old.reddit.com /r/FedRAMP/.rss
FedRAMP
Active Web Watch
Back to top.
Recently Seen Items
Compact view
Reading view
Looking at fedramp in a startup and can't find any startups w/ less than 100s of millions in revenue. We're costing it out currently & does seem to cost between 500k-1.25
Anyone have experience as a small company that's gone through fedramp process? 10mil arr — ish. Is it just completely impractical at this scale to do & maintain without a couple ftes completely focused on it.
Thanks in advance
[link] [comments]
Hi all, hopefully someone can help me learn a little bit more about some of these compliance standards and what we might actually need.
For some background. My company sells a cloud hosted software solution that we host in Azure. We have a commercial Azure tenant where the majority of our customers applications are hosted. The commercial cloud platform is SOC2 certified.
We were able to get access to a GCC High Azure Gov Cloud Tenant since we had several customers refusing to go hosted unless we were in Gov Cloud. We have met that requirement but are now continually being asked about Fedramp Compliance and or/ CMMC.
Truthfully I am not sure which one we would need, if we can even afford the compliance certification process, or if I could feasibly even get this set up. We are a small company, and I am basically it when it comes to IT. I have all of my normal duties on top of getting controls put in place for one of these compliance standards.
We are not a gov entity. We just sell an application that is appealing for several of our customers who do contract out w/ the gov or have a product that ends up in the defense pipeline.
[link] [comments]
Hello all, I'm kind of oblivious at this so hear me out. I'm already cleared to access all GOTS through my current company and an employee doing gov dev work, but wish to setup an auxiliary build environment through my (myself) as a service for things which aren't allowed on the network due to legacy/IA/architecture.
Wouldn't this be considered as an external service if the primary just signed off on it for ATO, or do I need to be a full CSP in this case?
Build environment would be empheral, nothing lives long, etc, just unclear on how far I'd actually have to go. Current employer is small, but a sub to one of the very large contractors, would the prime have to sign off, etc.
Thank you for any advice.
[link] [comments]
I have been trying to gain an understanding on what specific artifact/evidence that should be requested per specific selected controls. To include tailored questions that can be used as a guide to gather information for writing implementation statements.
Background: Currently going through my first full start to finish RMF process for ATO. I am assisting ISSO’s, ISSM’s, and other stakeholders with writing the control implementation statements while also gathering artifacts/evidence. The system has 15 components and 188 controls we are working on writing implementation statements per each component. With that comes with meeting with the appropriate POC per components and interview them to gain knowledge on the processes and how these components are being used in the main system.
Does somebody have some sort of guide for internal auditing? Maybe an artifact request list?
[link] [comments]
In the December, 2023 clarifying memo from the DoD CIO, David McKeown, they are basically providing guidance that all contractors and sub-contractors for the DoD can only use a minimum of FedRAMP Moderate authorized cloud services for storing/processing any CUI data. See https://dodcio.defense.gov/Portals/0/Documents/Library/FEDRAMP-EquivalencyCloudServiceProviders.pdf
If you are a cloud service provider, have you seen any increase in demand for FedRAMP Moderate authorization? Have you started to get questions about FedRAMP authorization from your customers in the DIB?
[link] [comments]
Looking for clarification on the certification process. Trying to determine if we need an ATO or our CSP (AWS) has that and we just need to meet their requirements.
My company is using AWS gov cloud environment to store data in a more secure area for portions of our cloud workloads. We will be building our own infrastructure and doing data modeling and such. This is due to corporate policy requirement of the data to be used, not bc we are a government entity. The AWS gov cloud is FedRamp certified obviously.
Does my company need a 3PAO to get assessed? Do we need to put together the Security Report and have SAR document? Or should AWS be giving me a list of requirements that we have to meet in order to operate in their environment?
Looking at those with an ATO, I’m not seeing general corporations like mine. I’m only seeing the huge providers like AWS, google and service now.
[link] [comments]
In past company, we had automated our User Access Reviews using Azure Identity Governance (aka Entra ID). However, current company uses Okta and AWS IAM Identity Center. I am curious how people are handling their own user access reviews, the process they follow and whether they have found good ways to automate.
[link] [comments]
Hello, I know this has been asked before but I could only find relatable posts from years ago. I am trying to look for a good software to help me automate POAMs. Do you guys have any suggestions? what do you like or dislike about it?
[link] [comments]
We have a client who wants to connect to snowflake in tenant environment. When I asked chatgpt- it provided an interesting answer- which I want opinions on:
Factors Influencing Boundary Determination
a. Ownership and Control
**Inside the Boundary:** If the organization that owns the analytics system also controls and manages the external data source, or if the data source is part of the same FedRAMP authorization, it might be considered inside the boundary. This means the organization has direct control over security, configuration, and maintenance.
**Outside the Boundary:** If the data source is managed by a different organization or is a third-party service, it is typically outside the boundary. The analytics system would rely on an interconnection agreement or a defined API/data exchange mechanism for accessing this external data source.
b. Data Flow and Integration
**Inside the Boundary:** If the external data source is fully integrated with the analytics system, and the data from the source becomes an inherent part of the analytics system’s processing, storage, or analysis, it might be considered inside the boundary. This typically applies when the data source feeds data in real-time or continuously into the analytics environment.
**Outside the Boundary:** If the external data source is accessed intermittently or used in a way where data flows in and out without permanent storage, the external source usually remains outside the boundary. In this case, the analytics system pulls data, performs analysis, and then discards it or returns results.
c. Security and Authorization
**Inside the Boundary:** If the security controls, access management, and data protection measures of the external data source fall under the same security framework as the analytics system (e.g., covered under the same FedRAMP authorization), it may be considered inside the boundary.
**Outside the Boundary:** If the external data source operates under a different security policy or is not covered by the analytics system's FedRAMP authorization, it is outside the boundary. Any connection between the systems would then need to be authorized through a formal interconnection agreement.
Scenario 2: External Data Source (Outside the Boundary)
The same FedRAMP-authorized analytics platform needs to connect to a third-party weather data provider via API to include weather patterns in its analysis.
The weather data provider is managed by an external organization, and the analytics system does not control how the provider secures or maintains its data.
In this case, the weather data provider is **outside the boundary**, as it operates independently, and the analytics platform only ingests data through defined API calls.
Referencing:
1. FedRAMP Documentation and Guidance
- FedRAMP Authorization Boundary Guidance: FedRAMP provides explicit guidance on defining system boundaries within its "FedRAMP Authorization Boundary Guidance" document. This document emphasizes the need to clearly delineate which components, services, and data flows are inside or outside the system boundary, including how interconnected systems should be handled.
- FedRAMP System Security Plan (SSP) Template: The FedRAMP SSP template requires CSPs to identify the system boundary and describe any external information systems with which it communicates. This template helps distinguish between what is managed within the system and what is considered an external or interconnected system.
Reference:
- FedRAMP Authorization Boundary Guidance
2. NIST Special Publication 800-53 Rev. 5 (Security and Privacy Controls)
- CA-3: System Interconnections: NIST SP 800-53, a fundamental security control framework used by FedRAMP, includes Control CA-3, which focuses on system interconnections. It requires organizations to authorize, document, and monitor information exchanges between systems, emphasizing the distinction between an organization's system and external systems. This control highlights that interconnected systems outside the organization’s direct control should be treated as external systems and require an Interconnection Security Agreement (ISA) or other formal documentation.
- CA-9: Internal System Connections: This control provides guidance on how internal connections are managed, reinforcing the idea that if a system or service is fully managed within the boundary, it remains internal, but if it’s managed externally, it falls outside.
Reference:
3. NIST Special Publication 800-37 Rev. 2 (Risk Management Framework)
- System Boundary Definition: NIST SP 800-37 provides guidance on implementing the Risk Management Framework (RMF) and defines how to establish system boundaries. It stresses the importance of defining the scope of the system by considering all components, data flows, and interconnections. It distinguishes between internal and external systems, requiring organizations to identify systems within their operational control versus those managed by other entities.
Reference:
4. NIST Special Publication 800-47 (Security Guide for Interconnecting Information Technology Systems)
- This publication provides detailed guidance on establishing and managing interconnections between different information systems. It emphasizes that systems managed by different entities, even when interconnected, are considered separate systems and require formal agreements (ISA/MOU) to govern the relationship.
Reference:
Summary of How These References Back Up the Conclusion:
- FedRAMP's Authorization Boundary Guidance establishes how systems must clearly define their boundary, including external versus internal systems.
- NIST SP 800-53 (CA-3) requires documenting and controlling connections with external systems, reinforcing that interconnected systems managed by different organizations are outside the boundary.
- NIST SP 800-37 emphasizes defining the system boundary and distinguishing between components under organizational control versus external systems.
- NIST SP 800-47 further clarifies the need for agreements to manage interconnections between systems controlled by different organizations.
[link] [comments]
I work in IT and see tons of job postings with FEDRamp/FEDRamp High Access requirements in the job descriptions and can't find a solid answer on what that means
Is it like a type of clearance? Sorry if this isn't the right place to ask, I couldn't find anything online about what this exactly means
[link] [comments]
Is there an expectation that a CSP's full stack only use FedRAMP-ed products or can some of the external services be non-FedRAMPed?
[link] [comments]
Hi,
We provide searchable maps with our SaaS and are currently providing services to the government. We have been doing so since prior to FedRAMP and they are requesting we become FedRAMP certified.
Relatively speaking we are a pretty small operation, 7 employees with lots of contractors.
Our product is pretty narrow in scope and we can operate it without collecting PII. We are SOC2 Type 2) and HIPAA compliant.
I am looking to understand the cost impact of the various baselines:
https://www.fedramp.gov/baselines/
I believe we would qualify for "FedRAMP Tailored Li-SaaS" and am wondering if there's a 3PAO that specializes in the low impact/Li-SaaS market and is priced accordingly.
Our current revenue from government clients doesn't eclipse some of the numbers I'm seeing for total costs and so this would be an investment in future opportunity and so I'm looking to minimize risk.
Just exploring this universe at the moment and so any feedback/advise is welcomed.
Thanks!
[link] [comments]
Is there any guide for FedRAMP from a software developer's perspective? I have been assigned to a new team for a client that works with government agencies. I have been assigned a task to do research about what FedRamp compliance means for our development.
I am a junior developer and I have spent the whole day searching for something that can help me getting started. I'm overwhelmed with all the jargons and have no idea what to do. (team lead isn't helpful either)
[link] [comments]
Hey all, I'm going to be starting a FedRAMP related job next week and I'm super curious about the mild activity in this sub. I recently attended a fancy industry group event and was surprised to find so many of the people there were business/sales types rather than hands on keyboard.
Where are technical folks talking about FedRAMP stuff, asking about interpretations for specific controls or encryption algorithm performance or the best FedRAMPed CICD SAAS or whatever? Is it all just buried on linkedin?
What kind of folks are hanging out here and what would you like to see happening here?
[link] [comments]
These guys are making some wild claims about getting people to FedRAMP at 10% the typical cost. Anyone have any experience working with them?
[link] [comments]
Hi, I’m researching a market and found a bunch companies that claim to be fedramp certified and seem have been awarded contracts with us government entities (va hospitals), but none of them are listed on the fedramp marketplace. How can that be? How do they sell to government?
[link] [comments]
I was curious how different organizations are approaching vulnerability management, specifically container vulnerabilities. When my organization was going into its initial audit 2 years ago we had a massive effort to transition all of our container images off of Ubuntu based containers. This was due to our vulnerability scanning tool detecting many CVEs that were high or critical but marked low by Ubuntu and stated they would not be fixed. Our assessor explained we had to have 0 criticals and highs and could only carry 30 total vulnerabilities. This made even risk reducing these vulns not an option.
Since then we’ve dedicated quite a bit of engineering effort maintaining in house compilations and docker builds of many open source and public offerings. Examples include having to completely rebuild confluent Kafka’s public image, and the public Apache airflow image.
When updating our container hardening for Rev5 we spoke with a 3PAO who said using a hardened base image is the best way to meet container image hardening and the best way to do that is to use iron bank. When looking at the iron bank offerings I noticed the RedHat UBI has >380 detected vulnerabilities but is still considered compliant. This goes directly against the guidance we were given on allotment of vulnerabilities. Was curious how other organizations are managing issues like this.
[link] [comments]
I lead recruiting for a top AI company and we are looking to hire 1-2 Senior SWE’s with extensive experience supporting FedRAMP
[link] [comments]
Anyone have some plain language guidance for engineers who aren’t FedRAMP savvy? There is a lot of ambiguity when you try to apply their scr guidance on more granular things. Would additional on prem software - say a text editor on a vm inside the boundary constitute a sig change and if not when does it cross the line to sig?
[link] [comments]
The new OMB memo introduces major updates:
- Mandate on OSCAL: FedRAMP now requires using NIST’s OSCAL for machine-readable data. Agencies must be able to produce, accept, and submit materials in this format.
- Artifact Submission: All authorization and continuous monitoring artifacts must be submitted as machine-readable data via APIs.
Surprise for Federal Agencies: OMB’s Presumption of Adequacy mandates acceptance of FedRAMP authorizations and requires OSCAL use in compliance programs. Agencies must provide authorization materials to FedRAMP PMO in OSCAL and ensure their GRC tools can handle OSCAL data.
CSP and Federal Agencies will now need to migrate to OSCAL -Native Tools.
Here is what CSPs and Federal Agencies should look for in GRC Tools
- OSCAL Compatibility: Ensure the tool can produce, transmit, and ingest OSCAL files, including SSP, SAP, SAR, and POA&Ms.
- Automation Capabilities: Look for tools that automate workflows, data sets, custom rules, and email notifications.
- Integration: The tool should integrate seamlessly with FedRAMP’s repository and other agency GRC systems.
- Flexibility: Choose tools that can adapt to frequent updates in OSCAL frameworks and profiles.
- Usability: Ensure the tool can generate both machine-readable and printable documents for manual reviews
[link] [comments]
Our first pilot effort will be on a new non-blocking process for reviewing significant changes, with an initial focus on new feature additions to existing cloud service offerings (CSOs). As we discussed in our roadmap release, the goal is to eventually replace the current “significant change request” process with an approach that does not require advance approval for each change. We’re piloting this approach because we believe the same security outcomes can be achieved by an alternative approach that empowers cloud providers to continuously deliver and assess improvements using secure and agile delivery and deployment practices.
Making significant changes in PROD without testing is a disaster in the making. I wonder how secure was the Crowdstrike change?
[link] [comments]
Hi friends,
I'm a founder of a fresh organization that provides some really innovative SaaS for government operations.
In this case, we are trying to nail a State RFP that requires the solution is FedRAMP certified. On the timeline they would like, this will be extremely difficult, and I want to present the best possible case in our RFP: to my understanding, that would be FedRAMP Ready.
The solution will (99.9% likely) handle and manage PII, so the end-state is probably FedRAMP Moderate or FedRAMP High depending on the procuring agency's desires. I am already pursuing StateRAMP which helps add a note of credibility at a much lower cost. To compete with other vendors on this RFP, I want to get as close to full FedRAMP as possible, but the RFP timeline is going to make that all but impossible. So, again, FedRAMP Ready is probably as close as we can get.
For clarity, it will be made of FedRAMP parts: AWS GovCloud using only FedRAMP M & H services which have already been JAB P-ATO designated. Container images that are built to be FedRAMP. I think this goes a long way to reduce the costs and complexity, but it doesn't really do much for our own Cloud Service Offering, which makes sense from a security standpoint: just because you use those tools doesn't mean your solution doesn't violate some important security controls in your application. If our application uses a logging tool that compromises a security boundary, now the whole environment is not FedRAMP compliant, because arbitrary data could leak.
So, I'm left with FedRAMP Ready as the best option. It's expensive, but maybe it's the only way to satisfy requirements on the RFP.
Am I thinking about this in the right way? Does anyone have experience with this (State-level procurement requiring FedRAMP)? Any vendor or 3PAO suggestions or smart ways to pursue FedRAMP Ready on an accelerated timeline? Cost estimations (I've seen a few but they vary pretty wildly)?
Any knowledge or experience you can impart would be extremely helpful.
[link] [comments]
How are you all handling OS upgrades and Significant Changes? Reading through the NIST 800-37 it states that OS upgrades are likely a trigger for a SCR. However, it then states that the org Security Impact Assessment should determine this change to be significant or not. If we are following STIG/SRG configuration requirements, I don't see how upgrading AL2 to AL2023, as an example, would require an SCR. Under RMF and previous DoD C&A framework we re-evaluated every OS upgrade, but that was because OS upgrades rarely happened.
I am planning on bringing this up with our 3PAO, but curious what others are doing around this.
[link] [comments]