Cuneus, operated by The Jalani Harbor Group, converts your existing evidence — prior SSP material, control workbooks, scanner exports, inventories, policies — into a structured set of reviewer-traceable draft deliverables. Package-readiness acceleration, not an authorization outcome.
Cuneus is the ATO/RMF Documentation Surge offering from The Jalani Harbor Group. It helps federal primes, subcontractors, and agency-adjacent delivery teams convert client-provided evidence into structured, reviewer-traceable draft authorization package materials.
The engagement is intentionally bounded: a fixed set of nine core deliverables, produced in a controlled 10-business-day sprint that starts only after a preflight readiness gate confirms your evidence set is sprint-ready. The client retains ownership of the authorization decision, the risk decision, the remediation plan, the final submission, and the formal POA&M.
Every Cuneus Track A sprint produces a defined set of draft, supporting, and traceable materials. No open-ended consulting. No additional deliverables without a change order.
Draft narratives for the System Security Plan, generated from the Structured Evidence Record and client-provided assertions. Every narrative traces to evidence or explicitly states the evidence gap.
Maps each control or objective to evidence references, narrative text, mapping rationale, evidence state, and client action required. The primary reviewer-facing artifact.
Lists missing, stale, weak, contradictory, unsupported, reference-only, or client-validation-required evidence conditions. Separate from the POA&M Candidate Register.
Candidate list of findings, existing POA&M items, reviewer findings, known risks, and client-confirmed weaknesses. Requires client validation before formal POA&M use.
Records open assumptions, client assertions, inheritance claims, not-applicable justifications, contradictory facts, reviewer questions, and items awaiting client confirmation.
Records artifacts that are unsupported, malformed, unsafe, unparseable, incomplete, inaccessible, restricted, or otherwise unusable. First defense against disputes about what was received.
Internal source of truth: normalized records produced by parser-supported extraction, with provenance, evidence state, evidence strength, and mapping rationale.
Hashes of every artifact received and every deliverable produced. The cryptographic basis for the intake freeze and the delivery manifest.
Summarizes input counts, parser outcomes, deficiencies, outputs, caveats, and versions. The cover sheet for the final delivery package.
The sprint clock does not start until preflight passes. That is the rule that keeps the 10-day promise honest.
Commercial outreach, a short demo using a golden sample, and a qualification form confirming what evidence exists. No evidence upload at this stage — we collect an artifact inventory only to determine whether a documentation surge is viable.
The Technical Lead collects structured information about your evidence, baseline, boundary, data handling, and reviewer availability. Produces the SOW scope, exclusions, expected artifacts, and preflight terms. No sprint clock yet.
You submit evidence through the approved path. The TL classifies, hashes, and ledger every artifact. The preflight produces one of four outcomes: ready for sprint, needs normalization, needs missing artifacts, or out of scope / defer. Only the first leads to intake lock.
Intake lock declared. Day 1 kickoff. Days 2–7: evidence freeze, parse & normalize, control mapping, gap/POA&M separation, draft SSP generation, and internal QA. Day 8: client validation packet. Day 9: final corrections & assembly. Day 10: final delivery and walkthrough. The clock runs from intake lock, not contract signature.
The operating boundary protects both Cuneus and the client. Understanding what Track A covers — and what it does not — prevents scope creep and ensures a clean delivery.
The exclusion set is not a list of services we refuse — it is a list of services that require a different scope, a different contract, and often a different team. If your need falls outside Track A, we will recommend the appropriate path.
If you have existing package material, a known system boundary, and a near-term authorization event, a Cuneus documentation surge may be viable. Reach out for a qualification conversation — no pressure, no evidence upload required at this stage.