Schedule ATO Acceleration Briefing

Blog

stackCast Episode #4: Nick Mistry, SVP and CISO at Lineaje

On a new episode of stackCast (powered by stackArmor), host Martin Rieger, Chief Solutions Officer & CISO at stackArmor, welcomes the SVP and CISO at Lineaje, Nick Mistry. The two discuss: The importance of software supply chain security and why it has been mandated by some government programs such as FedRAMP and FISMA The overview of a Software Bill of Materials (SBOM) and breakdown of transitive dependencies vs. dependencies Why Lineaje developed an SBOM exchange platform (SBOM360 Hub) and how it works How SBOM360 Hub impacts the overall security posture of a company To learn more about Lineaje and how they solve critical Software Supply Chain security problems faced by every organization that builds, uses, or sells software, please visit: https://www.lineaje.dev/. – About stackCast: Welcome to stackCast, powered by stackArmor, your go-to source for all things related to cloud security and cybersecurity compliance. Hosted by Martin Rieger, Chief Solutions Officer

Read More »
November 13, 2023

Accelerating FedRAMP ATOs: OMB Memo

The Office of Management and Budget (OMB) released a Draft Memorandum for Modernizing the Federal Risk and Authorization Management Program (FedRAMP) on Friday, Oct 27, 2023. FedRAMP was codified in 2022 when Congress passed the FedRAMP Authorization Act (“Act”).  The Act established FedRAMP within the General Services Administration (GSA) and created a FedRAMP Board to provide input and recommendations to the Administrator of GSA. FedRAMP has been in place through a Office of Management and Budget (OMB) memorandum in December 2011. OMB released the DRAFT Memorandum that has a number of highlights. Salient elements of the proposed changes are summarized below from our perspective in having supported over 200 system migrations and ATOs since 2009 when we supported the first Government wide Cloud Authorization To Operate (ATO) in May 2010 for Recovery.gov and then the first Cabinet Agency Cloud ATO in Dec 2010 for Treasury.gov. SaaS focus: OMB has a

Read More »
October 30, 2023

Suzette Kent Joins stackArmor AI Risk Management Center of Excellence (CoE)


By: Gaurav “GP” Pal, Founder and CEO, stackArmor Last month at stackArmor, we announced the establishment of our AI Risk Management Center of Excellence (CoE), comprised of executives with strong operational backgrounds and experience driving large-scale modernization efforts in Federal agencies.   We’re pleased to share that Suzette Kent, former Federal Chief Information Officer for the United States, is joining the stackArmor CoE to advise and provide ongoing counsel to stackArmor and its stakeholders. “Harnessing the power of AI for delivery of government mission and services will be transformational,” said Suzette Kent. “But, it is complicated to align all the emerging policy, risk frameworks, approval processes and existing policy and law.  I am thrilled to be included in the COE because I have seen the work of the stackArmor team to drill down to details and find a path to connect all the pieces.  We can only get to use of

Read More »
October 12, 2023

FedRAMP and Federal Cybersecurity Market Roundup September 2023

It’s been a few weeks now since Carahsoft’s FedRAMP Headliner Summit, but there is no shortage of moments to recall from it. For instance, Robert Costello commemorated his two-year anniversary as CIO at the Cybersecurity and Infrastructure Security Agency (CISA) during the event. While speaking on his role, he explained the difference that has unfolded, including a greater emphasis on having technically savvy federal employees. As quoted by MeriTalk, he stated, “We’re now doing cutting-edge technology solutions, providing services to the agencies that we weren’t before…” Growing Demand for Cloud Services It’s an important point that agencies such as CISA are enhancing tech skills. With growing risk, expanding innovations, and rising regulations, the demand is higher than ever. This is seen in funding initiatives as well. According to Government Technology, the federal government is preparing to distribute $1 billion to states and cities in order to support their cybersecurity plans.

Read More »
October 2, 2023

Implementing Zero Trust with Okta’s Identity Engine

By: Matthew Venne, Senior Solutions Director In an increasingly interconnected world, securing digital assets and sensitive information has never been more critical. In a never-ending game of “cat and mouse, malicious actors and cyber security professionals go back and forth trying to one-up each other.   As a result, the security required to protect digital assets has outgrown the “traditional†perimeter-based security model, where processes and identities are typically only authenticated once and then implicitly trusted.   To adapt to the new network complexity, a new model, the “Zero Trust†security model, has gained prominence as a more robust and effective approach to safeguarding data and systems.  Okta, a leading identity and access management (IAM) solution provider, has recently introduced its Identity Engine to implement Zero Trust principles. In this blog post, we will delve into how Okta’s Identity Engine implements Zero Trust and the benefits it offers for modern organizations. Understanding

Read More »
September 27, 2023

stackArmor Launches ATO for AI™ Governance Model To Help Public Sector Organizations Safely and Securely Accelerate AI Adoption

Solution receives industry backing with newly established AI Risk Management Center of Excellence (CoE) MCLEAN, Va., September 27, 2023 – stackArmor, the leader in security and compliance acceleration for government organizations, today announced its Approval To Operate (ATO) for AI™ accelerator, that helps public sector and government organizations rapidly implement security and governance controls to manage risks associated with Generative AI and General AI Systems. ATO for AI™ builds on the decades of experience in managing digital and information systems risk using open NIST standards like NIST RMF, NIST SP 800-53 and NIST SP 800-171 and integrates them with emerging frameworks like NIST AI RMF specifically tailored to manage AI risk. As organizations across the globe reap the benefits of AI for automated decision-making and data analysis, the Biden administration recently issued a fact sheet announcing commitments from eight AI companies to manage the risks posed by AI. The document notes the

Read More »
September 27, 2023

stackCast Episode #3: Stephen de Vries, CEO at IriusRisk

On a new episode of stackCast (powered by stackArmor), host Martin Rieger, Chief Solutions Officer & CISO at stackArmor, welcomes the CEO at IriusRisk, Stephen de Vries. The two discuss: What threat modeling is, and why it’s crucial in today’s digital landscape How IriusRisk automates the threat modeling process How IriusRisk breaks down silos between Security and Development The guide to how companies can invest in security Compliance and how working with G-SIBs comes with a unique challenge To learn more about IriusRisk and how they automate the threat modeling process, please visit: https://www.iriusrisk.com/. —- About stackCast: Welcome to stackCast, powered by stackArmor, your go-to source for all things related to cloud security and cybersecurity compliance. Hosted by Martin Rieger, Chief Solutions Officer & CISO at stackArmor, the series focuses on navigating the ever-changing landscape of cloud technology and cybersecurity. In a world where our reliance on digital technology is

Read More »
September 12, 2023

Looking Forward to the GovForward FedRAMP Headliner Summit

What’s the cloud hanging over cloud service providers’ heads? The rapidly evolving threat landscape. It’s challenging to keep up with the pace and scale of risk, which is especially true when you are working with clients as essential as federal government agencies. Therefore, it’s critical to not only maintain cyber hygiene, but to anticipate what’s lurking. One key way to help reach those goals is to band together with other cybersecurity experts to exchange ideas, discuss the topics impacting everyday tasks, explore solutions, and brainstorm on what’s ahead. Cue the GovForward FedRAMP Headliner Summit presented by GovExec. GovForward FedRAMP Headliner Summit  On August 23, leaders across the cybersecurity, cloud technology, government, and military fields will descend on the Waldorf Astoria in Washington, D.C. for conversations ranging from the need to better protect critical infrastructure to the state of cloud adoption. The main overarching theme, though, will be examining the impact

Read More »
August 18, 2023

FedRAMP and Federal Cybersecurity Market Roundup August 2023

If federal cybersecurity were a play, regulatory programs such as FedRAMP would be like the directors helping to guide all of the participating actors properly execute their parts and bring the vision to life. And with the spotlight growing brighter due to the mass digital migration, evolving tech landscape, and expanding threat environment, they recently brought in some new stage managers to help. 2nd Meeting of the Federal Secure Cloud Advisory Committee (FSCAC)  In compliance with the FedRAMP Authorization Act of 2022, the General Services Administration (GSA) established the Federal Secure Cloud Advisory Committee (FSCAC), an alliance of 14 private and public sector representatives stemming from companies such as Google to agencies such as the Defense Information Systems Agency. According to the Federal Register, FSCAC’s purpose is to “provide advice and recommendations to the Administrator of GSA, the FedRAMP Board, and agencies on technical, financial, programmatic, and operational matters regarding

Read More »
August 10, 2023

stackCast Episode #2: Evgeny Gervis, CEO at SafeLogic

https://youtu.be/nRqtoTR68_w On a new episode of stackCast (powered by stackArmor), host Martin Rieger, Chief Solutions Officer & CISO at stackArmor, welcomes the CEO at SafeLogic, Evgeny Gervis. The two discuss: The important aspect of cybersecurity for business, especially those dealing with the United States government and any other entity that requires cryptographic software validation How SafeLogic is revolutionizing the approach to achieving FIPS 140 validation How SafeLogic supports customers who are dependent upon someone else’s cryptography and what that process looks like To learn more about SafeLogic and how their FIPS 140 validation-as-a-service streamlines the process of achieving and maintaining FIPS 140 validation for encryption, please visit www.safelogic.com. You can also listen to the episode here. About stackCast: Welcome to stackCast, powered by stackArmor, your go-to source for all things related to cloud security and cybersecurity compliance. Hosted by Martin Rieger, Chief Solutions Officer & CISO at stackArmor, the series

Read More »
August 8, 2023

stackCast Episode #1: Introduction to stackArmor with CEO and Founder, Gaurav Pal (GP)

https://youtu.be/iF8JDGpzTHsWelcome to stackCast, powered by stackArmor, your go to source for all things related to cloud security and cybersecurity compliance. Host Martin Rieger, Chief Solutions Officer & CISO at stackArmor, kicks off the series with Gaurav Pal (GP), CEO and Founder of stackArmor, who shares:  The vision behind stackArmor and challenges they faced early on How they put the NIST security controls at the center of their universe The importance of cloud security and compliance The evolving security framework and future of the federal cloud security industry  To learn more about stackArmor and how they can help you with your compliance needs or anything cloud related, please visit www.stackarmor.com. You can also find stackArmor on: LinkedIn: https://www.linkedin.com/company/stackarmor/ YouTube: https://www.youtube.com/channel/UCS2dl2kpZ5PBA6BzBtiJu3g You can also listen to the podcast here. 

Read More »
July 18, 2023

Securing an Agency Sponsor for FedRAMP Agency-Sponsored ATO

Obtaining a mandated Federal Risk and Authorization Management Program (FedRAMP)  Authorization to Operation (ATO) is increasingly important for Cloud Service Providers (CSPs) who wish to make Cloud Service Offerings (CSOs) available to federal government agencies. The FedRAMP Authorization Act codifies the security and compliance requirements for commercial CSPs as they increasingly shift away from on-prem deployment models in favor of cloud-based service delivery models. The journey to FedRAMP authorization begins by understanding and embracing the requirement to secure an agency sponsor. Securing an agency with the willingness to become a CSPs partner and help shepherd them through the authorization process can be a daunting task. In FedRAMP, There are two paths to sponsorship – an Agency sponsorship to obtain a FedRAMP ATO and a Joint Authorization Board (JAB) sponsorship to obtain a Provisional Authorization (P-ATO). Given the JAB’s limited bandwidth, specific government-wide use, and business-case-centric qualification criteria, the majority of

Read More »
July 17, 2023

Navigating a JAB Provisional ATO (P-ATO)

Achieving a FedRAMP Authority to Operate (ATO) is a mandatory requirement for cloud service offerings (CSOs) that hold federal data. If you have software (or infrastructure or a platform) that is offered as-a-service and government agencies are your target customers, your cloud offering will be required to obtain and maintain a FedRAMP P-ATO. An ATO is evidence that your cloud offering has met and continues to operate in alignment with the high standards set forth in the FedRAMP cybersecurity controls baselines. JAB – FedRAMP’s Joint Authorization Board The FedRAMP program is governed by the Joint Authorization Board – otherwise known as the JAB. The JAB includes the Chief Information Officers (CIOs) from the Department of Defense (DoD), General Services Administration (GSA), and the Department of Homeland Security (DHS). Each of the three agencies has a team of technical reviewers (TRs) committed to the program’s objectives. The JAB is supported by

Read More »
June 29, 2023

Streamlining Federal Cybersecurity Requirements [Federal News Network]

With updates such as the latest revision to the National Institute of Standards and Technology Special Publication 800-53, navigating CMMC, FedRAMP, SP-800-171, and FISMA is more important than ever. Martin Rieger, the Chief Solutions Officer at stackArmor, joined Federal News Network to discuss the mistakes companies often make in tackling this process, what introduced changes mean for authorizations, why budgeting and planning for continuous monitoring will be critical, and more. Watch stackArmor’s Martin Rieger interview with Federal News Network here.  https://youtu.be/_K9hml0pSus

Read More »
June 22, 2023

Keeping Up with FedRAMP: Baseline Updates, Inaugural Members of the FSCAC, and More

In the words of Winston Churchill, “To improve is to change; to be perfect is to change often.” While it’s likely that collectively as business owners, policy drivers, and industry experts, we will never absolutely perfect the task of shielding government organizations and federal agencies from experiencing some sort of cyber vulnerability, we can certainly keep evolving the approach to protect them the best we can. And if introducing updates often is the path, then FedRAMP is on track. Coming off of significant milestones such as hitting its 300th ATO and witnessing a 50% increase in the number of CSOs authorized at the High impact level, the program is already announcing other updates and launching new initiatives. So, let’s catch up with what is going on in the world of FedRAMP. The FedRAMP Joint Authorization Board Approves Rev. 5 Baselines We begin with the approval of the FedRAMP Rev. 5

Read More »
June 16, 2023

It’s Official – FedRAMP has moved to Rev. 5

  As of May 30, 2023, FedRAMP has officially approved and adopted the new Rev. 5 baselines – aligning with the National Institute of Standards and Technology Special Publication 800-53 (NIST 800-53) Rev. 5 baselines that went into effect in September of 2021. Cloud Service Providers (CSPs) with existing authorizations, those who are mid-process, and those looking to achieve a FedRAMP authorization for the first time will all be required to align with Rev. 5 baselines. What Changes Can CSPs Expect? The new baselines include both new controls and required changes to a number of existing management, operational and technical controls across multiple control families. While FedRAMP has provided a complete workbook outlining the exact changes for each control in the new baselines, general changes include: Control language that is more directive and outcomes-centric throughout; A new Supply Chain Risk Management (SR) control family (taking the total number of families

Read More »
June 14, 2023

The Sky’s the Limit: The Growth of FedRAMP Compliant Cloud Service Offerings

As you’ll recall from our last post, FedRAMP just soared to a major milestone – 300 FedRAMP Authorized Cloud Service Offerings (CSOs). Beyond marking a noteworthy tally, this is a monumental achievement because it means that federal agencies now have reused these cloud services over 4,500 times! In the days and months to come, agencies will have access to even more CSOs than ever before, which comes with a few trickle down effects. The Benefits of More CSOs For one, more CSOs translates to more options for federal agencies. In turn, the team at FedRAMP points out that this makes the market more competitive and paves the way for lower pricing (a challenge that we also highlighted in our previous post). Plus, this record figure catapults FedRAMP further into its trajectory of growth. Growth has been a key trend for FedRAMP, especially over the past two years. Within that time

Read More »
May 19, 2023

What is FedRAMP Compliance? Understand the FedRAMP Certification and Compliance Process

What is FedRAMP P-ATO? FedRAMP Compliance and Certification Steps Explained The Federal Risk and Authorization Management Program (FedRAMP) is a US government-wide program that promotes the adoption of secure commercial cloud services across the federal government. The FedRAMP program streamlines the acquisition of cloud services by providing a standardized approach to security assessment, authorization, and continuous monitoring for cloud products and services. FedRAMP empowers agencies to use modern cloud technologies, with an emphasis on security and protection of federal information. FedRAMP compliance is a requirement for commercial cloud service providers (CSP) looking to provide s a security and compliance accreditation requirement for commercial cloud service providers looking to sell their solutions to US Government agencies. FedRAMP certifications are managed by GSA which is a US Government agency takes with operating the program. Federal agencies select and procure commercial cloud services based on their security requirements that are based on specific

Read More »
April 9, 2023

Lowering FedRAMP, CMMC 2.0 and StateRAMP Compliance Costs with ThreatAlert® Zero trust Security Platform

Lowering FedRAMP, CMMC 2.0 and StateRAMP Compliance Costs is critical for Organizations operating in highly regulated markets with public sector and government clients. Meeting complex NIST 800-53 security control requirements and generating a FedRAMP, StateRAMP, or CMMC 2.0 compliance package are critical requirements. FedRAMP compliance costs can be prohibitive due to the need for R&D, developing a package and implementing FIPS and DISA STIG controls that requires skilled cybersecurity, compliance and cloud experts that understand complex security requirements and government regulations. stackArmor’s compliance accelerator helps reduce the time and cost of FedRAMP, CMMC 2.0, StateRAMP and other Government mandated security requirements by providing a dedicated accreditation boundary with compliant security controls that meet NIST SP 800-53 and NIST SP 800-171 requirements. stackArmor pre-integrated solution delivers an end-to-end technology enabled solution that has been vetted and audited by government agencies, assessors and independent third-parties. Lowering FedRAMP Compliance Costs with ATO Acceleration

Read More »
April 7, 2023

Implementing Data Diode Pattern on AWS for Data Loss Prevention (DLP) and Zero Trust Access Control

Author: Matt Venne, Solutions Director, stackArmor, Inc. One of the biggest challenges that cloud architects and security professionals have is protecting “sensitive” data.  This challenge is multiplied when that sensitive data must move between different systems for analysis and consumption.  Data security is difficult in such a dynamic scenario, which requires special tooling and techniques to prevent the data from leaving its designated areas. Typically, these tools and techniques fall in the category of Data Loss Prevention or DLP for short.  The marketplace has no shortage of DLP solutions; they can be network-based, examining data in flight at central egress points – e.g., firewalls; or agent-based, installed on a device, such as a workstation, to examine data at rest to programmatically identity which data is sensitive.  Often, they are used in conjunction, agents identify sensitive data and network firewalls block the data identified by the agents from leaving. Data Loss

Read More »
February 26, 2023