FedRAMP 20x gives cloud providers more flexibility to document how they secure and operate their systems. For anyone who’s spent months preparing a Rev. 5 documentation package, that’s welcome news.
But that flexibility comes with a question: Without all those prescribed templates, how do you know what you’re supposed to write?
There’s also a rumor going around that FedRAMP 20x has eliminated documentation requirements altogether. Unfortunately for anyone hoping to retire their word processor, that’s not the case.
Want the quick explanation? Watch the video below.
Prefer reading? Here’s what you need to know.
What Actually Changed?
Under Rev. 5, cloud service providers had to prepare extensive documentation packages built around prescribed templates, detailed control narratives, and supporting evidence.
FedRAMP 20x takes a different approach. The emphasis is on documentation that’s relevant to your particular system, explains your security decisions, and reflects how your organization actually operates.
You have greater flexibility in how you document those things, but you still need to provide enough information for assessors and government customers to understand and evaluate your security. And some documentation requirements are quite specific.
What Documents Do You Still Need?
The exact requirements depend on your certification class, but several documents illustrate how the new model works.
Certification Package Overview (CPO)
This describes your cloud service offering and the information included in its certification package. It includes details about your services, Minimum Assessment Scope, relevant information resources, and other information needed to understand your offering.
Security Decision Record (SDR)
The SDR documents how your organization addresses applicable FedRAMP rules. It explains your security decisions, how requirements are implemented, and how those implementations are verified and validated. It also includes relevant assessment information and, where required, details about how your organization demonstrates its Key Security Indicators (KSIs).
Policies and Procedures
Yes, you still need these. FedRAMP requires providers to supply relevant policies and procedures as part of their certification data.
The difference is that you have greater flexibility to determine which documents make sense for your organization and how best to structure them. Your documentation should describe the practices your team actually follows.
Other Required Materials
Depending on the applicable rules, your package may also include secure configuration guidance, assessment information, ongoing certification reports, and additional operational data.
The important thing is to determine which requirements apply to your certification class and cloud service offering before deciding what needs to be produced.
Your Documentation Also Needs to Work for Machines
This is another important change. FedRAMP has published official JSON schemas for specified certification documents and reporting requirements. Where a rule specifies a JSON schema, the corresponding machine-readable information generally needs to validate against it.
And when certification data is provided in both human-readable and machine-readable formats, FedRAMP requires automation to keep that information consistent.
Think about what that means operationally. If your system changes, your documentation and reporting need a reliable way to reflect those changes. Otherwise, you risk having a written description that tells one story while your actual operating environment tells another.
How Do You Know When You’ve Written Enough?
This is probably the trickiest part of the transition. Templates had their frustrations, but at least they gave teams a relatively clear list of things to complete.
With FedRAMP 20x, organizations need to exercise more judgment about what documentation is necessary and sufficient.
A useful starting point is to ask: Does this document accurately describe what our team does? Does it explain how we’ve implemented the applicable requirements? Can we demonstrate that those implementations work? Will an assessor or government customer have enough information to understand our decisions?
Consider a policy that says your organization requires multifactor authentication. That’s useful information. But you also need a way to demonstrate how that requirement is implemented and whether it’s working.
The document explains the practice. Your verification and validation information demonstrates the implementation. Both contribute to the security picture.
The Challenge Is Knowing What’s Sufficient
FedRAMP 20x offers an opportunity to get away from enormous, rigid documentation packages. But deciding what to document, how to structure it, and how to maintain it introduces its own challenges.
Teams need to understand the applicable rules, identify the information they must provide, and make sure their documentation reflects the systems and processes they actually use. And there’s still the question everyone eventually asks: Is this going to be enough when we seek certification?
If you’re working through those questions, 38North Security can help.
Our FedRAMP advisory team works with cloud providers to understand their certification goals, interpret applicable requirements, and determine what documentation and operational capabilities they need.
Talk to 38North Security about your FedRAMP 20x certification path -> https://38northsecurity.com/contact/
About the Author
