Blog Archives - Page 2 of 11

FedRAMP: Adapting to a Dynamic Landscape While Balancing Security with Efficiency

The FedRAMP program has successfully enabled commercial cloud computing adoption by Federal and DOD agencies for over 14 years, establishing itself as a cornerstone of secure cloud adoption within the government. Despite recent uncertainties and speculation within the community, it’s important to remember that the program’s fundamental principles remain strong. FedRAMP agency authorizations continue at a healthy pace, and the authorization backlog is demonstrably shrinking. Ready In-Process Authorized Total Change from Prior Period 3/14/2025 40 111 380 531 6 3/1/2025 36 119 370 525 15 2/1/2025 26 121 363 510 11 1/1/2025 23 120 356 499 3 12/1/2024 23 119 354 496 -1 11/1/2024 26 119 352 497 1 10/1/2024 28 120 348 496 Source: FedRAMP.gov and historical data pulled from Wayback Machine Government-wide mandates for efficiency and prioritization are driving changes across all agencies, including FedRAMP. As a program established in law to provide a standardized, reusable approach to

March 14, 2025

Making FedRAMP ATOs Great with OSCAL and Components

OMB Memo M-24-15 published on July 24, 2024 directed GSA and the FedRAMP PMO to streamline the FedRAMP ATO process using NIST OSCAL. By late 2025 or early 2026 (18 months after the issuance of the memo), GSA must ensure the ability to receive FedRAMP authorization and continuous monitoring artifacts through automated, machine-readable means. Additionally, by the Summer of 2026 (twenty four months after the issuance of the memo), agencies must ensure that agency GRC and system-inventory tools can ingest and produce machine-readable authorization and continuous monitoring artifacts using OSCAL, or any succeeding protocol as identified by FedRAMP. As agencies, and cloud service providers race to meet the mandated timelines, it is important to understand and adopt NIST OSCAL in the right way! The experienced team of FedRAMP experts at stackArmor with over a decade plus of experience in helping cloud service providers meet the requirements of the FedRAMP program

January 5, 2025

A New Way to SSP: The Component Definition Approach to Defining Controls

A New Way to SSP: The Component Definition Approach to Defining Controls Guest Post by Johann Dettweiler, CISO, stackArmor Imagine a world where the “say nothing” narrative implementation statements, rampant across the landscape of System Security Plans (SSPs), get replaced by a definitive, understanding of system state to determine the implementation status of controls. For those of us that have languished with the “old way” of writing SSPs, we dare not imagine that promised land. However, with the introduction of the Open Security Controls Assessment Language (OSCAL), there is promise of a light in the darkness, a sip to a desert wanderer, a cool breeze in hell – I present to you – Component Definitions (CDEFs)! “Cue “Thus Spake Zarathustra” – BUM bum BUMMMMM BUM, bum, BUMMMMM!” Alright, admittedly that may have been a little bit over dramatic, but if you’ve ever experienced reading or writing an SSP, suffice to

December 13, 2024

California’s AI RAMP or FedRAMP for AI?

California’s AI RAMP or FedRAMP for AI?: Urgent need for an actionable and enforceable US safety and security framework for AI California State Bill 1047 was passed today by the Assembly where it heads to the Senate and the Governor’s desk for consideration. SB 1047 is remarkable for the specificity of the governance requirements and penalties for developers of AI models. The proposed Act clearly spells out covered models and establishes the governance model which includes designating a “Government Operating Agency”, mandating a third-party audit and explicit guidance on change management & reporting. The proposed law provides for flexibility by allowing the developer to choose the appropriate framework “(i) In fulfilling its obligations under this chapter, a developer shall consider industry best practices and applicable guidance from the U.S. Artificial Intelligence Safety Institute, National Institute of Standards and Technology, the Government Operations Agency, and other reputable standard-setting organizations.” The act clearly

August 29, 2024

Embracing MLSecOps for Secure and Safe AI Systems

Written by Matt Venne, Managing Director, stackArmor The advent of artificial intelligence (AI) is transforming practically every corner of our world. Concurrently, the need for MLSecOps platforms has become fundamental in ensuring the security of AI systems. Traditional security models often fall short in addressing the unique vulnerabilities inherent in AI systems. The integration of AI into the software development lifecycle (SDLC) is pivotal in fortifying the security frameworks of organizations leveraging AI technologies. Additionally, the introduction of AI Security Posture Management and scanning for AI-specific vulnerabilities play crucial roles. Implementing an LLM Firewall further enhances these security measures. These measures are essential for ensuring the robust protection of systems that utilize AI. Uncharted Waters: Unique Attack Vectors in AI Systems AI systems introduce a set of unique attack vectors that traditional security models are not equipped to handle. Unlike conventional software, AI systems can be susceptible to data poisoning,

June 5, 2024

Conducting a CMMC 2.0 Readiness Assessment

The Cybersecurity Maturity Model Certification program gives the Defense Department a mechanism to verify the readiness of defense contractors both large and small to handle controlled unclassified information and federal contract information in accordance with federal regulations. The CMMC 2.0 program is currently in the final rulemaking phase with implementation expected in 2025. Large defense contractors with multi-location or region business operations should conduct a CMMC readiness assessment to get ahead of the eventual implementation deadline and better understand how to best implement a compliance solution. stackArmor’s security and compliance experts have over two decades of experience implementing strong security and compliance guardrails based on NIST and DOD controls. They have developed an efficient Cybersecurity Maturity Model Certification (CMMC) Readiness Assessment solution. Defense contractors should accelerate their readiness efforts by: Determining the CMMC scope and boundary definition Performing a discovery of CUI data that may include but not limited to Word

June 3, 2024

Accelerating CMMC 2.0 Compliance for Defense Contractors with Microsoft Azure

Microsoft Azure provides a suite of highly integrated security services that provide a cost-effective solution for Defense contractors looking to meet the CMMC 2.0 requirements. The Cybersecurity Maturity Model Certification (CMMC) is a framework designed to enhance the security posture of companies that work with the Department of Defense (DoD) by implementing a set of cybersecurity best practices. In this blog post, we will delve into the impact of CMMC and how organizations can effectively monitor their compliance with this crucial framework. The ThreatAlert(R) CMMC Accelerator on Microsoft Azure provides a secure and dedicated CUI boundary with all the tools, documentation and services necessary to meet CMMC 2.0 requirements. A critical part of the ThreatAlert(R) CMMC Accelerator is the ThreatAlert(R) Security Workbench (TSW) for Azure, which provides unmatched level of visibility into potential vulnerabilities and compliance gaps, enabling contractors to comply with CMMC 2.0 monitoring and reporting requirements. Define

June 3, 2024

ThreatAlert® on Google Cloud Platform: A Proven Solution for Comprehensive Security

Alec Meyer, Sr. Cloud Solutions Specialist As cloud adoption continues its meteoric rise, so too does the complexity of securing diverse environments. At stackArmor, our ThreatAlert® Security Platform has been a cornerstone for achieving and maintaining compliance within Amazon Web Services (AWS) and Microsoft Azure. Moreover, ThreatAlert® is also fully compatible with Google Cloud Platform (GCP), broadening its reach to empower organizations across multiple cloud providers. Secure, Compliant, and AI-Powered: The Google Cloud Platform Advantage Google Cloud is taking compliance seriously by recently achieving ATOs on 100+ new services authorized at a FedRAMP high level. This significant achievement underscores GCP’s commitment to providing secure and compliant cloud solutions. Consequently, Google Cloud Platform is gaining popularity due to its advanced data processing, machine learning and AI capabilities. GCP’s BigQuery, Vertex AI suite and security tools are attracting commercial software companies to build mission-focused SaaS solutions. ThreatAlert’s GCP integration makes it easy

May 24, 2024

Adding GenAI to a FedRAMP Authorized Boundary

The FedRAMP PMO announced the Emerging Technology Prioritization Framework (ETPF) to fast-track AI solutions in code generation, image generation, and chatbots. Cloud service providers (CSP) with existing FedRAMP authorizations can now add OpenAI services to their current Cloud service offerings (CSO). This can be done by following FedRAMP’s prescribed change management process that is often referred to by its acronym – the SCR process. In this blog we will walk you through how you can prepare for such a journey and add Gen AI capabilities to your existing FedRAMP accreditation boundary. stackArmor engineers have informed this blog with their work for existing customers and clients. Select the right FedRAMP Accredited Cloud Service for GenAI First, the journey begins with selecting the right FedRAMP accredited AI cloud service to add to your boundary based on the use case. Google, with Vertex AI, and Microsoft, with Azure OpenAI, both hold FedRAMP High

May 23, 2024

How Much Does FedRAMP Compliance Cost?

FedRAMP compliance costs can be broken up into two parts: 1) initial ATO costs and 2) ongoing authorization or continuous monitoring costs. The initial FedRAMP compliance professional services costs for the most part vary between $250,000 to $750,000 depending on the support required, accreditation level and size of the environment. Generally, speaking FedRAMP compliance costs are accrued to support deployment engineering, documentation and 3PAO assessment as well as ongoing continuous monitoring costs. FedRAMP compliance is becoming the gold standard in security given its rigorous and comprehensive coverage of management, operational and technical controls. As organizations look to provide cloud services to the federal government, understanding the costs associated with Federal Risk and Authorization Management Program (FedRAMP) compliance becomes crucial. In this blog post, we’ll break down the various costs associated with FedRAMP to help you plan and budget effectively. What is FedRAMP? FedRAMP, the Federal Risk and Authorization Management Program,

May 21, 2024

An Analysis of AI usage in Federal Agencies

Federal Agencies are rapidly deploying and utilization AI/ML technologies to further the mission. This blog attempts to understand the types of AI/ML systems being used by agencies and how best to develop relevant guardrails. OMB’s M-14-10 memo outlines specific requirements that must be met for ensuring Responsible AI deployments. Responsible AI Directives from OMB As part of its guidance to agencies to ensure Responsible AI use as recommended by the NIST AI RMF to maintain AI system and use case inventories, OMBâ€™s guidance M-24-10 is prescriptive, and direct. Its states, in Sections 3-a-iv and 3-a-v: AI Use Case Inventories. Each agency (except for the Department of Defense and the Intelligence Community) must individually inventory each of its AI use cases at least annually, submit the inventory to OMB, and post a public version on the agencyâ€™s website. OMB will issue detailed instructions for the inventory and its scope through its

May 17, 2024

Managing Generative AI Risk and Meeting M-24-10 Mandates on Monitoring & Evaluation

OMBâ€™s memo M-24-10 (5c. Minimum Practices for Safety-Impacting and Rights-Impacting Artificial Intelligence) is prescriptive (and timebound): No later than December 1, 2024 and on an ongoing basis while using new or existing covered safety-impacting or rights-impacting AI, agencies must ensure these practices are followed for the AI: D. Conduct ongoing monitoring. In addition to pre-deployment testing, agencies must institute ongoing procedures to monitor degradation of the AIâ€™s functionality and to detect changes in the AIâ€™s impact on rights and safety. Agencies should also scale up the use of new or updated AI features incrementally where possible to provide adequate time to monitor for adverse performance or outcomes. Agencies should monitor and defend the AI from AI-specific exploits, particularly those that would adversely impact rights and safety. Â E. Regularly evaluate risks from the use of AI. The monitoring process in paragraph (D) must include periodic human reviews to determine whether

April 29, 2024

Test & Evaluation Techniques for Meeting M-24-10 Mandates to Manage Generative AI Risk

Overview The release of the National Institute of Standards and Technology (NIST)â€™s AI Risk Management Framework (AI RMF) helped put a framework around how testing would enable organizations to manage and mitigate AI risks. While testing is predominantly considered a core part of model development, the NIST AI RMF emphasizes the importance of continuous testing and monitoring of AI. The validity and reliability for deployed AI systems are often assessed by ongoing testing or monitoring that confirms a system is performing as intended. Measurement of validity, accuracy, robustness, and reliability contribute to trustworthiness and should take into consideration that certain types of failures can cause greater harm NIST AI RMF Â§3.1 OMBâ€™s memo M-24-10 goes into detail about the expectations around AI safety testing. Section 5c of the memo (5c. Minimum Practices for Safety-Impacting and Rights-Impacting Artificial Intelligence) has laid out the minimum practices for AI risk management. These are:

April 23, 2024

Continuous ATO: Going from Authority to Operate (ATO) to Ability to Respond

This white paper explores best practices designed to help reduce the time and cost of ATOs while improving access to risk data using process automation.

April 8, 2024

Is it time to enforce an Authority-to-Operate (ATO) for Healthcare Organizations?

The Change Healthcare security breach has impacted over 94% of hospitals as reported by the American Health Association (AHA). A cascading set of events was unleashed starting with the Feb 21, 2024 announcement of the data breach at Change Healthcare requiring nearly $2BÂ in advance payments severely impacting nearly 900,000 physicians, 33,000 pharmacies, 5,500 hospitals and 600 laboratories. The security attack is reported to have been caused by a security vulnerability in software provided by ConnectWise and used by Change Healthcare. Security and cybersecurity incidents in healthcare are not new. However, what makes the Change Healthcare security breach standout is the widespread impact and the need for a forceful government response that included the Whitehouse. In many ways this cyberattack mirrors the Colonial Pipeline incident a few years ago where Citizens faced gas shortages serving as a wakeup call to policy makers that cybersecurity incidents can be disruptive to the

March 25, 2024

GSA Small Business Office and FedRAMP PMO looking for Small Business Cloud Solutions

General Services Administration (GSA), Office of Small and Disadvantaged Business Utilization (OSDBU) and The FedRAMP PMO are hosting a webinar on March 21, 2024 to provide guidance to small business CSPs in becoming FedRAMP authorized. Small businesses are encouraged to attend and register for this free event. The topics that will be covered include: Gain insight into the benefits of partnering with FedRAMP Understand The FedRAMP Authorization process Identify FedRAMP Resources for CSPs Time: Thursday, March 21, 2024 at 1:00 PM in Eastern Time (US and Canada) The registration link is available here. Small businesses with cloud service offerings that cater to federal agencies with innovative SaaS or PaaS solutions should seek FedRAMP accreditation. What is FedRAMP? The Federal Risk and Authorization Management Program, or FedRAMP, is a government-wide program that provides a standardized approach to security assessment for commercial cloud service providers (CSPs). Any cloud system hosting federal must be

March 11, 2024

FedRAMP ATO Prioritization for Generative AI Cloud Solutions

The US Government is continuing to move rapidly to ensure US competitiveness in the area of Artificial Intelligence (AI). The FedRAMP Program Management Office (PMO) published the Emerging Technology Prioritization Framework (ETPF) in January 2024. The ETPF is designed to help accelerate the availability of FedRAMP accredited Gen AI cloud solutions for federal agencies and users. The FedRAMP PMO is soliciting feedback and comments due by March 11, 2024 on the the proposed prioritization framework. Please read our blog to learn more about FedRAMP. US Government agencies including DOD and Federal Civilian agencies spent nearly $3B on AI solutions based on a 2023 report from Stanford University. This spending is expected to grow rapidly as agencies and public sector organizations start production deployments in the near future. To ensure the safe and secure deployment of AI technologies and to drive the development of standards, the Department of Commerce announced the creation

February 29, 2024

stackArmor Announces Participation in Department of Commerce Consortium Dedicated to AI Safety

**stackArmor will be part of the leading AI stakeholders to help advance the development and deployment of safe, trustworthy AI under new U.S. Government safety institute** MCLEAN, Va.–February 8, 2024–Today, stackArmor announced that it has been selected by the Department of Commerce to join the nation’s leading artificial intelligence (AI) stakeholders to participate in a Department of Commerce initiative to support the development and deployment of trustworthy and safe AI. Established by the Department of Commerce’s National Institute of Standards and Technology (NIST), the U.S. AI Safety Institute Consortium (AISIC) will bring together AI creators and users, academics, government and industry researchers, and civil society organizations to meet this mission. “Understanding that adopting AI in a safe and secure manner is a challenge for public sector agencies due to evolving guidance, standards for risk, and a shortage of resources, it’s of the utmost importance to offer proven solutions to the

February 8, 2024

stackArmor’s ThreatAlert ATO® Accelerator Supports NIH AIM-AHEAD Program

Solution enables underrepresented communities greater access to AI/ML research capabilities MCLEAN, Va.–(BUSINESS WIRE)–stackArmor, a leading provider of cloud, security and compliance acceleration solutions for meeting FedRAMP, FISMA and CMMC 2.0, today announced it has been supporting Dr. Paul Avillach, one of the Multiple Principal Investigators of the National Institutes of Health (NIH)’s Artificial Intelligence/Machine Learning Consortium to Advance Health Equity and Researcher Diversity (AIM-AHEAD) program. The AIM-AHEAD program mission is to enhance the participation of underrepresented communities in the development of AI/ML models. The program improves the capabilities of this emerging technology, beginning with electronic health records (EHR) and extending to other diverse data to address health disparities and inequities. A lack of diversity of data and researchers in the AI/ML field runs the risk of creating and perpetuating harmful biases in its practice, algorithms and outcomes. “We have been privileged to support Dr. Avillach’s vision to reduce the cost

January 23, 2024

GAO Report Details FedRAMP ATO Challenges and Costs

The US Government Accountability Office (GAO) released a report on The Federal Risk and Authorization Management Program (FedRAMP®). The 37 page report provides highly relevant insights to both agencies and commercial organizations pursuing FedRAMP accreditations or ATOs. Highlights from the report are presented below. Key Challenges Faced by Agencies and Cloud Service Providers (CSP) Receiving timely responses from stakeholders: Agencies and CSPs reported that they had issues with receiving timely responses from stakeholders throughout the authorization process. Sponsoring CSPs that were not fully prepared Agencies reported that CSPs did not fully understand the FedRAMP process and lacked complete documentation. Lacking sufficient resources: Agencies reported that they lacked the resources (e.g., funding and staffing) needed to sponsor an authorization. Meeting FedRAMP technical and process requirements: CSPs reported that they had to update the infrastructure to meet federal security requirements. Finding an agency sponsor: CSPs reported that finding an agency sponsor was difficult. Engaging

January 19, 2024

Understanding AI Risk Management – Securing Cloud Services with OWASP LLM Top 10

Welcome back to the era of GenAI, where the world remains captivated by the boundless potential of artificial intelligence. However, the proliferation of AI does not preclude us from considering the new risks it poses. As you may recall, I have been supporting numerous initiatives around AI Risk Management as part of our ATO for AI offering and recently explored the ethical risks surrounding AI using the IEEE CertifAIEd framework. As part of the NIST AI RMF, we need to continue to adopt new and emerging risk management practices unique to AI systems. Today, weâ€™re going to be exploring the other type of risks: the security vulnerability vectors that are unique to AI systems. Today we will be examining the most common of those vectors, called the OWASP LLM Top 10 and how to protect yourself while building solutions using AWS Native AI services. What is the OWASP LLM TopÂ 10?

January 5, 2024

Accelerating Safe and Secure AI Adoption with ATO for AI: stackArmor Comments on OMB AI Memo

Updated on 5/24/2025 with new developments related to this topic. On May 22, 2025, NIST published a blog stating their intent to leverage existing control frameworks to protect AI systems as opposed to creating new frameworks. stackArmor’s position published in 2023 to use AI Overlays to develop guardrails for AI systems has been accepted as an approach that will be implemented by NIST. Ms. Clare Martorana, U.S. Federal Chief Information Officer, Office of the Federal Chief Information Officer, Office of Management Budget. Subject: Request for Comments on Advancing Governance, Innovation, and Risk Management for Agency Use of Artificial Intelligence Draft Memorandum Ms. Martorana, We appreciate the opportunity to comment on the proposed Memo on Agency Use of Artificial Intelligence. As the CEO and founder of a small and innovative solutions provider, stackArmor, Inc., headquartered in Tysons VA, I applaud your efforts to foster transparency and solicit ideas and comments.Â We

December 18, 2023

stackArmor, Carahsoft partner with University of Utah School of Medicine to Accelerate FISMA ATO for NEMSIS

TYSONS CORNER, Va., Dec. 15, 2023 — stackArmor, Inc., a leading provider of FedRAMP, FISMA, CMMC 2.0, NIST AI RMF and StateRAMP compliance acceleration solutions and Carahsoft Technology Corp., the Trusted Government IT Solutions Provider® today announced that it has assisted University of Utah School of Medicine, with successfully obtaining a FISMA Moderate ATO for the National Emergency Medical Services Information System (NEMSIS). NEMSIS is a collaborative system hosted on Amazon Web Services (AWS) to improve prehospital patient care through the standardization, aggregation, and utilization of point of care EMS data at a local, state, and national level. NEMSIS is a program of US Department of Transportation’s National Highway Traffic Safety Administration (NHTSA) Office of EMS and hosted by the University of Utah’s Data Coordinating Center, housed within the School of Medicine. “FISMA is one of the most important regulations regarding Federal data security standards and guidelines. An ATO (Authority To Operate) forms the

December 15, 2023

Understanding Risk Assessment Standards for Deploying Safe & Secure AI Systems

A blog post by Matthew Venne, Sr. Solutions Director, stackArmor Itâ€™s no secret that Cloud 2.0 will be driven by Artificial Intelligence (AI). The rate at which the world is adopting AI-based solutions is nothing short of staggering; what was once viewed as science fiction, is quickly becoming science fact. With each AI system that gets deployed into the world, another machine takes ownership of decisions previously made by a human. We are currently seeing AI being adopted across all sectors of life: self-driving cars, college admissions, housing applications, the defense industry and more. Â This presents unique challenges and risks that require new thought leadership to properly assess and mitigate. What happens if: An Autonomous Intelligence System (AIS) used for college admissions incorporates a bias against any demographic? An AI-powered smartwatch discovers its owner has a condition they wanted to keep private? An AIS escalates its own privileges to access

December 12, 2023