Blog

  Large software vendors, global defense contractors and organizations operating in hyper regulated markets must meet very specific government cybersecurity requirements. These requirements include ensuring data sovereignty as well as compliance with specific standards like FedRAMP or ITSG-33 in the US and Canada respectively. The rapid emergence of data sovereignty requirements are driving the increased need for “in-region” deployments that provide the ability to contain the data within a pre-specified area. External connections to corporate services, other SaaS services, or other systems cause the assessors to take a real hard look at data flows. This scrutiny and extra due diligence can slow down the accreditation process. These unique constraints create challenges for large global organizations looking to meet complex regulatory requirements in a cost-effective manner. This problem can be solved by using an “in-boundary” security and compliance model that limits the number of external connections and delivers a “region-gapped” service.

Large ISV’s, Global Defense contractors and organizations operating in global hyper regulated markets must meet very specific government cybersecurity requirements.

The FedRAMP Program Management Office (PMO) issued updated guidance on the FedRAMP Readiness Assessment requirements.

The cost of pursuing a FedRAMP authorization for a software company range from $500,000 to $1 million for a single product. Obviously, this is especially burdensome for small companies — the same firms that often drive the innovation and modernization the government seeks.
Author: Michael Garland, Gaurav “GP” Pal

As the Federal Risk and Authorization Management Program marks its 10th anniversary, it’s time to applaud FedRAMP’s accomplishments — but also explore ways to scale its operations so the government can more quickly adopt innovative software solutions.
Author: Michael Garland, Gaurav “GP” Pal

Organizations looking to participate and take advantage of the rapidly growing Government and Public sector cloud market must get ready by conducting a gap assessment of their environment.

FedRAMP was established in 2012 and is managed by the U.S. General Services Administration.

Organizations continue to migrate and adopt AWS Cloud Services and offer digital services to their customers and stakeholders.

Change control and configuration management processes help maintain a secure baseline configuration of the Cloud Service Provider’s (CSP) architecture.

AWS Resource Access Manager (RAM) is a service that enables you to easily and securely share AWS resources with any AWS account or within your AWS Organization.

  stackArmor has been supporting customers since 2014 in assisting with their AWS cloud migration and management needs.  Once the migration is done, continued cloud management is critical to receiving the cloud dividend. stackArmor has developed the Well-Managed Cloud framework and the stackArmor ThreatAlert® security platform to help customers easily manage their cloud environments. The ThreatAlert platform provides four key areas of focus including security, operations, compliance, and governance. Screenshot of ThreatAlert® Security Platform for managing and operating secure and optimal cloud environments on AWS A key part of operating a cloud environment is to ensure the lowest possible operational costs. To help customers implement an easy to understand Cloud cost optimization is the process of reducing your overall cloud spend by identifying mismanaged resources, eliminating waste, reserving capacity for higher discounts, and right-sizing computing services to scale. There are a few common cloud cost optimization best practices, including, finding

  ISVs and Startups are increasingly being driven to provide software as a service to Government agencies. SaaS solutions are critical to driving digital transformation and helping agencies meet their mission requirements. Commercial organizations must obtain a FedRAMP Authority To Operate (ATO) to ensure that their cloud system meets government data confidentiality, integrity, and availability requirements. The technical architecture for obtaining an ATO can be especially challenging for large multi-product or multi-country organizations. For example, large ISV’s have multiple product lines or complex compliance requirements that must satisfy current and future needs. A platform-centric architecture is essential to ensure that the FedRAMP compliant system is scalable given the high cost of initial compliance. stackArmor has pioneered ATO Acceleration using an “in-boundary” platform-centric architecture on AWS. stackArmor-s ATO Acceleration solution is vetted by AWS and is called ThreatAlert®. The solution incorporates two key best practices highly relevant for compliance-focused organizations: 1) A