability scanners, SBOM generators, STIG compliance tools, and test frameworks. Evidence is collected via API, not screenshots.
2. Generates narratives with AI — Amazon Bedrock reads your actual evidence and writes control implementation narratives that reference your real IAM roles, VPC configurations, and scan results. Not boilerplate — evidence-specific.
3. Exports submission-ready packages — One click produces OSCAL JSON, Word documents, PDFs, or eMASS CSV files ready for your assessor.

Who Uses iLAB SecureX?

Supported Compliance Frameworks

Meet the Team

Throughout this manual, we follow a fictional team as they use iLAB SecureX to get an ATO for their cloud-native application.

Let's follow Sarah as she takes TMSA from zero to ATO-ready using iLAB SecureX.

Register Your System

Sarah's first step: tell the platform about the system she needs to authorize.

The Systems page is the home screen of iLAB SecureX. It shows all authorization boundaries (systems) managed by the platform. Each system has its own controls, evidence, narratives, and export packages.

Figure 1.1: The Systems page — Sarah's starting point. She can see any existing systems and create new ones.

Creating a New System

Click "Create system" in the top right to open the system registration form.

Figure 1.2: The Create System form. Sarah fills in the system details that will appear in the SSP.

Form Fields

After clicking "Create system", the platform:

1. Creates the system record with a unique UUID
2. Loads the control catalog from the assigned compliance profile
3. Applies the inheritance model (marking CSP-inherited controls)
4. Redirects Sarah to the System Dashboard

The System Dashboard

Sarah's command center — a single view of where the system stands in the ATO process.

Figure 2.1: The System Dashboard for TMSA. Shows 14% ATO readiness, 141 controls, 170 evidence artifacts, and the ATO Journey Timeline.

Dashboard Sections

Executive Summary

The top card shows the key metrics at a glance:

• ATO Readiness — Percentage of controls fully implemented or inherited. A system typically needs 90%+ before submitting for assessment.
• Risk Posture — Overall risk level based on unimplemented controls and open POA&M items.
• Est. Time to ATO — Estimated calendar days to reach ATO-ready status, calculated from your current implementation velocity.
• POA&Ms — Number of active Plan of Action & Milestones items.
• Control Implementation Progress — Progress bar showing implemented vs. total controls.
• Evidence Health — Fresh evidence (collected within 30 days), stale evidence (older than 30 days), and missing evidence (controls without any evidence).

POA&M Summary

Shows total POA&M items, overdue count, in-progress count, completed count, and a remediation progress bar. High-priority items and upcoming due dates are highlighted.

ATO Journey Timeline

A visual 5-phase timeline showing where you are in the ATO process:

1. Evidence Collection — Collect compliance artifacts from infrastructure
2. Narrative Generation — AI generates control implementation narratives
3. ISSO Review & Approval — Human review and approval of narratives
4. Security Assessment — Independent assessment by 3PAO or government assessor
5. ATO Authorization — Final authorization decision by the AO

Evidence Adapters

Shows the status of all 6 evidence adapters — which are connected, how many artifacts each has collected, and when the last collection ran. Click "Configure" to set up any adapter.

Quick Actions

One-click shortcuts to the most common workflows: Collect Evidence, Generate Narratives, Export Package, and Run Gap Assessment.

Control Status Pie Chart

A donut chart showing the breakdown of control implementation status: Implemented (green), Partially Implemented (orange), Planned (blue), Inherited (purple), and Not Applicable (grey).

Collect Evidence

The foundation of every ATO — real, current evidence from your actual infrastructure.

The Evidence Library page is where you collect, view, and manage all compliance evidence for a system. Evidence is the raw data that proves your system implements security controls.

Figure 3.1: The Evidence Library. Top: collection panel with adapter selection. Bottom: all 170 collected evidence artifacts with types, sources, control mappings, timestamps, and integrity hashes.

Step-by-Step: Collecting Evidence

Understanding Evidence Artifacts

Each collected artifact has:

• Evidence Type — The category (e.g., iam_policy_snapshot, rbac_configuration, vulnerability_scan)
• Source Adapter — Which adapter collected it (e.g., aws, source-code)
• Mapped Controls — The NIST 800-53 control IDs this evidence supports (e.g., AC-2, AC-3, SC-7)
• Collected At — Timestamp of when the evidence was collected
• SHA-256 Hash — Cryptographic integrity hash proving the evidence hasn't been tampered with

Collection Run History

Below the collection panel, a Collection Run History table shows all previous collection runs with their status, adapters used, artifact counts, and timestamps. This provides an audit trail of when evidence was collected.

Review Evidence Gaps

What's missing? The gap analysis tells you exactly which controls need more evidence.

Figure 4.1: Evidence Gap Analysis. In this case, all required evidence is present — no gaps detected. When gaps exist, the table shows each control ID, family, severity, and the specific missing evidence types.

The gap analysis page shows:

• Control ID — The NIST 800-53 control that has insufficient evidence
• Family — The control family (AC, AU, CM, IA, SC, etc.)
• Severity — How critical the gap is (Critical, High, Medium, Low)
• Missing Evidence — The specific evidence types needed, with the adapter that should collect them

When gaps are found, the remediation path is clear: go back to the Evidence page, select the appropriate adapter, and collect the missing evidence type.

The Control Catalog

141 controls, searchable and filterable — the backbone of your ATO package.

Figure 5.1: The Control Catalog. 141 controls with search, family filter, implementation status, responsibility, and narrative status columns.

Understanding Control Status

Responsibility Types

• Customer — Your organization is fully responsible for implementing this control
• Inherited — The CSP (e.g., AWS) is fully responsible
• Shared — Both the CSP and your organization share responsibility
• Provider — A service provider is responsible

Narrative Status

• Approved — ISSO has reviewed and accepted the narrative
• Draft — AI-generated, pending human review
• Rejected — Needs revision
• None — No narrative generated yet

Click any Control ID link to open the Control Detail page.

Generate AI Narratives

The AI reads your evidence and writes control implementation narratives — specific to your system, not boilerplate.

Figure 6.1: The Narrative Review page. Shows 121 of 141 narratives generated, 5 approved, 116 pending review. The AI model selector and bulk action buttons are in the header.

Step-by-Step: Generating Narratives

What Makes These Narratives Different

Unlike template-based tools that produce generic boilerplate, iLAB SecureX narratives reference your actual data:

• For AC-2 (Account Management), the AI cites the specific IAM roles it found in your AWS account, their permission boundaries, and the RBAC patterns in your source code
• For SC-7 (Boundary Protection), it describes your actual VPC configuration with subnet counts and security group rules
• For RA-5 (Vulnerability Scanning), it references the Trivy scan results with specific CVE counts and severity levels

Review & Approve Narratives

AI drafts, humans decide — the ISSO reviews every narrative before it enters the ATO package.

Figure 7.1: The Control Detail page for AC-2 — Account Management. Shows the AI-generated narrative (draft status), linked evidence artifacts with integrity hashes, and the Generate/Edit/Approve buttons.

The Control Detail Page

Each control has a dedicated detail page showing:

Key Metrics (top bar)

• Implementation Status — Current status (Implemented, Partially Implemented, Planned, Inherited)
• Responsibility — Who is responsible (Customer, Inherited, Shared)
• Narrative Status — Draft, Approved, or Rejected
• Evidence Count — Number of evidence artifacts linked to this control

Implementation Narrative

The main section shows the AI-generated narrative text. Three action buttons are available:

• Generate Narrative — (Re)generate the narrative using AI. Sends the control's linked evidence to Amazon Bedrock.
• Edit — Opens the narrative in a text editor so the ISSO can make manual adjustments.
• Approve — Marks the narrative as approved. Only appears when the status is "draft" or "review."

Linked Evidence

A table showing all evidence artifacts mapped to this control, including:

• Evidence Type (e.g., rbac_configuration, iam_policy_snapshot)
• Source adapter (e.g., source-code, aws)
• Collection date
• SHA-256 integrity hash (truncated for display)

Bulk Approval

Back on the Narrative Review page, the "Approve All Drafts" button lets the ISSO bulk-approve all draft narratives at once. The button shows the count of pending drafts (e.g., "Approve All Drafts (116)").

Export the ATO Package

One click produces submission-ready documents in the format your assessor needs.

Figure 8.1: The Export Center. Four export formats available, with a history of previously generated exports showing filenames, formats, dates, and content counts.

Available Export Formats

Generating an Export

1. Select the desired format by clicking its tile
2. Click "Generate Export"
3. A success alert appears with the filename and a download link
4. The export appears in the Export History table below

Each export includes:

• System information (name, acronym, impact level, deployment environment)
• All control implementations with narratives
• Evidence references with integrity hashes
• POA&M items (if any)
• Metadata (control count, evidence count, generation date)

Manage Compliance Profiles

Compliance frameworks are configuration, not code — add new frameworks by creating a YAML profile.

Figure 9.1: The Profiles page. 5 built-in profiles covering IL5, IL4, FedRAMP High, CMMC Level 2, and NIST 800-171. Custom profiles can be created with the Profile Builder.

Built-in Profiles

The Profile Builder (8-Step Wizard)

Click "Create profile" to open the Profile Builder — an 8-step wizard that guides you through creating a custom compliance profile:

1. Basic Information — Profile ID, name, version, framework, baseline, description, target application types, target environments
2. Catalog — Control catalog source, baseline, exclusions (controls to skip), and additions (extra controls)
3. Inheritance (optional) — CSP provider name, SSP reference, and inherited control definitions with status (fully inherited, shared, customer responsible)
4. Evidence Mappings — Map controls to required evidence types, specify which adapter collects each type, and write AI narrative prompts per control
5. Narrative Templates (optional) — Handlebars templates for formatting AI-generated narratives
6. Export Configuration — Enable/disable OSCAL, Word, PDF, and eMASS export formats
7. Evidence Collection — Collection schedule (cron expression), on-deployment collection toggle, retention period
8. Review & Save — Summary of all settings with validation

Evidence Adapters

Pluggable evidence sources — 6 built-in, unlimited custom.

Figure 10.1: The Adapters page. 6 built-in adapters: AWS Evidence, Source Code Analyzer, Trivy, SBOM, OpenSCAP, and Test Results. Custom adapters can be created with the "Create adapter" button.

Built-in Adapters

Adapter Detail Page

Click any adapter name to open its detail page, which shows:

• Configuration — ID, version, source (built-in or custom), enabled status, target environments
• Connection Settings — Dynamic form generated from the adapter's JSON Schema (for custom adapters with configurable connection parameters)
• Supported Evidence Types — All evidence types this adapter can collect
• Test Adapter — Enter a scan target and run a test to verify the adapter works
• Health Check — Verify connectivity to the adapter's data source

Creating a Custom Adapter

Click "Create adapter" to register a new evidence source. You provide:

• ID — Unique kebab-case identifier (e.g., postgresql)
• Name — Human-readable name
• Description — What the adapter collects
• Evidence Types — Comma-separated list of evidence types it produces
• Target Environments — Where it can run (e.g., aws, on-premise)
• Config Schema (JSON) — A JSON Schema defining connection settings fields (host, port, credentials, etc.). The platform auto-generates a configuration form from this schema.

AI Agents

Pluggable AI reasoning — different agents for different compliance frameworks and tasks.

Figure 11.1: The AI Agents page. 3 built-in agents (Narrative Generator, Gap Analysis, Risk Assessment) plus the custom CMMC Level 2 Assessor.

Built-in Agents

Threat Intelligence Agents

Three new agents transform compliance findings into threat-informed intelligence using MITRE ATT&CK, CISA KEV, and EPSS data via a Bedrock Knowledge Base.

Agent Detail Page

Figure 11.2: Agent Detail page — Overview tab showing configuration (ID, version, provider, source, approval requirement) and capabilities.

Each agent has three tabs:

Overview Tab

Shows the agent's configuration: ID, version, provider (bedrock), source (built-in or custom), whether it requires human approval, and its capabilities.

Invoke Agent Tab

Figure 11.3: The Invoke Agent tab. Select a capability, optionally select a target system, add instructions, and click Invoke.

To invoke an agent:

1. Select a Capability — Choose which capability to run (e.g., narrative_generation, gap_analysis)
2. Select a Target System (optional) — The system whose evidence the agent will analyze
3. CMMC Domain Filter (CMMC agents only) — Scope the assessment to a specific domain (AC, AU, CM, IA, SC, etc.) for thorough per-practice analysis
4. Additional Instructions (optional) — Free-text instructions for the agent
5. Click "Invoke"

The agent's output is rendered as formatted HTML with headers, bullet points, and evidence citations. If the agent requires human approval, Approve and Reject buttons appear below the output.

History Tab

Shows all previous invocations for this agent with: invocation ID, capability, status, approval status, who triggered it, date, and action buttons. Click any invocation to view its full output in a modal.

Creating a Custom Agent

Click "Create agent" on the Agents list page. Provide:

• ID — Unique kebab-case identifier
• Name — Human-readable name
• Description — What the agent does
• Provider — AI backend (bedrock, openai, custom)
• Capabilities — Comma-separated list of capabilities
• Requires Human Approval — Whether outputs need ISSO approval before use

POA&M Management

Track known weaknesses with remediation plans, milestones, and deadlines.

Plan of Action & Milestones (POA&M) items track known security weaknesses that need remediation. They're a required part of every ATO package.

Creating a POA&M Item

Navigate to the POA&M page from the System Dashboard (click "View All POA&Ms"). Each POA&M item includes:

• Control ID — The NIST 800-53 control with the weakness
• Weakness Description — What the gap or vulnerability is
• Severity — Critical, High, Medium, or Low
• Status — Open, In Progress, Completed, or Risk Accepted
• Remediation Plan — Specific steps to address the weakness
• Responsible Party — Who owns the remediation
• Milestones — Individual remediation steps with due dates

POA&M Summary (Dashboard)

The POA&M Summary card on the System Dashboard shows:

• Total POA&M count, overdue items, in-progress items, completed items
• Remediation progress bar
• High-priority items (critical/high severity that are still open)
• Items due within 30 days

Continuous Monitoring & cATO

ATO isn't a one-time event — it's a continuous process. iLAB SecureX is built for cATO.

Traditional ATO is a point-in-time snapshot that goes stale immediately. iLAB SecureX is designed for Continuous Authority to Operate (cATO):

• Scheduled Evidence Collection — Evidence adapters can run on configurable schedules (daily, weekly, or custom cron expressions). New evidence is collected automatically without manual triggers.
• Live Dashboards — The System Dashboard shows real-time compliance posture. ATO readiness, evidence freshness, and control status update with every collection run.
• Drift Detection — When a configuration changes (a security group opens, CloudTrail is disabled, a new vulnerability appears), the platform detects it on the next collection run and updates the compliance posture.
• Webhook Notifications — Register webhooks to receive real-time notifications when evidence changes, controls drift, or POA&M items become overdue.

The cATO Workflow

1. Initial ATO package is submitted and authorized
2. Evidence adapters run on schedule (e.g., daily at midnight)
3. Dashboard shows real-time compliance posture to the ISSM
4. When drift is detected, the ISSO is notified and creates POA&M items
5. The AO has a live view of compliance posture — no waiting for the next reauthorization cycle

Threat Intelligence

Transform compliance findings into threat-informed defense — know which adversaries can exploit your open findings.

The Gap: Compliance Data as Threat Intelligence

Every STIG assessment generates thousands of findings, but those findings are treated as compliance checkboxes — not as threat intelligence. The gap: nobody connects "this STIG finding is open" to "this is the specific adversary technique that exploits it."

iLAB SecureX bridges that gap with three threat intelligence agents that transform compliance data into adversary-informed, prioritized intelligence.

The Three-Agent Pipeline

1. Threat Exposure Mapper

Takes STIG/CIS findings and control gaps from the existing compliance pipeline and maps them to MITRE ATT&CK techniques using published NIST 800-53 → ATT&CK mappings.

Input: Open findings and control gaps (already generated by existing agents)

Output: For each finding — the ATT&CK techniques it enables, which adversary groups use those techniques, and potential attack paths through the environment.

Key insight: No new data collection required. It transforms data the platform already produces.

2. Adversary Prioritization Agent

Takes the ATT&CK mappings from the Threat Exposure Mapper and ranks remediation by adversary relevance — not just severity category.

Prioritization factors:

• Adversary relevance — Does the finding enable techniques used by threat groups targeting your sector?
• CISA KEV status — Is the vulnerability in the Known Exploited Vulnerabilities catalog?
• EPSS score — Probability of exploitation in the next 30 days
• Attack path position — Initial access findings rank higher than lateral movement
• Blast radius — Perimeter-exposed systems rank higher than internal-only

Output: A threat-informed remediation priority stack with immediate/short-term/medium-term/long-term action items and risk reduction projections.

3. Threat Landscape Monitor

Continuously watches external threat feeds and re-prioritizes when the landscape changes.

Triggers:

• New CVE that maps to a STIG control you have open
• New CISA KEV entry affecting your tech stack
• EPSS score increase for a vulnerability in your environment
• New ATT&CK technique attribution to a threat group in your adversary set

Output: Real-time re-prioritization alerts with severity, affected findings, and recommended actions.

Recommended schedule: Every 6 hours for continuous monitoring.

Bedrock Knowledge Base

The threat intelligence agents are backed by a Bedrock Knowledge Base containing:

• MITRE ATT&CK Enterprise — Full technique catalog with adversary group profiles
• NIST 800-53 → ATT&CK mappings — Published by the MITRE Center for Threat-Informed Defense
• CISA KEV catalog — Known exploited vulnerabilities with remediation deadlines
• EPSS scores — Exploit prediction scores for probability of exploitation
• Curated adversary profiles — DoD/diplomatic sector threat groups (APT28, APT29, APT41, Lazarus Group, Charming Kitten, Volt Typhoon, Sandworm, Kimsuky)

The KB uses Bedrock's managed vector store — no OpenSearch or Aurora required. Cost is pay-per-query only, essentially zero when idle.

Default Adversary Profile: DoD/Diplomatic Sector

Adversary profiles are configurable per deployment. Organizations can define their own priority threat groups based on their sector and mission.

Invoking Threat Intelligence Agents

Navigate to AI Agents → select the threat intelligence agent → Invoke Agent tab:

1. Select the capability (e.g., threat_exposure_mapping)
2. Select the target system
3. Optionally add instructions (e.g., "Focus on perimeter-exposed systems")
4. Click "Invoke"

Or via API:

POST /api/v1/agents/threat-exposure-mapper/invoke
{
  "capability": "threat_exposure_mapping",
  "systemId": "your-system-uuid",
  "prompt": "Map all open findings to ATT&CK techniques"
}

The Before & After

AI-Powered ATO Automation

Six new AI agents that automate the most time-consuming parts of the ATO process.

Inheritance Resolution

Navigate to your system dashboard and click "Resolve Inheritance". The agent analyzes your deployment environment and determines which controls are inherited from your Cloud Service Provider.

For AWS GovCloud systems, this typically marks 50-70 controls as inherited or shared, jumping your ATO readiness from ~14% to ~50% in one step.

Review the results table, override any decisions you disagree with, then click "Accept All" or "Apply Selected".

POA&M Generator

After running gap analysis, invoke the POA&M Generator agent. It creates properly formatted POA&M items for every evidence gap, complete with weakness descriptions, severity justifications, remediation plans, and milestones.

Package Validator

Before exporting your ATO package, run the Package Validator. It checks that every control has a narrative or POA&M, evidence is fresh, narratives reference real evidence, and framework requirements are met.

Assessor Simulator

The Assessor Simulator predicts what a real 3PAO assessor would flag during review. It identifies weak narratives, missing evidence, and controls that don't match their implementation claims. Fix these issues before the real assessment.

Compliance Trend Analyst

The Compliance Trend Analyst shows how your compliance posture has changed over time, predicts when you'll be ATO-ready based on current velocity, and recommends focus areas for fastest improvement.

Full ATO Orchestrator

The Full ATO Orchestrator runs the complete pipeline in one step: inheritance resolution, gap analysis, POA&M generation, package validation, and assessor simulation. Produces a comprehensive readiness report showing exactly where you stand and what to do next.

The ATO Readiness Process

All Features & Capabilities

A complete reference of every feature in iLAB SecureX.

Navigation

The sidebar navigation provides access to all major sections:

• Systems — List and manage authorization boundaries
• Profiles — View and manage compliance framework profiles
• Profile Builder — Create custom compliance profiles (8-step wizard)
• Adapters — View and manage evidence collection adapters
• AI Agents — View and manage AI agents for compliance automation

System-Level Pages

Within each system, the following pages are available:

• Dashboard — Executive summary, ATO readiness, compliance timeline, adapter status, quick actions
• Controls — Full control catalog with search, filter, and status tracking
• Control Detail — Individual control with narrative, evidence, and approval workflow
• Evidence — Evidence collection panel, artifact table, collection run history
• Evidence Gaps — Gap analysis showing controls with missing evidence
• Narratives — Bulk narrative generation, AI model selection, approval progress
• Export — Package generation in OSCAL, Word, PDF, and eMASS formats
• POA&M — Plan of Action & Milestones management

API Access

Every feature in iLAB SecureX is accessible via REST API. The dashboard is a consumer of the API — not a separate system. Third-party tools, CI/CD pipelines, and GRC platforms can integrate directly.

API Base URL: https://<your-api-gateway>/v1/api/v1/

Authentication: Bearer token (JWT) or API key (X-API-Key header)

Keyboard Shortcuts & Tips

• Click the ⓘ icons throughout the UI for contextual help on any field or column
• Use the search box on the Control Catalog to quickly find controls by ID or title
• Use the family filter dropdown to focus on a specific control family (AC, AU, CM, etc.)
• The breadcrumb trail at the top of every page shows your current location and lets you navigate back