In this edition of OnPoint xChange, we unpack how Agentic AI is transforming public services, not by replacing humans, but by augmenting teams with digital agents that understand mission context, policy boundaries, and how to take smart action.

I had the opportunity to interact with 
 

John Kimberl, a Technical Healthcare Solutions Consultant supporting ASSYST’s Hephaestus FHIR platform, with a focus on health data interoperability and secure cloud solutions

Bhargav Joshi, an AI/ML Engineer leading autonomous systems engineering in ASSYST’s Green Accelerator framework

Erin Slezak, a Proposal Solution Writer, is passionate about user-centered design and accessible public services.

Together, we discussed what Agentic AI Protocols are, how Model Context Protocol (MCP) enables trustworthy agent behavior, and why metadata awareness is essential for services, interoperability, and scalable enterprise adoption.

Read More on LinkedIn

Across State and Local governments, there’s growing interest in how Artificial Intelligence (AI) might help agencies serve their communities more effectively. While budgets are tight and priorities are many, one thing is clear: people expect services to be simpler, faster, and easier to navigate—especially online.

Recently, a new type of AI capability has caught my attention—and that of many agencies I collaborate with. It’s called Agentic AI.

Agentic AI refers to intelligent software agents that not only answer questions but also take action, following rules, completing tasks, and collaborating with users and systems. The concept may sound technical, but the benefits are practical and impactful, whether that’s a resident renewing a permit or a staff member managing paperwork behind the scenes.

People Are Changing How They Access Information

Residents are no longer satisfied with clicking through multiple web pages, hoping to find the right form or process. Increasingly, they want to ask a question and receive an answer, just like they do with search engines or voice assistants.

And there’s a real opportunity here. 

Instead of asking:

“Where’s the form for starting a home business?”

 Imagine asking:

 “How do I register a home bakery, and what permits do I need?”

 “How do I apply for housing assistance?”

 “What steps do I need to take to renew my driver’s license?”

And then receiving a clear, step-by-step response tailored to your location, eligibility, and agency rules.

That’s the potential of Agentic AI at the front door of government.

What Middle Offices Should Be Thinking About

Behind that front door is where most of the real work happens—document reviews, eligibility checks, multi-step workflows, and communication across systems and departments.

Agentic AI can support middle offices by:

• Coordinating task flow across teams or departments
• Interpreting policies into actionable decision logic
• Helping staff manage caseloads, reminders, and documentation
• Spotting delays or exceptions in service pipelines

In this role, AI isn’t replacing anyone—it’s enhancing the way staff work, improving visibility, and reducing dropped handoffs.

How the Back Office Will Evolve

In the back office, where compliance is tracked, records are maintained, and reports are generated, Agentic AI can make a meaningful impact.

Key benefits include:

• Pre-filling reports and logs based on real-time system activity
• Helping HR, finance, or legal teams stay ahead of documentation needs
• Connecting data across systems to give leadership a clear, actionable view

This evolution isn’t immediate, but it’s underway. Agencies that begin exploring now will be better positioned to adapt gradually, securely, and responsibly.

A Practical Way to Get Started: The Green Accelerator

We’ve found that starting small—with a single service or workflow—is the best way to explore Agentic AI’s real-world value. That’s why we created the Green Accelerator.

It’s where agencies can:

• Define a specific challenge
• Design and test an AI agent in a safe, controlled environment
• Measure outcomes, make adjustments, and decide when to scale

I’m excited to collaborate with award-winning solution teams, including those recognized at the GSA Federal AI Hackathon, where practical, mission-driven innovation took center stage. That same spirit of responsible experimentation and measurable progress guides everything we do through the Accelerator.

Connecting Agentic AI to Agency Goals

While the efficiency gains of AI are important, it’s equally critical to connect them to your agency’s mission and measurable outcomes. For example, Agentic AI can help:

• Reduce service backlogs
• Advance digital equity goals
• Improve staff productivity and service delivery

These outcomes are crucial for developing a compelling case to executives, budget owners, and policy teams.

Ready to See It in Action?

Want to see Agentic AI in action? 

Visit assyst.net/agenticai or connect with our team to explore how your agency can get started.

Background

The US Defense Microelectronics Activity (DMEA) acts as the DoD center for all matters related to microelectronics, encompassing technology development, acquisition strategies, transformative initiatives, and ongoing support. The core mission of DMEA is to spearhead microelectronics design and research efforts across the DoD. This leadership role is crucial for continuously enhancing the technological capabilities of the US military, ensuring a competitive edge, and effectively modernizing existing legacy weapons systems to meet contemporary defense requirements. By focusing on innovation and strategic implementation in microelectronics, DMEA plays a crucial role in safeguarding national security and enhancing the technological capabilities of the armed forces.

Challenge

Serving as an integral element within the complex framework of U.S. military operations and diverse governmental agencies, DMEA confronted the necessity of establishing a robust and current Continuity of Operations Plan (COOP). This plan transcended mere bureaucratic formality, representing a strategic imperative to ensure the uninterrupted execution of critical Mission-Essential Functions (MEFs), even in the face of unforeseen disruptions. The formulation of such a comprehensive COOP presented a multifaceted challenge, necessitating proactive adaptation to the perpetually evolving landscape of IT risk management, as well as meticulous foresight and synchronized collaboration among various stakeholders.

Beyond its initial development, DMEA recognized the sustained commitment required to maintain effective continuity. The new COOP would require continuous support, including ongoing maintenance and periodic revisions to the pre-existing COOP. The dynamic nature of threats and technological advancements necessitated a continually adaptable document, subject to ongoing refinement to maintain its relevance and efficacy.

A foundational principle of this initiative was the steadfast adherence to a stringent array of federal and departmental directives. The COOP was meticulously crafted to achieve full compliance with Presidential Policy Directive 40 (PPD-40), a seminal directive that delineates national essential functions and continuity prerequisites. Furthermore, it rigorously conformed to Federal Continuity Directives (FCD) 1 & 2, which furnish detailed guidance on executive branch continuity programs. At the departmental level, DMEA ensured compliance with Department of Defense Directives (DoDD) 3020.26 and Department of Defense Instructions (DoDI) 3020.42, both of which delineate specific mandates for continuity programs within the DoD. This tiered approach to compliance underscored DMEA's commitment to operational resilience and its pivotal role in safeguarding national security.

Solution

ASSYST’s approach to supporting DMEA’s COOP program was comprehensive and deeply rooted in our extensive expertise across vital sectors. Our team, comprising experienced professionals in cybersecurity, national security, and critical infrastructure protection, was strategically positioned to provide comprehensive COOP support and enhancement services. This extensive knowledge enabled us not only to design and implement a resilient COOP, but also to foresee and address potential vulnerabilities.

The core of our methodology involved the careful development and implementation of a process we meticulously engineered to ensure full compliance with a complex array of regulatory and policy frameworks. Specifically, we adhered to Presidential Policy Directive 40 (PPD-40), Federal Continuity Directives 1 and 2 (FCD-1 and FCD-2), Department of Defense Directive 3020.26 (DoDD 3020.26), and Department of Defense Instruction 3020.42 (DoDI 3020.42). Additionally, our work incorporated relevant regulatory standards, most notably those established by the National Institute of Standards and Technology (NIST), which form the foundation for robust cybersecurity and information resilience.

Importantly, our process was not a generic solution; it was adapted to meet DMEA’s specific operational requirements and strategic goals. This customization was achieved by integrating all DMEA MEFs directly into COOP design and deployment. By understanding and embedding DMEA's critical operations, we assured that the COOP plan would effectively support the agency's ability to maintain its essential functions even amidst disruptive scenarios. This comprehensive and compliant methodology underscored ASSYST’s dedication to delivering a truly resilient and effective COOP solution for DMEA.

Our technical approach to this initiative involved detailed tasks related to the Risk Management Framework (RMF). We provided Subject Matter Experts (SMEs) highly skilled in offering ISO and RMF support to assist and advise on completing and validating final RMF packages, developing all Authorization to Operate (ATO) documentation, and routing it for appropriate sign-offs. This support encompassed maintaining, tracking, and updating System Security Plans (SSPs), conducting risk management and analysis to ensure adherence to DoD directives, developing effort estimates and planning schedules for budget estimations, and identifying and documenting appropriate protection levels for data, including encryption. To ensure our support yields enduring benefits for DMEA, we consciously developed practical update schedules, a Multi-Year Strategic Plan, and a Program Management Plan to guide ongoing development and maintenance.

Value/Impact

Through this initiative, DMEA established a robust COOP capability, significantly enhancing the agency’s ability to assess, communicate, and restore mission-critical operations in the event of unexpected events. Additionally, streamlined processes and improved documentation enabled DMEA to anticipate potential disruptions more effectively and prepare for them, thereby improving overall program readiness and increasing operational efficiency. Our support also ensured compliance with federal directives, reducing audit risks and consistently fulfilling all mandated requirements. 

ASSYST’s National Security Practice

ASSYST is greatly invested in backing the success of our nation’s most critical security initiatives, having collaborated with numerous DoD agencies over the years. Our accomplished Homeland & National Security Practice team members bring with them extensive backgrounds in the DoD, the Army, and state and local law enforcement and public safety organizations. Our support capabilities for these organizations encompass energy and infrastructure resilience, strategic consulting and advisory services, cyber risk, compliance, regulatory and enforcement data analytics, law enforcement IT and data integration, and all-source intelligence and analytics. 

We offer the use of our Green Accelerator platform (AssystGA) in service of our customers’ missions. This platform accelerates development processes, utilizes innovative AI technologies, and provides our customers with access to a range of integrated tools developed by ASSYST. Among these tools, our ComplySyncATO solution is designed to support our customers' diverse digital security needs, offering services such as automated compliance assessment and verification, identity and access management, and continuous monitoring to ensure alignment with evolving regulatory requirements. 

ASSYST works tirelessly to ensure our support is always aligned with the most current security technology and is suited to meet and exceed our customers’ expectations. For further information on our national security support capabilities, please visit this link.

With over a decade of experience in cybersecurity program management, I've gained deep insights into effective and ineffective strategies. My oversight of cybersecurity programs for healthcare government agencies, such as CMS, provides me with opportunities to identify and implement innovative technologies and processes for problem-solving. 

A notable challenge, for example, arises when files are received in OSCAL for GRC but cannot be seamlessly transmitted to disparate systems. This gap presents ASSYST with an opportunity to develop a proof of concept for standardizing security artifacts in machine-readable formats, including XML, JSON, and YAML. Ultimately, embracing OSCAL is pivotal for transforming compliance from a hindrance into a strategic advantage.

OSCAL: A Schema for Cybersecurity Consistency and Automation

Developed by NIST, this introduces a structured, machine-readable format (JSON, XML, YAML) for expressing security and privacy control documentation. It applies across the entire Risk Management Framework (RMF), including:

• System Security Plans (SSPs)
• Security Assessment Plans (SAPs)
• Assessment Results (SARs)
• POA&Ms
• Control Catalogs and Implementation Profiles
• Component and Service Definitions

The technical value of OSCAL is clear: it enables automated systems to interpret, validate, and integrate compliance artifacts across heterogeneous environments, eliminating the need for manual formatting, subjective interpretation, and repetitive control rewriting.

Before and After OSCAL: What Changes Technically?

Data Standardization as Strategy 

OSCAL represents a fundamental shift in how cybersecurity compliance is approached—moving from static documentation to machine-readable, structured data.

At its core, OSCAL is not just a format; it is a framework for automation, validation, and scalability. By expressing security artifacts, such as System Security Plans (SSPs), Security Assessment Reports (SARs), and Plans of Action and Milestones (POA&Ms), in standardized formats, OSCAL enables consistent interpretation, seamless integration, and faster processing across tools, teams, and systems.

Operationalizing OSCAL means adopting a data-first mindset—where compliance is not a manual output but a continuously validated state. This shift enables agencies and organizations to enhance audit readiness, minimize human error, and expedite the authorization process.

Operationalizing OSCAL Across the RMF Lifecycle

To help federal agencies practically implement OSCAL, forward-leaning compliance programs are embracing full-lifecycle automation strategies that align with evolving cybersecurity mandates and digital transformation goals.

Key technical enablers include:

Schema-Validated OSCAL Artifact Conversion

Transforms legacy System Security Plans (SSPs), Security Assessment Plans (SAPs), and Security Assessment Reports (SARs) into OSCAL-compliant formats while preserving control mappings and implementation metadata. This ensures continuity and consistency across traditional and machine-readable documentation.

Cross-Framework Harmonization

Enables alignment across frameworks such as FedRAMP, NIST 800-53, CMMC, and agency-specific overlays using OSCAL control profiles, tailoring capabilities, and inheritance mappings. This simplifies multi-standard compliance while supporting reuse and reciprocity.

AI-Enabled Evidence Ingestion

Integrates real-time inputs from vulnerability scanners, ticketing systems, and system logs. Natural Language Processing (NLP) models automatically map evidence artifacts to corresponding control identifiers, reducing manual effort and increasing traceability.

Automated SAR and POA&M Generation

Uses test assertions and validation logic to assess control effectiveness and generate machine-readable SARs. Open risks and remediation plans are automatically tracked via dynamically generated Plans of Action and Milestones (POA&Ms), improving oversight and continuous monitoring.

Extensible APIs and Integration Hooks

Supports seamless integration with existing DevSecOps pipelines, security tools, GRC platforms, and incident response systems. This ensures compliance becomes a continuous, embedded process—not a disconnected, episodic activity.

SaaS Security Posture Management (SSPM) + OSCAL = Real-Time Assurance

With the proliferation of SaaS in federal environments, SaaS Security Posture Management (SSPM) has become a critical component of modern risk governance. SSPM tools monitor configuration drift, access policies, encryption settings, and compliance violations across applications like Microsoft 365, Salesforce, and ServiceNow.

But their output is often siloed and disconnected from RMF workflows. By integrating SSPM telemetry with OSCAL artifacts, we enable:

• Real-time mapping of SSPM alerts to RMF controls
• Evidence ingestion into SARs using validated control assertions
• Dynamic POA&M generation when SSPM detects a misconfiguration
• SaaS-specific OSCAL profiles that reduce redundancy in ATO packages

This fusion creates an architecture where SaaS posture data feeds directly into structured compliance reporting, reducing ATO maintenance time and improving control visibility.

The Future: AI-Augmented Compliance Pipelines

As OSCAL adoption grows, its potential goes beyond static reporting. It becomes the foundation for:

• Policy-as-code enforcement using OSCAL profiles as executable control rules
• Continuous ATO (cATO) through integrated SAR/SAP validation against live telemetry
• Predictive compliance drift detection using AI trained on OSCAL-linked artifacts
• LLM-assisted control authoring and assessment planning
   

ASSYST ComplySyncATO’s roadmap reflects this direction—leveraging AI to reduce workload, flag non-conformance, promote data standardization, and foster interoperability, all while keeping compliance synchronized. Comply.Sync.Now.

ASSYST has expanded its Homeland & National Security Practice with integrated capabilities designed to meet the complex and evolving needs of federal agencies responsible for national resilience, cybersecurity, border protection, and emergency response. This strategic growth supports key priorities for the US Department of Homeland Security (DHS) and its mission partners.

"As agencies prepare for an increasingly dynamic threat environment, there's a growing demand for secure, modular, and compliant technology that adapts to new mandates and integrates easily into mission systems. As a former law enforcement officer, I want to help agencies not just procure this technology, but fully utilize it to assist the boots on the ground," said Eugene Goldlust, Senior Account Executive at ASSYST.

Read More

We’ve spent decades supporting federal agencies as they work to improve the delivery of public services. We’ve learned that for military families, veterans, and the people who support them, technology should do one thing above all: make it easier to get the help they need.

That might mean finding the right information quickly, completing a process without frustration, or accessing support while balancing the many realities of military life. Behind every request is a person—often a spouse, a parent, or someone in transition—looking for stability and clarity.

We believe it’s time to make that experience better. Not by adding more systems or interfaces—but by making what already exists more connected, more dependable, and more thoughtful.

The Real Need

Military families move often. They navigate complex benefits, changing school systems, healthcare decisions, and job transitions. Veterans and caregivers face unique challenges. The programs that support them—from readiness and resilience to education and outreach—operate across various systems, policies, and timelines.

Technology can either help or hinder.

Our vision is to help agencies deliver digital tools and services that:

• Reduce duplication and confusion
• Respect the user’s time and circumstances
• Support staff with the right data and context
• Stay reliable during key life moments—deployment, relocation, transition

This isn't about innovation for its own sake. It’s about building systems that do their job, consistently and securely.

How We Support That Vision

ASSYST collaborates closely with federal agencies to modernize systems, enhance security, and improve service delivery. For programs focused on military communities, we focus on four priorities:

1. Design for Real Life

We take a human-centered approach—utilizing our knowledge of military family life to design experiences that are clear, inclusive, and accessible. That includes global integrated services design, mobile-first design, and interfaces that reduce cognitive burden rather than add to it.

2. Keep Data Protected, Always

We build and operate systems with a security-first mindset. From access controls to monitoring and compliance with federal frameworks, our goal is to help programs protect personal information while still allowing users to move forward with confidence.

3. Make Information Work Harder

As the First Place Winner of the GSA Federal AI Hackathon, we are continually seeking ways to make AI More Human-Friendly. We utilize AI and automation thoughtfully, focusing on helping people find answers, complete tasks, or receive guidance. Our Green Accelerator Platform supports workflows that surface useful insights and reduce manual processing, all while maintaining human oversight.

4. Support Program Agility

Policy and program requirements change. Our teams develop modular systems that can be updated without disruption, giving agencies flexibility without high rework or long lead times.

5. Bringing People and Programs Closer Together

We understand that successful service delivery doesn’t just support individuals—it strengthens the relationship between programs and the communities they serve.

We aim to close the gap between:

• Military families and the services built for them
• Program managers and the tools they rely on
• Providers and the systems they access
• CIOs and CISOs who must balance progress with protection

By enhancing the everyday experience of using and managing public systems, we enable agency teams to stay focused on their mission, rather than the technology.

We recognize that the responsibility of supporting military families extends beyond any single system. It requires listening, adjusting, and staying accountable.

ASSYST is ready to be a steady partner in that effort by building services that work, platforms that last, and relationships that reflect a shared commitment to the public good.

A Data-Driven, Design-Led, and Intelligence-Infused Approach for the Security Data Lake at HHS CMS

The Centers for Medicare & Medicaid Services (CMS) manages one of the largest digital infrastructures in the federal government—spanning hundreds of FISMA systems, cloud workloads, hybrid networks, and compliance environments. To safeguard this complex ecosystem, CMS partnered with ASSYST to implement a forward-thinking solution, a Security Data Lake (SDL). A Platform designed to unify Continuous Diagnostic and Mitigation (CDM) detailed cybersecurity telemetry from across the IT environment, enhancing threat intelligence and empowering real-time decision-making to improve the security posture of mission-critical applications. 

It was a transformation driven by data engineering, human-centered design (HCD), and the power of AI infused user experiences.

Challenge: Siloed Data, Slower Response

CMS’s security teams were overwhelmed by volumes of data generated by disparate sources—cloud configurations, vulnerability scans, firewall logs, compliance assessments, and more. Each team operated in silos, using their ingestion tools, dashboards, and data schemas. This fragmentation slowed collaboration, increased storage costs, and made cross-domain analysis nearly impossible.

During zero-day events like Log4J, what should have been a rapid response became a manual process of stitching together insights from different systems—costing critical time and adding risk to operations. CMS needed a unified, governed, and accessible data platform that could provide a view of CDM data to support multiple teams, roles, and missions—without compromising agility or security.

Solution: A Federated, AI-Ready Security Data Lake

ASSYST collaborated with CMS’s Information Security and Privacy Group (ISPG) to architect and operationalize a federated Security Data Lake platform built on Snowflake’s secure, FedRAMP-authorized Data Cloud. The platform centralized the ingestion of telemetry from AWS Config, Tenable, Snyk, Panther, Archer, and more, from both the cloud and the premise data center. Applying schema-on-read techniques to retain raw fidelity while enabling flexible, on-demand analytics.

We designed the SDL to support a multi-tenant access model featuring row-level security and role-based controls that enable different security units to collaborate securely from a shared source of truth. To support CMS’s modernization and automation goals, we integrated data services for metadata enrichment and cross-domain telemetry linking.

The AI-enabled platform is integrated with large language models (LLMs), predictive analytics, and multi-agent systems, which enhance context-driven decision-making, streamline investigations, and scale compliance readiness.

Human-Centered Design: Making Cyber Data Work for People

Recognizing that technology is only as valuable as it is usable, ASSYST adopted a Human-Centered Design (HCD) approach for data visualization of the CDM data. We developed detailed user personas to represent the diverse range of CMS stakeholders—from SOC analysts and vulnerability engineers to executive leadership and audit teams—each persona guided decisions regarding data access, dashboard views, chatbot behavior, and analytics priorities.

To unlock the full value of the SDL, we designed and deployed the Agentic AI App. This conversational, LLM-powered tool enables users to search and retrieve data catalog metadata using natural language queries. The Agentic AI app is capable of leveraging multiple UI patterns (linear, card-based, threaded) and selecting the threaded mode based on feedback from metadata users who require structured exploration paths and layered conversations. The UI integrates interactive components, such as buttons, forms, and menus, providing users with an intuitive, action-driven interface for discovering and utilizing cyber telemetry without requiring SQL knowledge to formulate queries.

Usability at Scale: Dashboards That Drive Action

Beyond search and metadata exploration, ASSYST focused on making data-driven decisions easier across CMS. Working closely with CMS stakeholders, we redesigned Tableau dashboards with HCD principles—streamlining visual layouts, reducing cognitive load, and improving data navigation across key views such as:

• Vulnerability Monitoring Dashboard
• Known Exploited Vulnerabilities (KEV)
• Vulnerability-Related Asset Details

We facilitated user discovery sessions, journey mapping, and dashboard testing to ensure these dashboards not only reflected real-time SDL data but also aligned with user goals, workflows, and remediation processes. Special attention was given to login and landing page usability, with validated UX enhancements enabling faster access to alerts, insights, and reports.

These improvements have directly contributed to higher dashboard adoption across CMS, increased stakeholder satisfaction, and faster time-to-action in response to evolving cyber threats.

Value Delivered: From Insights to Outcomes

The results have been transformative. CMS now operates from a single pane of glass for security telemetry, with unified data access across departments, improved team collaboration, and sharply reduced response times. During major cyber events, queries that previously took days now return results in minutes. Compliance and audit preparation have become more efficient through the use of live telemetry overlays and the contextual mapping of NIST controls via AI Tools.

The Security Data Lake—once envisioned as a data warehouse—is now a living, AI-ready platform where data, design, and intelligence converge to drive mission success.

What’s Next: Agentic AI, Continuous Compliance, and Beyond

With the SDL in place, ASSYST is helping CMS prepare for its next leap forward: integrating Agentic AI. Using the Model Context Protocol (MCP), CMS will enable autonomous agents to interact with live data, perform security checks, validate configurations, and generate evidence for audits in real-time.

Through ASSYST’s Green Accelerator Framework, ASSYST is advancing toward a future where security operations are not only data-driven but context-aware, automated, and intelligently designed around the people who rely on them.

Background 

In a rapidly advancing digital world, keeping your systems up to date with the latest technology has become essential for maintaining operational efficiency. If your digital infrastructure is currently behind the curve, keeping up with modern advancements will only become increasingly challenging. This was the challenge that three DoD customers faced before ASSYST partnered with a specialized Software-as-a-Service (SaaS) Solution Offering provider to offer them a modern solution to their organizational challenges.

Challenge

The National Guard units stationed at Fort Chaffee, Arkansas, and Fort McLellan, Alabama, as well as the Army Contracting Command – Rock Island (ACC-RI) at Pine Bluff Arsenal, Arkansas, were operating on an outdated and overly complex infrastructure that was needlessly relying on physical documentation. This significantly increased the time spent acquiring permits for outdoor recreational activities, such as hunting or fishing, and presented unnecessary challenges regarding the organization of these documents. These customers all requested the implementation of a web-based outdoor recreation management tool to minimize these issues and introduce a more modernized operation that utilizes current technologies.

Solution and Features

ASSYST partnered with RecAccess to support the implementation of their Cloud-based outdoor recreation management software, also called RecAccess, as a service to these three customers. The RecAccess SaaS is an online platform designed to support customers performing field work, such as the National Guard and ACC-RI. The platform is compliant with relevant standards, including FedRAMP and the Sikes Act, ensuring it operates in alignment with Federal initiatives that promote sustainability and wildlife conservation.

A central feature of the RecAccess SaaS is the issuance of permits and licenses for various recreational outdoor activities, enabling users to navigate to a single platform for all permit acquisition needs rather than requesting each permit separately. This is invaluable for streamlining and vastly accelerating the permit application process, as well as for enhancing organizational capabilities. While the primary function of RecAccess is issuing permits, multiple supporting services and features are available for implementation, such as a check-in/out system enabling users to report their attendance in designated recreation zones, an interactive mapping service, mobile phone and tablet compatibility, a variety of data management support services, and many others.

Value/Impact

ASSYST’s partnership with RecAccess and support in implementing the RecAccess SaaS has been transformative for the National Guard units in Fort Chaffee and Fort McLellan, as well as the ACC-RI at Pine Bluff Arsenal. The application modernization services we provided to these three DoD customers’ unit infrastructures showcase a simplified and robust method for permit management and storage. These highly successful implementations highlight the unique value of Cloud-based Software-as-a-Service offerings in providing support tailored to a customer’s specific needs and circumstances.

On today's Qik Bits, ASSYST's Vijay Narasimhan shares insights on shaping the journey from the days of Mainframes to the advent of Agentic AI

Watch on LinkedIn - https://www.linkedin.com/feed/update/urn:li:activity:7346175344942481408 

The reliable and timely exchange of electronic prescription information is foundational to modern healthcare delivery, yet national consistency in implementing the NCPDP SCRIPT standard has remained a challenge. Variations in vendor interpretation, limited validation resources, and evolving regulatory requirements have created barriers to the uniform adoption of these standards. Recognizing this, the Assistant Secretary for Technology Policy/Office of the National Coordinator for Health Information Technology (ASTP/ONC - https://www.healthit.gov) launched the eRx Conformance Initiative, a targeted effort to operationalize and sustain a centralized testing platform that enables developers, implementers, and certifiers to assess conformance against SCRIPT specifications with precision and confidence. As a critical enabler of interoperability and medication safety, this initiative aligns with ONC’s broader mission to advance trustworthy, standards-based health IT infrastructure at scale.

Fragmentation in Standards Implementation

Despite the widespread adoption of electronic prescribing, consistent adherence to the NCPDP SCRIPT standard across the health IT ecosystem has proven difficult. Vendors often interpret implementation guides differently, resulting in variations in how transactions are structured and exchanged. This lack of uniformity complicates testing and certification, introduces inefficiencies, and increases the risk of communication errors between prescribers, pharmacies, and payers. Additionally, updates to the standard, such as changes to data elements, workflows, or schema, require careful coordination across technical teams and certification bodies. Before the eRx Conformance Initiative, there was no single, authoritative platform for systematically validating SCRIPT-based transactions in a repeatable, policy-aligned way. This gap presented a risk not only to program integrity but also to ONC’s long-term goal of enabling interoperable, standards-driven care coordination.

Establishing a Standards-Aligned Testing Platform

To close the gap between standards development and real-world implementation, ONC initiated a multi-year contract to design, build, and operate a conformance testing system dedicated to electronic prescribing. The goal was to provide a reliable and scalable platform that enables health IT developers, certifiers, and federal stakeholders to assess and validate the structure and behavior of transactions against the NCPDP SCRIPT standard. The platform would serve as a central point of reference, supporting iterative updates to the standard, promoting national alignment, and ultimately accelerating vendor readiness for certification and production deployment. In selecting ASSYST to lead this effort, ONC prioritized proven capability in standards-based development, agile delivery, and secure system design, all essential for building a sustainable, production-grade solution that could evolve alongside regulatory and industry needs. CMS adopted the NCPDP SCRIPT standard for e-prescribing and electronic prior authorization (ePA). Under the CMS‑4205‑F2 rule (published July 17, 2024), Upgrades from SCRIPT version 2017071 to 2023011 are required by January 1, 2028. SCRIPT covers prescription orders, history, and ePA messaging.

Scalable, Agile-Driven Conformance System

ASSYST approached the eRx Conformance Initiative with a structured, agile delivery model tailored to federal health IT standards and policy oversight. At the core of the effort was the development and maintenance of a modular testing environment capable of validating electronic prescribing transactions by the NCPDP SCRIPT standard, version 2023. The system architecture supports iterative testing workflows across development, staging, and production environments, enabling controlled release cycles and rapid integration of feedback.

Over the course of the engagement, ASSYST developed and upgraded more than three dozen XML-based test scripts, covering a comprehensive range of eRx use cases, including new prescriptions, prior authorizations, renewals, cancellations, and clinical messaging. Each script was supported by a fully documented test case set, including test stories, data specifications, example messages, and expected results. These assets were mapped to acceptance criteria and tracked using integrated tools, such as JIRA and Confluence, providing transparency and traceability across all sprints.

The team also implemented continuous engagement with ONC’s technical leadership, reviewed and responded to user inquiries from the broader implementation community, and maintained rigorous compliance with federal IT quality standards by drawing practices from CMMI Level 3 and ISO 9001, 20000, and 27001 certifications.

Enabling Futureproof Standards-Based ePrescribing

The eRx Conformance Testing Platform has become a key asset in ONC’s broader strategy to drive interoperability and improve safety across the prescription drug ecosystem. By providing a centralized, standards-aligned environment for SCRIPT validation, the initiative enables health IT developers to test and refine their systems with greater speed, accuracy, and assurance long before they reach the certification or production stage.

This has led to measurable improvements in implementation consistency, reduced testing burden, and stronger alignment between policy goals and real-world technology behavior. The platform also provides federal stakeholders, including certification bodies and standards organizations, with a reliable tool to support compliance monitoring and future policy enforcement.

For the end user, whether a prescriber, pharmacy, or patient, the downstream impact is clearer communication, fewer transaction errors, and faster access to medication. By strengthening the technical foundation of e-prescribing, this initiative supports a safer and more coordinated healthcare experience for millions of Americans.