Quick Guide on FedRAMP Fundamentals

When is FedRAMP required: The federal government enacted the FedRAMP regulation in December 2011 to enable executive agencies and departments to use an assessment method based on risk and cost-effectiveness when adopting cloud technologies. A FedRAMP readiness assessment is mandatory for cloud products and solutions providers seeking to receive an Authorization to Operate (ATO). FedRAMP ATO indicates that a provider’s hosted information and systems meet FedRAMP requirements.

What is FedRAMP? When is FedRAMP Required?

FedRAMP is a shortened abbreviation meaning Federal Risk and Authorization Management Program. It is a standardization method designed for federal agencies to facilitate the assessment of  Cloud Service Provider’s (CSP’s) continuous monitoring, authorization, and security. FedRAMP features a risk management framework based on the Federal Information Security Management Act (FISMA) of 2002 and NIST 500-83 that allow stakeholders to assess and authorize cloud service offerings.

FedRAMP assessments aim to increase confidence in the security of cloud solutions through continuous monitoring and the use of reliable security practices and procedures. The official FedRAMP website states:

“FedRAMP facilitates the shift from insecure, tethered, tedious IT to secure, mobile, nimble, and quick IT.”

FedRAMP is also an essential requirement for federal agencies using cloud computing technologies. FedRAMP certification is mandatory since it indicates compliance with the required standards, and demonstrates the ability to protect valuable federal information and technological investments.

The FedRAMP Program Management Office (PMO) is responsible for maintaining standardized procedures for risk assessments and security to assist federal government organizations in adopting secure cloud offerings and services. The government created FedRAMP to support its cloud computing plan for choosing third-party cloud-based products and services among federal agencies.

FedRAMP Levels and Controls 

FedRAMP provides authorizations to CSPs at three primary levels:  low, moderate, and high.

1. Low Impact Risk: The FedRAMP authorization for low impact risk consists of data meant for public access and use. The authorization at this level does not compromise the reputation, finances, mission, or safety of the agency.
2. Moderate impact risk: Authorization for moderate impact risk includes information not meant for public use or access. Such data includes personally identifiable information. Any breach of such information can severely impact the operations of the affected agency.
3. High impact risk: High impact risk FedRAMP authorizations are for protecting highly confidential federal data, such as emergency services, healthcare information, and law enforcement. Cyber breaches to the government systems housing this type of data would result in catastrophic consequences, including threats to intellectual property, financial damages, and disrupted operations. 

What does FedRAMP Certification Mean?

FedRAMP certification is a government program used to provide a standardized strategy for performing security assessments, authorization, and enabling continuous monitoring of cloud services and products. The certification allows agencies to implement and use cloud technologies by emphasizing the protection and security of federal IT infrastructure and information.

How much does it cost?

To understand the FedRAMP certification costs, they are broken down into five parts:

1. Engineering: The average engineering costs are $1,100,000 and are associated with the implementation of technical changes to a cloud system to conform to the federal moderate impact level requirements. They include PIV/CAC authentication, FIPS 140-2 encryption, among others.
2. Documentation: The average cost for documentation is $400,000. This includes costs for documenting system security procedures and policies, incident response plans, SSP, and more.
3. 3PAO Assessment: The average cost for a FedRAMP certification assessment is $500,000. These expenses include the cost of an independent assessment performed by a FedRAMP accredited 3PAO. Additional charges will include testing, onsite assessment,  security assessment briefings, and reports to the authorizing officials. 
4. FedRAMP JAB Review: The FedRAMP JAB review  averages $250,000. These costs are associated with the updates needed to meet the JAB requirements for granting authorization to a CSP.
5. Continuous Monitoring: The average costs for continuous monitoring are $1,000,000, and they include the ongoing fees for POA&M management, annual assessments, and monthly vulnerability testing.

Benefits of FedRAMP

Instead of conducting multiple assessments for your cloud services, FedRAMP offers an integrative unified, and comprehensive audit for CSPs. Even though the FedRAMP assessment and certification process is tedious and intensive, it gives qualified CSPs a competitive advantage since they are eligible to work with federal agencies. Plus, investing in the certification creates confidence in the CSPs’ security capabilities among non-government customers.

Acquiring a FedRAMP certification also demonstrates an organization’s credibility. The certification roadmap consists of three rigorous procedures. To be certified, an agency must first perform a security assessment to ensure conformance to the specified standards and controls. Then, the FedRAMP program grants a security authorization, after which the agency implements an authorization and continuous assessment plan. A successful certification process proves a CSP has surpassed various cybersecurity tests successfully and is capable of maintaining the relevant security standards.

Furthermore, FedRAMP permits agencies to eliminate legacy systems and antiquated hardware. Some agencies use outdated infrastructure because of the lengthy and tedious procedures for getting IT approvals. Fortunately, an essential requirement for participating in the assessment procedure is the elimination of obsolete and redundant infrastructure. Agencies can channel the capital expenditure for the non-essential infrastructure to other critical sectors and cut costs significantly.

FedRAMP Covered Entities 

FedRAMP assessment and certification is a requirement for any Cloud Service Provider (CSP) seeking to become a third-party vendor for federal agencies. In certain instances, state government agencies may require third-party CSPs to acquire FedRAMP certifications. The state offices leverage FedRAMP’s rigorous cloud security program for cloud-based information systems. However, whether a CSP provides cloud services and offerings to federal governments or not, it might consider adopting FedRAMP security requirements and controls.

Who Performs FedRAMP Assessments? 

An accredited Third-Party Assessment Organization (3PAO) can perform FedRAMP assessments. A 3PAO is an organization that the PMO certifies to help CSPs and government agencies meet FedRAMP compliance regulations. During the FedRAMP certification journey, the 3PAO evaluates a CSP’s cloud computing system to ensure transparency between the third party and the government and establishes that the provider maintains consistency in their data security strategies.

The 3PAOs play an essential role in the FedRAMP assessment processes since they are independent. They must evaluate the CSP’s security implementations and provide a detailed risk posture of the cloud security environment for the security authorization decision process. Since the American Association for Laboratory Accreditation (A2LA) is responsible for accrediting the 3PAOs, these (C3PAO) assessors must demonstrate the technical competence and independence needed to acquire representative evidence and evaluate security implementations.

In most cases, the 3PAO deploys FedRAMP templates to perform security assessments and authorization.

FedRAMP Key Processes  

The three critical processes of a FedRAMP assessment and certification include:

• Security Assessment:

This process involves a set of NIST 800-53 Rev. requirements. However, before starting the security assessment procedure, the CSP must ascertain that the agency partner has reviewed and approved the SSP, and has engaged a 3PAO to develop a Security Assessment Plan (SAP). During the assessment process, the 3PAO tests and evaluates the CSP’s system. NOTE: A CSP must freeze any system development plans during the testing process.

A successful testing activity paves the way for developing a Security Assessment Report (SAR), which describes the testing findings and provides the recommendation for a FedRAMP Authorization. The CSP, in consultation with the 3PAO, uses the SAR findings to develop a Plan of Actions and Milestones (POA&M). The POA&M outlines the general plan for addressing any deficient results revealed in the testing process.

• Leveraging and Authorization:

Federal agencies refer and leverage security authorization packages in the FedRAMP repository to grant authorization. Before granting approval, the agencies first review the assessment and other deliverables to approve them or request more testing where necessary. The agencies perform a final review to determine whether to accept the system and the associated risks and then provide an Authority to Operate (ATO).

The agencies and the CSP then upload the full security packages, the ATO letter, and the FedRAMP checklist to the FedRAMP Secure Repository accessed through OMB MAX, as well as inform the PMO. Once the PMO reviews the packages and ensures the CSP has addressed all POA&M issues, the FedRAMP PMO provides a FedRAMP Authorization.

• Ongoing Assessment and Authorization:

The continuous assessment ensures that CSPs maintain their authorization status. After the FedRAMP Authorization process, the CSPs provide the agencies using their cloud services with monthly continuous monitoring and assessment deliverables. The deliverables may comprise updated information system requests or modifications, scan results, and reports, the POA&M, or any other artifacts as agreed upon in the service level agreements.

The agencies review the monthly deliverables but do not require to share them with the FedRAMP PMO. However, the CSPs can use the FedRAMP repository to share the deliverables with agency representatives. Moreover, a CSP must engage the 3PAO to provide a fully completed annual security assessment and analysis report to ascertain that the system’s risk posture remains at acceptable levels according to FedRAMP standards.

The annual assessment report and updated authorization package documentation must then be uploaded to the FedRAMP secure repository. The government requires FedRAMP Authorized CSPs to perform Continuous Monitoring to maintain an adequate security posture. Federal Agencies should review CSP’s Continuous Monitoring artifacts to determine if an ATO is appropriate over the life of the cloud-based system or service.

FedRAMP Agency Partner 

CSPs require Authorization to Operate from an agency using their cloud-based product or service. As mentioned, an ATO is the official management decision that a senior Federal official gives to authorize the operation of an information system. Besides, the decision explicitly accepts the risk of CSP’s offering to agency operations.

CSPs should identify an appropriate Agency Partner to work with for their FedRAMP authorization. Naturally, that agency should be using or is committing to acquiring a CSP’s cloud service. The FedRAMP PMO also assists in communicating the requirements, roles, and responsibilities to CSPs looking for an Agency partner or customer.

The partnership establishment process is where a CSP uses the FedRAMP In Process Requirements, accessed from FedRAMP’s Marketplace Designations for CSPs, to formalize a partnership with an agency. In other instances, the CSP vendor may already have a contract with an agency, or the agency might have already started the acquisition procedure.

The CSP’s leadership must fully commit to the FedRAMP certification process and must have built a functional, secure system. However, if that has not been done, the CSP must collaborate with the FedRAMP office by participating in an intake process after filling out the CSP Information Form.

During the partnership establishment process, a CSP designs and develops a System Security Plan (SSP), which presents the security blueprint of the system to be certified. The CSP is not required to complete the SSP before initiating a partnership but should complete it and allow the agency to review it before the commencement of the security assessment process. Also, the agency should review, approve, and sign off the SSP prior to testing. `

FedRAMP Automation  

Through close collaboration with NIST and other industry leaders, FedRAMP develops and maintains the Open Security Controls Assessment Language (OSCAL). OSCAL is a standard that guides stakeholders when they publish, implement, or assess cloud security controls.

OSCAL helps streamline and automate components in the authorization process. For instance, CSPs can leverage the standard to enable the rapid and accurate creation of System Security Plans (SSPs). Additionally, they can validate their content before submitting it to the government for review. OSCAL, on the other hand, assists the 3PAO in speeding up cloud assessment activities by enabling the automation of processes such as reporting, planning, and execution. Agencies use the OSCAL standard to accelerate the processes of reviewing the FedRAMP-required security authorization packages. At the same time, the PMO uses OSCAL to develop tools needed to reduce costs and enhance the quality of service reviews.

Ways Ignyte Assurance Platform Helps

Ignyte Assurance Platform assists you in automating the continuous monitoring process following a CSP  acquiring a FedRAMP Approval and ID, thus enhancing your cloud security posture. When using the platform, you disregard the need for superfluous emails and tracking beyond the already implemented legacy systems. Companies can rapidly automate the complete ATO lifecycle, beginning with system registration and ending with system decommissioning. The Ignyte Assurance Platform automates continuous monitoring requirements with a 21st-century certification analyst-friendly interface.

Organizations exploring federal audit options can partner with Ignyte’s experienced assessors to conduct necessary assessments towards FedRAMP certification. Ignyte professionals deliver guided pre-assessment and assessment expertise, eliminating the need for external resources until the FedRAMP accreditation is required.