Schedule ATO Acceleration Briefing

Blog

Embracing MLSecOps for Secure and Safe AI Systems

Written by Matt Venne, Managing Director, stackArmor The advent of artificial intelligence (AI) is transforming practically every corner of our world. Concurrently, the need for MLSecOps platforms has become fundamental in ensuring the security of AI systems.  Traditional security models often fall short in addressing the unique vulnerabilities inherent in AI systems. The integration of AI into the software development lifecycle (SDLC) is pivotal in fortifying the security frameworks of organizations leveraging AI technologies. Additionally, the introduction of AI Security Posture Management and scanning for AI-specific vulnerabilities play crucial roles. Implementing an LLM Firewall further enhances these security measures. These measures are essential for ensuring the robust protection of systems that utilize AI. Uncharted Waters: Unique Attack Vectors in AI Systems AI systems introduce a set of unique attack vectors that traditional security models are not equipped to handle. Unlike conventional software, AI systems can be susceptible to data poisoning,

Read More »
June 5, 2024

Conducting a CMMC 2.0 Readiness Assessment

The Cybersecurity Maturity Model Certification program gives the Defense Department a mechanism to verify the readiness of defense contractors both large and small to handle controlled unclassified information and federal contract information in accordance with federal regulations. The CMMC 2.0 program is currently in the final rulemaking phase with implementation expected in 2025. Large defense contractors with multi-location or region business operations should conduct a CMMC readiness assessment to get ahead of the eventual implementation deadline and better understand how to best implement a compliance solution. stackArmor’s security and compliance experts have over two decades of experience implementing strong security and compliance guardrails based on NIST and DOD controls. They have developed an efficient Cybersecurity Maturity Model Certification (CMMC) Readiness Assessment solution. Defense contractors should accelerate their readiness efforts by: Determining the CMMC scope and boundary definition Performing a discovery of CUI data that may include but not limited to Word

Read More »
June 3, 2024

Accelerating CMMC 2.0 Compliance for Defense Contractors with Microsoft Azure

Microsoft Azure provides a suite of highly integrated security services that provide a cost-effective solution for Defense contractors looking to meet the CMMC 2.0 requirements. The Cybersecurity Maturity Model Certification (CMMC) is a framework designed to enhance the security posture of companies that work with the Department of Defense (DoD) by implementing a set of cybersecurity best practices. In this blog post, we will delve into the impact of CMMC and how organizations can effectively monitor their compliance with this crucial framework.  The ThreatAlert(R) CMMC Accelerator on Microsoft Azure provides a secure and dedicated CUI boundary with all the tools, documentation and services necessary to meet CMMC 2.0 requirements. A critical part of the ThreatAlert(R) CMMC Accelerator is the ThreatAlert(R) Security Workbench (TSW) for Azure, which provides unmatched level of visibility into potential vulnerabilities and compliance gaps, enabling contractors to comply with CMMC 2.0 monitoring and reporting requirements.   Define

Read More »
June 3, 2024

ThreatAlert® on Google Cloud Platform: A Proven Solution for Comprehensive Security

Alec Meyer, Sr. Cloud Solutions Specialist As cloud adoption continues its meteoric rise, so too does the complexity of securing diverse environments. At stackArmor, our ThreatAlert® Security Platform has been a cornerstone for achieving and maintaining compliance within Amazon Web Services (AWS) and Microsoft Azure. Moreover, ThreatAlert® is also fully compatible with Google Cloud Platform (GCP), broadening its reach to empower organizations across multiple cloud providers. Secure, Compliant, and AI-Powered: The Google Cloud Platform Advantage Google Cloud is taking compliance seriously by recently achieving ATOs on 100+ new services authorized at a FedRAMP high level. This significant achievement underscores GCP’s commitment to providing secure and compliant cloud solutions. Consequently, Google Cloud Platform is gaining popularity due to its advanced data processing, machine learning and AI capabilities. GCP’s BigQuery, Vertex AI suite and security tools are attracting commercial software companies to build mission-focused SaaS solutions. ThreatAlert’s GCP integration makes it easy

Read More »
May 24, 2024

Adding GenAI to a FedRAMP Authorized Boundary

The FedRAMP PMO announced the Emerging Technology Prioritization Framework (ETPF) to fast-track AI solutions in code generation, image generation, and chatbots. Cloud service providers (CSP) with existing FedRAMP authorizations can now add OpenAI services to their current Cloud service offerings (CSO). This can be done by following FedRAMP’s prescribed change management process that is often referred to by its acronym – the SCR process. In this blog we will walk you through how you can prepare for such a journey and add Gen AI capabilities to your existing FedRAMP accreditation boundary. stackArmor engineers have informed this blog with their work for existing customers and clients. Select the right FedRAMP Accredited Cloud Service for GenAI First, the journey begins with selecting the right FedRAMP accredited AI cloud service to add to your boundary based on the use case. Google, with Vertex AI, and Microsoft, with Azure OpenAI, both hold FedRAMP High

Read More »
May 23, 2024

How Much Does FedRAMP Compliance Cost?

FedRAMP compliance costs can be broken up into two parts: 1) initial ATO costs and 2) ongoing authorization or continuous monitoring costs. The initial FedRAMP compliance professional services costs for the most part vary between $250,000 to $750,000 depending on the support required, accreditation level and size of the environment. Generally, speaking FedRAMP compliance costs are accrued to support deployment engineering, documentation and 3PAO assessment as well as ongoing continuous monitoring costs. FedRAMP compliance is becoming the gold standard in security given its rigorous and comprehensive coverage of management, operational and technical controls. As organizations look to provide cloud services to the federal government, understanding the costs associated with Federal Risk and Authorization Management Program (FedRAMP) compliance becomes crucial. In this blog post, we’ll break down the various costs associated with FedRAMP to help you plan and budget effectively. What is FedRAMP? FedRAMP, the Federal Risk and Authorization Management Program,

Read More »
May 21, 2024

An Analysis of AI usage in Federal Agencies

Federal Agencies are rapidly deploying and utilization AI/ML technologies to further the mission. This blog attempts to understand the types of AI/ML systems being used by agencies and how best to develop relevant guardrails. OMB’s M-14-10 memo outlines specific requirements that must be met for ensuring Responsible AI deployments. Responsible AI Directives from OMB As part of its guidance to agencies to ensure Responsible AI use as recommended by the NIST AI RMF to maintain AI system and use case inventories, OMB’s guidance M-24-10 is prescriptive, and direct. Its states, in Sections 3-a-iv and 3-a-v: AI Use Case Inventories. Each agency (except for the Department of Defense and the Intelligence Community) must individually inventory each of its AI use cases at least annually, submit the inventory to OMB, and post a public version on the agency’s website. OMB will issue detailed instructions for the inventory and its scope through its

Read More »
May 17, 2024

Managing Generative AI Risk and Meeting M-24-10 Mandates on Monitoring & Evaluation

OMB’s memo M-24-10 (5c. Minimum Practices for Safety-Impacting and Rights-Impacting Artificial Intelligence) is prescriptive (and timebound): No later than December 1, 2024 and on an ongoing basis while using new or existing covered safety-impacting or rights-impacting AI, agencies must ensure these practices are followed for the AI: D. Conduct ongoing monitoring. In addition to pre-deployment testing, agencies must institute ongoing procedures to monitor degradation of the AI’s functionality and to detect changes in the AI’s impact on rights and safety. Agencies should also scale up the use of new or updated AI features incrementally where possible to provide adequate time to monitor for adverse performance or outcomes. Agencies should monitor and defend the AI from AI-specific exploits, particularly those that would adversely impact rights and safety.   E. Regularly evaluate risks from the use of AI. The monitoring process in paragraph (D) must include periodic human reviews to determine whether

Read More »
April 29, 2024

Test & Evaluation Techniques for Meeting M-24-10 Mandates to Manage Generative AI Risk

Overview The release of the National Institute of Standards and Technology (NIST)’s AI Risk Management Framework (AI RMF) helped put a framework around how testing would enable organizations to manage and mitigate AI risks. While testing is predominantly considered a core part of model development, the NIST AI RMF emphasizes the importance of continuous testing and monitoring of AI. The validity and reliability for deployed AI systems are often assessed by ongoing testing or monitoring that confirms a system is performing as intended. Measurement of validity, accuracy, robustness, and reliability contribute to trustworthiness and should take into consideration that certain types of failures can cause greater harm NIST AI RMF §3.1 OMB’s memo M-24-10 goes into detail about the expectations around AI safety testing. Section 5c of the memo (5c. Minimum Practices for Safety-Impacting and Rights-Impacting Artificial Intelligence) has laid out the minimum practices for AI risk management. These are:

Read More »
April 23, 2024

Is it time to enforce an Authority-to-Operate (ATO) for Healthcare Organizations?

The Change Healthcare security breach has impacted over 94% of hospitals as reported by the American Health Association (AHA). A cascading set of events was unleashed starting with the Feb 21, 2024 announcement of the data breach at Change Healthcare requiring nearly $2B  in advance payments severely impacting nearly 900,000 physicians, 33,000 pharmacies, 5,500 hospitals and 600 laboratories. The security attack is reported to have been caused by a security vulnerability in software provided by ConnectWise and used by Change Healthcare. Security and cybersecurity incidents in healthcare are not new. However, what makes the Change Healthcare security breach standout is the widespread impact and the need for a forceful government response that included the Whitehouse. In many ways this cyberattack mirrors the Colonial Pipeline incident a few years ago where Citizens faced gas shortages serving as a wakeup call to policy makers that cybersecurity incidents can be disruptive to the

Read More »
March 25, 2024

GSA Small Business Office and FedRAMP PMO looking for Small Business Cloud Solutions

General Services Administration (GSA), Office of Small and Disadvantaged Business Utilization (OSDBU) and The FedRAMP PMO are hosting a webinar on March 21, 2024 to provide guidance to small business CSPs in becoming FedRAMP authorized. Small businesses are encouraged to attend and register for this free event. The topics that will be covered include: Gain insight into the benefits of partnering with FedRAMP Understand The FedRAMP Authorization process Identify FedRAMP Resources for CSPs Time: Thursday, March 21, 2024 at 1:00 PM in Eastern Time (US and Canada) The registration link is available here. Small businesses with cloud service offerings that cater to federal agencies with innovative SaaS or PaaS solutions should seek FedRAMP accreditation. What is FedRAMP? The Federal Risk and Authorization Management Program, or FedRAMP, is a government-wide program that provides a standardized approach to security assessment for commercial cloud service providers (CSPs). Any cloud system hosting federal must be

Read More »
March 11, 2024

FedRAMP ATO Prioritization for Generative AI Cloud Solutions

The US Government is continuing to move rapidly to ensure US competitiveness in the area of Artificial Intelligence (AI). The FedRAMP Program Management Office (PMO) published the Emerging Technology Prioritization Framework (ETPF) in January 2024. The ETPF is designed to help accelerate the availability of FedRAMP accredited Gen AI cloud solutions for federal agencies and users. The FedRAMP PMO is soliciting feedback and comments due by March 11, 2024 on the the proposed prioritization framework. Please read our blog to learn more about FedRAMP. US Government agencies including DOD and Federal Civilian agencies spent nearly $3B on AI solutions based on a 2023 report from Stanford University. This spending is expected to grow rapidly as agencies and public sector organizations start production deployments in the near future. To ensure the safe and secure deployment of AI technologies and to drive the development of standards, the Department of Commerce announced the creation

Read More »
February 29, 2024

stackArmor Announces Participation in Department of Commerce Consortium Dedicated to AI Safety

**stackArmor will be part of the leading AI stakeholders to help advance the development and deployment of safe, trustworthy AI under new U.S. Government safety institute** MCLEAN, Va.–February 8, 2024–Today, stackArmor announced that it has been selected by the Department of Commerce to join the nation’s leading artificial intelligence (AI) stakeholders to participate in a Department of Commerce initiative to support the development and deployment of trustworthy and safe AI. Established by the Department of Commerce’s National Institute of Standards and Technology (NIST), the U.S. AI Safety Institute Consortium (AISIC) will bring together AI creators and users, academics, government and industry researchers, and civil society organizations to meet this mission. “Understanding that adopting AI in a safe and secure manner is a challenge for public sector agencies due to evolving guidance, standards for risk, and a shortage of resources, it’s of the utmost importance to offer proven solutions to the

Read More »
February 8, 2024

stackArmor’s ThreatAlert ATO® Accelerator Supports NIH AIM-AHEAD Program

Solution enables underrepresented communities greater access to AI/ML research capabilities MCLEAN, Va.–(BUSINESS WIRE)–stackArmor, a leading provider of cloud, security and compliance acceleration solutions for meeting FedRAMP, FISMA and CMMC 2.0, today announced it has been supporting Dr. Paul Avillach, one of the Multiple Principal Investigators of the National Institutes of Health (NIH)’s Artificial Intelligence/Machine Learning Consortium to Advance Health Equity and Researcher Diversity (AIM-AHEAD) program. The AIM-AHEAD program mission is to enhance the participation of underrepresented communities in the development of AI/ML models. The program improves the capabilities of this emerging technology, beginning with electronic health records (EHR) and extending to other diverse data to address health disparities and inequities. A lack of diversity of data and researchers in the AI/ML field runs the risk of creating and perpetuating harmful biases in its practice, algorithms and outcomes. “We have been privileged to support Dr. Avillach’s vision to reduce the cost

Read More »
January 23, 2024

GAO Report Details FedRAMP ATO Challenges and Costs

The US Government Accountability Office (GAO) released a report on The Federal Risk and Authorization Management Program (FedRAMP®). The 37 page report provides highly relevant insights to both agencies and commercial organizations pursuing FedRAMP accreditations or ATOs. Highlights from the report are presented below. Key Challenges Faced by Agencies and Cloud Service Providers (CSP) Receiving timely responses from stakeholders: Agencies and CSPs reported that they had issues with receiving timely responses from stakeholders throughout the authorization process. Sponsoring CSPs that were not fully prepared Agencies reported that CSPs did not fully understand the FedRAMP process and lacked complete documentation. Lacking sufficient resources: Agencies reported that they lacked the resources (e.g., funding and staffing) needed to sponsor an authorization. Meeting FedRAMP technical and process requirements: CSPs reported that they had to update the infrastructure to meet federal security requirements. Finding an agency sponsor: CSPs reported that finding an agency sponsor was difficult. Engaging

Read More »
January 19, 2024

Understanding AI Risk Management – Securing Cloud Services with OWASP LLM Top 10

Welcome back to the era of GenAI, where the world remains captivated by the boundless potential of artificial intelligence. However, the proliferation of AI does not preclude us from considering the new risks it poses. As you may recall, I have been supporting numerous initiatives around AI Risk Management as part of our ATO for AI offering and recently explored the ethical risks surrounding AI using the IEEE CertifAIEd framework. As part of the NIST AI RMF, we need to continue to adopt new and emerging risk management practices unique to AI systems. Today, we’re going to be exploring the other type of risks: the security vulnerability vectors that are unique to AI systems. Today we will be examining the most common of those vectors, called the OWASP LLM Top 10 and how to protect yourself while building solutions using AWS Native AI services. What is the OWASP LLM Top 10?

Read More »
January 5, 2024

Accelerating Safe and Secure AI Adoption with ATO for AI: stackArmor Comments on OMB AI Memo

Updated on 5/24/2025 with new developments related to this topic. On May 22, 2025, NIST published a blog stating their intent to leverage existing control frameworks to protect AI systems as opposed to creating new frameworks. stackArmor’s position published in 2023 to use AI Overlays to develop guardrails for AI systems has been accepted as an approach that will be implemented by NIST. Ms. Clare Martorana, U.S. Federal Chief Information Officer, Office of the Federal Chief Information Officer, Office of Management Budget. Subject: Request for Comments on Advancing Governance, Innovation, and Risk Management for Agency Use of Artificial Intelligence Draft Memorandum Ms. Martorana, We appreciate the opportunity to comment on the proposed Memo on Agency Use of Artificial Intelligence. As the CEO and founder of a small and innovative solutions provider, stackArmor, Inc., headquartered in Tysons VA, I applaud your efforts to foster transparency and solicit ideas and comments.  We

Read More »
December 18, 2023

stackArmor, Carahsoft partner with University of Utah School of Medicine to Accelerate FISMA ATO for NEMSIS

TYSONS CORNER, Va., Dec. 15, 2023 — stackArmor, Inc., a leading provider of FedRAMP, FISMA, CMMC 2.0, NIST AI RMF and StateRAMP compliance acceleration solutions and Carahsoft Technology Corp., the Trusted Government IT Solutions Provider® today announced that it has assisted University of Utah School of Medicine, with successfully obtaining a FISMA Moderate ATO for the National Emergency Medical Services Information System (NEMSIS). NEMSIS is a collaborative system hosted on Amazon Web Services (AWS) to improve prehospital patient care through the standardization, aggregation, and utilization of point of care EMS data at a local, state, and national level. NEMSIS is a program of US Department of Transportation’s National Highway Traffic Safety Administration (NHTSA) Office of EMS and hosted by the University of Utah’s Data Coordinating Center, housed within the School of Medicine. “FISMA is one of the most important regulations regarding Federal data security standards and guidelines. An ATO (Authority To Operate) forms the

Read More »
December 15, 2023

Understanding Risk Assessment Standards for Deploying Safe & Secure AI Systems

A blog post by Matthew Venne, Sr. Solutions Director, stackArmor It’s no secret that Cloud 2.0 will be driven by Artificial Intelligence (AI). The rate at which the world is adopting AI-based solutions is nothing short of staggering; what was once viewed as science fiction, is quickly becoming science fact. With each AI system that gets deployed into the world, another machine takes ownership of decisions previously made by a human. We are currently seeing AI being adopted across all sectors of life: self-driving cars, college admissions, housing applications, the defense industry and more.  This presents unique challenges and risks that require new thought leadership to properly assess and mitigate. What happens if: An Autonomous Intelligence System (AIS) used for college admissions incorporates a bias against any demographic? An AI-powered smartwatch discovers its owner has a condition they wanted to keep private? An AIS escalates its own privileges to access

Read More »
December 12, 2023

All Eyes on AI: Rising Interest, Regulation, and Compliance Requirements

AI is so much more than a buzz term these days. It is a full blown technological revolution commanding the attention of industries and sectors across the board. Its surging role is particularly evident in the public sector where government and federal agencies are flocking to capture the benefits of the emerging tech. Take the Department of State for example. In order to automate the time-consuming task of documentation processing and declassification, the department has instituted an AI-driven pilot project that helps to streamline reviews. AI Initiatives from The White House and Public Sector  But as AI gains traction, there is also a rush to get ahead of its challenges. In a talk hosted by the Information Technology Industry Council, Arati Prabhakar, the director of the White House’s Office of Science and Technology Policy, discussed an expected executive order that focuses on balancing opportunity with risk. Of course, that became

Read More »
November 17, 2023

FedRAMP and Federal Cybersecurity Market Roundup October 2023

October was a busy month for FedRAMP. From Federal Secure Cloud Advisory Committee (FSCAC) meetings to an automation overhaul, there were a slew of activities aiming to further prepare the program for the future it faces and will need to serve. Developing the Next Generation of FedRAMP The push to really explore FedRAMP’s upcoming chapter began with the first FSCAC meeting of the month on October 19. The focus of this particular gathering was to delve further into the Cloud Solution Provider (CSP) Authorization Path and offer an opportunity to present insights on how to enhance this process. The following convening on October 26 was centered around the growing role of Continuous Monitoring (ConMon), also offering an opening of the floor to discuss input that would lead to draft recommendations. But the key theme that keeps recurring is automation. While the forthcoming November meetings will tune more deeply into equipping

Read More »
November 15, 2023

stackCast Episode #4: Nick Mistry, SVP and CISO at Lineaje

On a new episode of stackCast (powered by stackArmor), host Martin Rieger, Chief Solutions Officer & CISO at stackArmor, welcomes the SVP and CISO at Lineaje, Nick Mistry. The two discuss: The importance of software supply chain security and why it has been mandated by some government programs such as FedRAMP and FISMA The overview of a Software Bill of Materials (SBOM) and breakdown of transitive dependencies vs. dependencies Why Lineaje developed an SBOM exchange platform (SBOM360 Hub) and how it works How SBOM360 Hub impacts the overall security posture of a company To learn more about Lineaje and how they solve critical Software Supply Chain security problems faced by every organization that builds, uses, or sells software, please visit: https://www.lineaje.dev/. – About stackCast: Welcome to stackCast, powered by stackArmor, your go-to source for all things related to cloud security and cybersecurity compliance. Hosted by Martin Rieger, Chief Solutions Officer

Read More »
November 13, 2023

Accelerating FedRAMP ATOs: OMB Memo

The Office of Management and Budget (OMB) released a Draft Memorandum for Modernizing the Federal Risk and Authorization Management Program (FedRAMP) on Friday, Oct 27, 2023. FedRAMP was codified in 2022 when Congress passed the FedRAMP Authorization Act (“Act”).  The Act established FedRAMP within the General Services Administration (GSA) and created a FedRAMP Board to provide input and recommendations to the Administrator of GSA. FedRAMP has been in place through a Office of Management and Budget (OMB) memorandum in December 2011. OMB released the DRAFT Memorandum that has a number of highlights. Salient elements of the proposed changes are summarized below from our perspective in having supported over 200 system migrations and ATOs since 2009 when we supported the first Government wide Cloud Authorization To Operate (ATO) in May 2010 for Recovery.gov and then the first Cabinet Agency Cloud ATO in Dec 2010 for Treasury.gov. SaaS focus: OMB has a

Read More »
October 30, 2023