Quick Overview

FedRAMP is a U.S. Government program to standardize how the Federal Information Security Management Act (FISMA) applies to cloud computing services. Cloud computing offers many advantages over traditional computing. Through cloud computing, Federal Agencies are able to consolidate and provision new services faster, at the same time reducing information technology costs. Cloud computing also enables efficiencies for services to citizens and offers stronger cyber security safeguards than what is possible using traditional information technology (IT) methods.

FedRAMP provides a standardized approach to security assessment, authorization, and continuous monitoring of cloud based services. Using a “do once, use many times” framework, FedRAMP reduces the cost of FISMA compliance and enables Government entities to secure Government data and detect cyber security vulnerabilities at unprecedented speeds.

FedRAMP has dual primary goals to improve the government’s transition to cloud-based services:

Develop a standard, risk-based security framework to improve the conformity, security, and clarity of cloud security authorization documentation, mitigating agency data risk exposure
Encourage the sharing of documentation, information, and testing across the government to improve efficiency and reduce assessment and authorization costs.

Independent assessors (i.e., 3PAOs) play a critical role in the FedRAMP security assessment process. An independent assessor verifies CSP security implementations and provides the risk posture of a cloud environment for a security authorization decision. These assessment organizations must demonstrate independence and the technical competence required to test security implementations and collect representative evidence. Independent assessors:

Plan and perform security assessments of CSP systems
Review security package artifacts in accordance with FedRAMP requirements
The Security Assessment Report (SAR) created by the assessor is a key deliverable for agencies to use FedRAMP security assessment packages.

FedRAMP was a collaboration between the National Institute of Standards and Technology (NIST), General Services Administration (GSA), Department of Defense (DOD), and Department of Homeland Security (DHS).

FedRAMP – The Process

FedRAMP utilizes a “do once, use many times” approach designed to reduce the cost of compliance versus requesting assessments each time an agency initiates a CSP acquisition.

FedRAMP is compliant with the Federal Information Security Management Act (FISMA) of 2002 and leverages the National Institution of Standards and Technology (NIST) baseline controls and framework for risk management. FedRAMP risk management encompasses four processes in the security assessment framework (SAF):

1. Document

• Categorize the system – The CSP determines its risk impact (Low, Moderate, or High) based upon the FIPS 199 template. Note: Currently, FedRAMP does not apply to high-risk impact systems. However, guidance is available for high-risk impact systems.
• Select and implement security controls – The CSP will select NIST baseline security controls based on its system categorization. For any control not achieved, the CSP must justify its position for not implementing the control.
• Create a System Security Plan (SSP) – The CSP documents the details of the above steps in an SSP for review. The SSP describes the security authorization boundary, how the implementation addresses each required control, roles and responsibilities, and expected behavior of individuals with system access. Every security package must include an SSP for review.
• Supplemental documents for submission: Supplemental documents include Security Policies, Privacy Analysis, e-Authentication Worksheet, User Guide, Rules of Behavior, IT Contingency Plan, Configuration Management Plan, Control Information Summary (CIS), Incident Response Plan, and Privacy Impact Assessment (if applicable).

2. Assess

• Security assessment plan (SAP) – CSPs must use an independent assessor to test the controls as documented in the SSP. This assessment starts with documenting the SAP developed by an independent assessor. Authorizing officials must approve the SAP.
• Perform security testing – The independent assessor performs testing in accordance with the SAP. Testing includes completion of FedRAMP control test cases, penetration testing, configuration scans, and authenticated vulnerability scans of the CSP system.

3. Authorize

• Security assessment report (SAR) – The independent assessor prepares a report using FedRAMP templates. The SAR contains information about vulnerabilities, threats, and risks discovered during the testing process. The SAR also contains guidance for CSPs in mitigating the security weaknesses found. Authorizing officials review the SAR.
• Plan of action and milestones (POA&M) – The CSP must address vulnerabilities noted in the SAR and demonstrate a plan for correcting weaknesses. The POA&M serves as a tracking system for the CSP.
• Authorization – The CSP submits all documents noted above, including the SAR and POA&M. Authorizing officials review the entire package and make a risk-based decision on authorization.
• Authorization letter – The formalized decision is documented through an authority to operate (ATO) letter from authorizing officials to the CSP and the FedRAMP project management office. The CSP is then added to the authorizing list of CSPs at www.fedramp.gov.

4. Monitor

• Operational visibility – This includes periodic submission of control artifacts and an annual re-assessment. The re-assessment is completed by an independent assessor.
• Change control – The CSP must notify authorizing officials of changes that might impact the ability to meet FedRAMP requirements.
• Incident response – As documented in the SSP, the CSP must have incident response plans in place for all compliant FedRAMP systems. Severe incidents may initiate a review of the CSPs authorization. Failure to report incidents may also trigger a review.

How can we help?

Don’t go it alone through the FedRAMP process. It is important to communicate early and often with your 3PAO and a firm who can prepare your organization the nuances of FedRAMP. Begin with a pre-assessment.
As Fortidm is undergoing DOD facility secret clearance we are better equipped to handle the nuances of the Fedramp audit and get your cloud compliance with FedRamp.

Please visit the official site for FedRAMP at https://www.fedramp.gov