Preparation is key to smoothing your FedRamp journey

NOTE: This is the first of two commentaries offering advice on FedRamp compliance.

For years, the federal government’s aspirations in the cloud have been defined by speed. Today, there is a new s-word that has been added to the mix: smart.

In late September, the White House unveiled a new draft of its cloud computing strategy, which shifts the “Cloud First” initiative launched in 2010 under the Obama Administration to a “Cloud Smart” policy. “Many agencies were early in their journey in adopting those technologies and we’ve learned a substantial amount,” said Federal CIO Suzanne Kent, explaining the evolving approach to cloud.

Against this backdrop, one area where agencies and industry are working to become both faster and smarter is the Federal Risk and Authorization Management Program (FedRAMP), created in 2011 to provide a standardized approach to security assessment, authorization, and continuous monitoring for cloud products and services. The Trump Administration appears keenly aware of shortcomings that have impacted the program over the past seven years, such as the considerable time and resources needed for vendors to complete the process and offer FedRAMP-compliant solutions.

These concerns have reached the highest levels of government, as evidenced by the April release of FedRAMP’s CSP Authorization Playbook and several attempts by legislators to enact reform legislation. The White House’s “Cloud Smart” draft policy also acknowledges that “strategies for accelerating common ATO agreements and overall process improvements are in development and will be addressed in future guidance.”

Unfortunately, industry vendors looking to offer FedRAMP-compliant solutions may not have the luxury of waiting for full reform efforts to be in place. To avoid making “perfect” the enemy of the “good,” here are a few simple ways to help streamline your FedRAMP journey and tap into the expanding federal market for cloud-based services.

The First Step is the Most Important

If you want to have a successful FedRAMP process, it is absolutely vital that you organize everything on the front end, which includes determining your end goal. Before taking any action, it is very important that cloud-service providers (CSPs) understand the impact level of their information system and security requirements associated with that level. CSPs should use FIPS 199, Federal Information Processing Standard, and NIST SP 800-60, Guide for Mapping Types of Information and Information Systems to Security Categories, for determining security impact levels and security categorizations of their cloud service offering (CSO) consistent with the organization’s assigned mission and business functions.

Furthermore, it’s important to ensure that your team is properly prepared for the process and is fully briefed on the requirements.

By doing this you can avoid the biggest pitfall of FedRAMP – reaching a step in the process, whether it’s a risk review or remediation, and realizing that you lack the necessary expertise or controls to complete the step. It will bring your FedRAMP journey to a standstill, costing you valuable time, resources, and peace of mind.

While FIPS 199 impact levels are a critical piece, CSPs should be focused on their end goals when mapping out an effective strategy instead of approaching it in a “one size fits all” manner. For example, a CSP may only have the Moderate Impact Level as a goal, while others may be looking to meet Impact Level 4 or 5 requirements set forth by the Department of Defense.

This is an important piece to consider as a CSP can reuse what they used for its initial FedRAMP authorization package in order to meet higher standards, referred to as FedRAMP+. By having all of this decided on the front end will drastically cut down on the time and resources needed to achieve the desired goal.

Another critical step for CSPs is to harden their baseline to match one of the variety of standards that have been approved by FedRAMP — including DISA’s Security Technical Implementation Guide (STIG) and the United States Government Configuration Baseline (USGCB).

By looking inward before beginning the FedRAMP process, CSPs can identify potential problems before they arise and map out a path to approval that does not drain time or resources.

Determine Your Authorization Strategy

As you begin the FedRAMP authorization process, the biggest question to answer is which of two main authorization strategies works best for you: CSPs can take the agency route to approval or the Joint Authorization Board (JAB) path. When trying to figure out which is right for you, here are a few questions to ask:

• Does your offering have a niche, agency-specific demand?
• Will you rely on an agency’s flexibility concerning specific risks?

If the answer to these questions is yes, then you should go the agency route to approval, as agencies will offer flexibility around risk evaluation depending on the specific mission.

On the other hand:

Does your offering have potential demand from multiple agencies?

Can your offering stand up to a rigorous review of its security authorization package?

If you answered yes to these questions, you should likely pursue JAB Authorization.

The JAB is the primary governance and decision-making body for the FedRAMP process, consisting of chief information officers (CIOs) from the Department of Defense, Department of Homeland Security and the General Services Administration. JAB authorization allows for a broader field of engagement options, but has a very low tolerance for risk when it comes to IT systems.

With this in mind, you can expect this route to include rigorous technical reviews without the expectation of accepting risk on behalf of agencies.

Once you determine your path to authorization – after organizing on the front end – you can begin the FedRAMP process with confidence.

The Path to Success is Paved by Self-Evaluation

Every CSP should conduct a self-assessment so you can gain insight on the current security state of your offering and its technical capabilities. By doing a proactive, thorough review, you can incorporate and address requirements early on in the solution’s design, planning and documentation. As part of this, you’ll also find the so-called “showstoppers” in the process, which are obligatory requirements that cannot have alternate implementations and must be addressed directly.

Another potential showstopper is the underlying infrastructure that a CSP selects. If a CSP is using another CSP’s infrastructure, it is strongly recommended they select services that have already been authorized, to further ease the process. Whether that’s Amazon Web Services (AWS), Microsoft Azure, Google or any other service, the infrastructure must be FedRAMP-authorized to ensure full authorization. Failure to do so would result in the potential for a CSP’s entire process to grind to a halt late in the process, which will have wasted a CSP’s valuable resources.

The FedRAMP process has been rightly criticized over the year, but improvements in technology and guidance means that the headaches of the past can remain there.