{"id":3236,"date":"2022-01-03T09:30:47","date_gmt":"2022-01-03T14:30:47","guid":{"rendered":"https:\/\/seaglasstech.wpenginepowered.com\/?p=3236"},"modified":"2022-01-10T11:47:34","modified_gmt":"2022-01-10T16:47:34","slug":"what-is-fedramp-and-why-is-it-important","status":"publish","type":"post","link":"https:\/\/seaglasstechnology.com\/what-is-fedramp-and-why-is-it-important\/","title":{"rendered":"What Is FedRAMP And Why Is It Important?"},"content":{"rendered":"

\"twoKeeping government data out of the wrong hands<\/a> is a top priority in the United States. Innovations in technology have opened up new opportunities in the form of cloud computing. The on-demand availability of computer system resources, including data storage capabilities, has resulted in greater flexibility, increased collaboration, quality control, and cost savings. <\/p>\n

Despite the high level of security that cloud systems possess, cloud-based technology is not impervious to internal and external cybersecurity threats.<\/p>\n

Established in 2011 by the Office of Management and Budget (OMB), FedRAMP<\/a> was created to provide a cost-effective, risk-based approach for the implementation and use of cloud services in executive departments and agencies. Learn more about FedRAMP, why it is important, and how federal agencies can use modern cloud technologies safely. <\/p>\n

What Is FedRAMP?<\/h2>\n

The Federal Risk and Authorization Management Program (FedRAMP) is a program<\/a> that evaluates and authorizes cloud-based products and services used by U.S. federal agencies. This rigorous, in-depth process ensures adequate security posture of cloud service offerings (CSOs) and helps keep agencies mobile without compromising federal security.<\/p>\n

Obtaining FedRAMP authorization is no easy task. It is considered one of the most meticulous software-as-a-service certifications in the world, made up of 14 applicable regulations and laws, as well as 19 standards and guidance documents. FedRAMP allows agencies to quickly adapt from outdated, insecure legacy IT to secure, cost-effective and mission-enabling cloud-based IT.<\/p>\n

Why Is FedRAMP Important?<\/h2>\n

FedRAMP creates a common security framework that eliminates duplicative efforts and helps the federal government accelerate the adoption of cloud technology. Today, all cloud services that store federal data require FedRAMP authorization, meaning any organization that wishes to work with the federal government must have FedRAMP authorization as part of their security plan.<\/p>\n

\"fedrampHaving authorization helps ensure consistency in the security of government cloud services. FedRAMP provides a single set of standards for all cloud partners and government agencies. Agencies are responsible for reviewing their security requirements against the standardized baseline. <\/p>\n

Cloud service providers must go through the authorization process just once. After obtaining authorization for their CSO, the security package can continue to be reused by any federal agency.<\/p>\n

FedRAMP is now mandatory for all executive agency service models and cloud deployments at high, moderate, and low impact levels. The program is controlled by a Joint Authorization Board (JAB) that is made up of representatives from the Department of Defense (DoD), the Department of Homeland Security (DHS), and the General Services Administration (GSA)<\/a>.<\/p>\n

What Are The Steps To FedRAMP Authorization?<\/h2>\n

The process of obtaining FedRAMP authorization can be challenging; however, authorization can significantly increase security credibility as it shows a commitment to meeting the highest security standards. There are several steps involved in FedRAMP authorization, including the following:<\/p>\n

1. Package Development<\/h3>\n

FedRAMP authorization begins with an authorization kickoff meeting. The provider must complete a system security plan, followed by the development of a security assessment plan by a FedRAMP-approved third-party assessment organization.<\/p>\n

2. Assessment<\/h3>\n

The third-party assessment organization then submits a security assessment report and the provider develops a Plan of Action and Milestones (POA&M). This is a corrective action plan for tracking the resolution of information security and security weaknesses.<\/p>\n

3. Authorization<\/h3>\n

An authorizing agency or JAB then decides whether the level of risk is acceptable. If it is, an authority to operate a letter is submitted to the FedRAMP project management office and the provider is listed in the FedRAMP marketplace.<\/p>\n

4. Monitoring<\/h3>\n

Once listed, the provider is responsible for sending monthly security monitoring deliverables to all agencies.<\/p>\n

What are the Categories of FedRAMP Compliance?<\/h2>\n

FedRAMP consists of four impact levels for services based on risk. These categories are associated with the potential impacts of a security breach in three distinct areas, including availability, integrity, and confidentiality. The first three impact levels are from the National Institute of Standards and Technology (NIST) and are based on Federal Information Processing Standard (FIPS) 199. The final impact level is based on NIST Special Publication 800-37.<\/p>\n

The four impact levels include:<\/p>\n