RMFInsider

To inherit controls in eMASS, open your system, go to the Controls tab (or the dedicated Inheritance view, depending on your instance), search for the common control provider system (your hosting facility, enclave, or cloud provider), select the controls that provider offers for inheritance, and submit the inheritance request. The provider’s ISSO or ISSM approves it on their side, and the controls appear in your baseline marked as inherited, carrying the provider’s implementation and validation status. Then you document, on every inherited control, what the provider covers and what you still own. Skipping that last part is how inheritance gets rejected at assessment.

If you need the concept before the mechanics, start with control inheritance in RMF explained. This post is the eMASS click path plus the documentation that makes it hold.

Step 1: Identify the provider and what it actually offers

Every common control provider publishes (or should publish) a list of controls it offers for inheritance, usually called a Common Control Provider (CCP) package or an inheritance matrix. Physical and environmental controls (PE family) from the data center, boundary protection (SC-7) from the enclave, and personnel security (PS family) from the organization are the standard offerings. Cloud providers offer their FedRAMP or DoD Provisional Authorization control set; FedRAMP vs DoD RMF for cloud explains how those map.

Get the matrix before you touch eMASS. Requesting inheritance for a control the provider does not actually offer wastes a week and irritates the one ISSO you will need favors from later.

Step 2: Request inheritance in eMASS

• Open your system and go to the Controls tab. Look for an Inheritance, Inherit Controls, or Manage Inheritance action. Placement varies by instance version.
• Search for the provider system by name or system ID. You need to be in the same eMASS instance (or organization) as the provider; cross-instance inheritance goes through a manual, document-based process instead.
• The provider’s inheritable controls list appears. Select the controls you want. Where the provider offers a control as hybrid, it will usually be flagged; select it anyway and plan to write your half.
• Submit the request. It routes to the provider’s approver role.

Email the provider ISSO the same day. eMASS notifications go to the same inbox as every other eMASS notification, which is to say they are ignored. A one-line “inheritance request submitted for SYSTEM-X, 42 controls, PE and SC families” gets it approved this week instead of next quarter.

Step 3: Verify what came through

Once approved, run the Control Status report and filter on the inherited flag. Check three things on each inherited control:

• The provider’s implementation status and validation status carried over. An inherited control that the provider has not validated is inherited risk, not inherited compliance.
• The provider’s authorization is current. If their ATO expires before yours, your inherited controls expire with it, and the AO will ask.
• The inheritance type (full versus hybrid) matches your understanding. eMASS sometimes reflects the provider’s default, which is not always what the matrix said.

Running and reading eMASS reports covers that filter and the columns to check.

Step 4: Document the split on every hybrid control

This is where inheritance succeeds or fails at assessment. A fully inherited control needs a one-sentence implementation statement: “PE-3 is fully inherited from [Provider], ATO dated [date]; the system has no physical components outside the provider’s controlled space.” A hybrid control needs two paragraphs: what the provider does, then what you do.

Example, AU-6 (Audit Review) as a hybrid: “The enclave SOC reviews boundary and network device logs daily under the provider’s AU-6 implementation (inherited). The system ISSO reviews application and database audit logs weekly in Splunk using the saved search “SYS-Weekly-Audit-Review” and records findings in the audit review log (system-owned). Evidence: artifact AU-6 – Weekly Audit Review Log – 2026-08.” That is the split validators want to see, and it is the split they rarely get. Writing implementation statements has the full structure.

Step 5: Attach the provider’s evidence, or a pointer to it

Validators may or may not have access to the provider’s system in eMASS. Ask the provider for a copy of their authorization letter and a control summary you can attach as artifacts to your inherited controls. If they will not release evidence, attach a memo stating the provider system name, ATO date, and the eMASS system ID where the evidence lives. A pointer beats a blank artifacts column every time.

Common inheritance failures

• Inheriting a control your system partially violates. Inheriting SC-7 from the enclave while your system runs its own internet-facing interface outside the enclave boundary. The validator will find it, and now the whole inheritance looks careless.
• Inheriting and then forgetting. The provider’s ATO lapses, or they drop a control from their offering, and nobody tells you. Put the provider’s ATO expiration on your ConMon calendar. The continuous monitoring checklist has a line for it.
• Marking hybrid controls as fully inherited. The single most common inheritance finding. If your system has any configuration, process, or people involved in the control, it is hybrid.
• Inheriting from a system with a worse categorization than yours. A Moderate provider cannot fully satisfy a High system’s control enhancements. Check impact levels before you request.

How much work does inheritance actually save?

On a typical Moderate-Moderate-Moderate system hosted in a DoD data center, PE, PS, and boundary-related controls plus a slice of the organizational-level controls (the -1 policy controls) come to somewhere between 60 and 100 inheritable items depending on the provider. That is a third of the baseline you do not have to build evidence for. It is also a third of the baseline you have to document correctly and monitor for expiration, so “save” is the right word and “eliminate” is not.

The RMF Checklist has inheritance tasks placed in the Select and Implement steps where they belong, so you request it before you start writing statements you did not need to write.