Federal and Defense agencies are increasingly encouraged to buy the best of breed commercial solutions. Commercial Software-as-a-Service (SaaS) Cloud Service Providers (CSPs) or Independent Software Vendors (ISVs) looking to meet this growing demand must meet the Federal Risk and Authorization Management Program (FedRAMP®) cybersecurity requirements. FedRAMP provides a standardized, reusable approach to security assessment and authorization for commercial cloud service offerings. The FedRAMP Marketplace lists cloud service offerings (CSOs) based on their Impact Levels (amongst other filters). The primary levels are Low, Moderate, and High.
A quick analysis of the FedRAMP Marketplace data shows the growing demand for FedRAMP High cloud service offerings. As the graphic below demonstrates, FedRAMP High authorizations are growing faster than those for the Moderate baseline.
Understanding FedRAMP High Requirements
The FedRAMP cybersecurity requirements are rooted in Federal standards, such as the Federal Information Processing Standard (FIPS) 199, that outlines the security categorization of federal information and information systems. CSOs are categorized into one of the three Impact Levels1. The FedRAMP High baseline has 410 security controls versus 323 in a Moderate baseline. There are a number of myths associated with FedRAMP High ATOs:
- It will take 12 months or more.
- This project will cost a few million dollars.
- An organization need to double its internal headcount to support the system.
- A separate audit for Department of Defense (DOD) Impact Level 4 (IL-4) is required.
These myths tend to dissuade CSPs from pursuing FedRAMP High authorizations. However, they do not need to be reality, and this is where the cloud security and compliance automation experts at stackArmor step in to help organizations accelerate and obtain a FedRAMP High Authorization to Operate (ATO). Working with stackArmor organizations can expect:
- A fully deployed, High-ready solution within 6 months
- Total Cost of Ownership (TCO) of less than a million dollars
- No additional resources needed to fully support the system
- Investment multiplier by leveraging FedRAMP High for DOD IL-4 without a re-assessment
- Minimal engineering and architectural changes for uplifting to DOD IL-5
stackArmor’s ThreatAlert® ATO Accelerator provides a unique “in-boundary” security solution that provides 100% technical control coverage for a FedRAMP High baseline and minimizes engineering and architectural changes.
FedRAMP Moderate to High (M2H) Accelerator
For organizations with existing FedRAMP Moderate CSOs, the experts at stackArmor have developed the FedRAMP M2H Accelerator to rapidly uplift current CSOs to FedRAMP High in a matter of weeks. The FedRAMP M2H Accelerator consists of 4 key steps:
- Discovery – Perform research and analysis to determine:
- New service or upgrade?
- Greenfield deployment or upgrading an existing environment?
- Timing of the SCR (Significant Change Request)?
- Identify Changes – There are 87 new controls and over 70 controls with stricter parameters introduced due to the FedRAMP High Baseline. The ThreatAlert® security stack has been purpose-built to account for these new requirements and is designed to work with and augment existing security solutions to quickly achieve requirement readiness. stackArmor helps to coordinate with end-agency customers with pre-built change requests designed to meet FedRAMP change management protocols.
- Design, Solution & Implement – Each system is unique, so stackArmor works with existing system teams to address new technical control implementations in the context of the existing system, perform all necessary discovery, and update the authorization package documentation in order to be fully assessment-ready.
- Support Assessment – stackArmor works with your organization throughout the Third-Party Assessment Organization (3PAO) assessment process, gathering evidence, acting as interview Subject Matter Experts (SMEs), and reviewing assessment deliverables. All of this ensures the authorization package is fully complete to obtain both an Agency ATO and updated FedRAMP High Marketplace listing.
Given the operational experience and pre-defined gap analysis done by stackArmor, we offer M2H Accelerator to help customers cut down their costs for upgrading to FedRAMP High. A sample analysis from the FedRAMP M2H Accelerator is shown below:
AC-02 (03) – ACCOUNT MANAGEMENT | DISABLE INACTIVE ACCOUNTS
The information system automatically disables inactive accounts after [Assignment: organization-defined time period].
Analysis: Update the scripts and automation from 60 days to 35 days. Need to update LDAP/AD, IDP/Okta, and IAM automations.
Ready to discuss your FedRAMP High Project?
Schedule a free consultation by contacting us, and an ATO Specialist will schedule an appointment with your team.
