Undergoing a FedRAMP authorization can be a daunting and expensive task, especially if you’re a small business or start-up. You may have budgeted for the independent third-party assessor (3PAO) and the resources needed to support your cloud offering’s functionality. But have you budgeted for the security solutions you’ll likely need to buy if you want to meet FedRAMP requirements?
The unfortunate reality of FedRAMP is that implementing the required FedRAMP controls requires a significant investment in technical capabilities. In this blog post, we’ll explore a few technical capabilities you should budget for, and the security control requirements associated with them at the Moderate baseline. The first four security solutions are explicitly called out in control requirements, whereas the last one requires some interpretation.
Multi-Factor Authentication
Multi-Factor Authentication (MFA) is a process that verifies users with two or more authentication factors. The three authentication categories that qualify for MFA controls are something you know (i.e. a password or PIN), something you have (i.e. hardware token), and something you are (i.e. biometrics like a fingerprint).
The FedRAMP controls explicitly state that the system must implement MFA for access to all accounts, whether privileged or unprivileged. Unfortunately, you can’t just use any MFA solution to meet these requirements. An important piece that isn’t obvious in the MFA-specific controls is ensuring that your MFA solution uses FIPS 140-2 validated algorithms (though some agency-authorizations may let you get away with non-FIPS 140-2 validated MFA tools like Microsoft of Google authenticator).
If you plan to use a cloud-based MFA solution, then make sure you check out the FedRAMP Marketplace to ensure that it is FedRAMP-authorized at the same authorization level as the information system in scope.
| Control ID | Control Name | Control Requirement |
| IA-2 (1) | IDENTIFICATION AND AUTHENTICATION | NETWORK ACCESS TO PRIVILEGED ACCOUNTS | The information system implements multifactor authentication for network access to privileged accounts. |
| IA-2 (2) | IDENTIFICATION AND AUTHENTICATION | NETWORK ACCESS TO NON-PRIVILEGED ACCOUNTS | The information system implements multifactor authentication for network access to non-privileged accounts. |
| IA-2 (3) | IDENTIFICATION AND AUTHENTICATION | LOCAL ACCESS TO PRIVILEGED ACCOUNTS | The information system implements multifactor authentication for local access to privileged accounts. |
| IA-2 (11) | IDENTIFICATION AND AUTHENTICATION | REMOTE ACCESS – SEPARATE DEVICE | The information system implements multifactor authentication for remote access to privileged and non-privileged accounts such that one of the factors is provided by a device separate from the system gaining access and the device meets [FedRAMP Requirement: FIPS 140-2, NIAP Certification, or NSA approval]. |
Vulnerability Scanning and Code Analysis
Vulnerability scanning and code analysis is important for identifying vulnerabilities and coding issues. To meet FedRAMP requirements, you’ll need a vulnerability scanner that can execute authenticated scans of your operating system/infrastructure, databases, and web applications. If containers are used within your environment, some additional requirements exist.
Additionally, while development environments are a bit of a gray area as they can be scoped out of the system boundary, there is a requirement that static and dynamic code analysis tools are used as part of the development process.
| Control ID | Control Name | Control Requirement |
| RA-5 | VULNERABILITY SCANNING | The organization: a. Scans for vulnerabilities in the information system and hosted applications [FedRAMP Assignment: monthly operating system/infrastructure; monthly web applications and databases] and when new vulnerabilities potentially affecting the system/applications are identified and reported; b. Employs vulnerability scanning tools and techniques that facilitate interoperability among tools and automate parts of the vulnerability management process by using standards for: Enumerating platforms, software flaws, and improper configurations; Formatting checklists and test procedures; and Measuring vulnerability impact; c. Analyzes vulnerability scan reports and results from security control assessments; d. Remediates legitimate vulnerabilities [Assignment: organization-defined response times], in accordance with an organizational assessment of risk; and e. Shares information obtained from the vulnerability scanning process and security control assessments with [Assignment: organization-defined personnel or roles] to help eliminate similar vulnerabilities in other information systems (i.e., systemic weaknesses or deficiencies). |
| SA-11 (1) | DEVELOPER SECURITY TESTING AND EVALUATION | STATIC CODE ANALYSIS | The organization requires the developer of the information system, system component, or information system service to employ static code analysis tools to identify common flaws and document the results of the analysis. |
| SA-11 (8) | DEVELOPER SECURITY TESTING AND EVALUATION | DYNAMIC CODE ANALYSIS | The organization requires the developer of the information system, system component, or information system service to employ dynamic code analysis tools to identify common flaws and document the results of the analysis. |
Malicious Code Protection
Malicious code protection mechanisms are solutions that protect against malicious code including viruses, worms, spyware, etc. Per FedRAMP, malicious code protection mechanisms must be employed at system entry and exit points. Therefore, anti-virus software should be installed on all the operating systems within the environment.
Typically, antivirus software uses signature definitions to identity malicious code. But FedRAMP also requires nonsignature-based malicious code detection mechanisms. So you must also implement a heuristics-based anti-malware solution if that feature is not provided by your anti-virus software.
| Control ID | Control Name | Control Requirement |
| SI-3 | MALICIOUS CODE PROTECTION | The organization: a. Employs malicious code protection mechanisms at information system entry and exit points to detect and eradicate malicious code; b. Updates malicious code protection mechanisms whenever new releases are available in accordance with organizational configuration management policy and procedures; c. Configures malicious code protection mechanisms to: Perform periodic scans of the information system [FedRAMP Assignment: at least weekly] and real-time scans of files from external sources at [FedRAMP Assignment: to include endpoints] as the files are downloaded, opened, or executed in accordance with organizational security policy; and [FedRAMP Assignment: to include alerting administrator or defined security personnel] in response to malicious code detection; and d. Addresses the receipt of false positives during malicious code detection and eradication and the resulting potential impact on the availability of the information system. |
| SI-3 (7) | MALICIOUS CODE PROTECTION | NONSIGNATURE-BASED DETECTION | The information system implements nonsignature-based malicious code detection mechanisms. |
File Integrity Monitoring
File integrity monitoring, sometimes referred to as file integrity management, are tools that monitor and analyze the integrity of critical assets using a verification method. FIM tools are important because they protect sensitive files, data, and applications and are used to help identify potential security breaches.
| Control ID | Control Name | Control Requirement |
| SI-7 | SOFTWARE, FIRMWARE, AND INFORMATION INTEGRETY | The organization employs integrity verification tools to detect unauthorized changes to [Assignment: organization-defined software, firmware, and information]. |
Security Information and Event Management
Security Information and Event Management tools ingest event data from multiple sources across your environment to provide event correlation and analytics. There isn’t a control that explicitly states you must have a SIEM. However there are a handful of controls that are hard to meet without one.
Manually reviewing all the logs and activity within your environment can become tedious and time consuming. It’s basically looking for a needle in a haystack. Ingesting data in one central repository such as a SIEM and configuring detection rules and alerting can help you more easily manage all the data and quickly identify potential security incidents affecting your environment.
| Control ID | Control Name | Control Requirement |
| AU-6 (1) | AUDIT REVIEW, ANALYSIS, AND REPORTING | PROCESS INTEGRATION | The organization employs automated mechanisms to integrate audit review, analysis, and reporting processes to support organizational processes for investigation and response to suspicious activities. Supplemental Guidance: Organizational processes benefiting from integrated audit review, analysis, and reporting include, for example, incident response, continuous monitoring, contingency planning, and Inspector General audits. Related controls: AU-12, PM-7. |
| AU-6 (3) | AUDIT REVIEW, ANALYSIS, AND REPORTING | CORRELATE AUDIT REPOSITORIES | The organization analyzes and correlates audit records across different repositories to gain organization-wide situational awareness. Supplemental Guidance: Organization-wide situational awareness includes awareness across all three tiers of risk management (i.e., organizational, mission/business process, and information system) and supports cross-organization awareness. Related controls: AU-12, IR-4. |
| SI-4 | INFORMATION SYSTEM MONITORING | The organization: a. Monitors the information system to detect: Attacks and indicators of potential attacks in accordance with [Assignment: organization- defined monitoring objectives]; and Unauthorized local, network, and remote connections; b. Identifies unauthorized use of the information system through [Assignment: organization- defined techniques and methods]; c. Deploys monitoring devices: (i) strategically within the information system to collect organization-determined essential information; and (ii) at ad hoc locations within the system to track specific types of transactions of interest to the organization; d. Protects information obtained from intrusion-monitoring tools from unauthorized access, modification, and deletion; e. Heightens the level of information system monitoring activity whenever there is an indication of increased risk to organizational operations and assets, individuals, other organizations, or the Nation based on law enforcement information, intelligence information, or other credible sources of information; f. Obtains legal opinion with regard to information system monitoring activities in accordance with applicable federal laws, Executive Orders, directives, policies, or regulations; and g. Provides [Assignment: organization-defined information system monitoring information] to [Assignment: organization-defined personnel or roles] [Selection (one or more): as needed; [Assignment: organization-defined frequency]]. |
| SI-4 (1) | INFORMATION SYSTEM MONITORING | SYSTEM-WIDE INTRUSION DETECTION SYSTEM | The organization connects and configures individual intrusion detection tools into an information system-wide intrusion detection system. |
| SI-4 (4) | INFORMATION SYSTEM MONITORING | INBOUND COMMUNICATIONS TRAFFIC | The information system monitors inbound and outbound communications traffic [FedRAMP Assignment: continuously] for unusual or unauthorized activities or conditions. |
| SI-4 (16) | INFORMATION SYSTEM MONITORING | CORRELATE MONITORING INFORMATION | The organization correlates information from monitoring tools employed throughout the information system. |
Contact Us to Help
We’ve identified five different security solutions that need to be implemented to meet FedRAMP requirements. If they are already incorporated into your environment, then great. If not, now is a good time to start researching solutions and their associated costs.
If you weren’t already aware of these requirements, then you should consider having 38North Security conduct a gap analysis of your cloud service offering. During a gap analysis, information is collected from interviews and artifacts to evaluate the existing security controls of your cloud solution against the FedRAMP security control baseline to identify non-compliant controls and remediation measures. The results of the gap analysis can be used to ensure that you’re allocating resources and funding to the areas where it’s needed to ensure that you obtain a FedRAMP authorization.
Frequently Asked Questions:
1. How long does the FedRAMP authorization process typically take, and how does it vary based on the size and complexity of the organization?
The FedRAMP authorization process duration can vary significantly based on the size and complexity of the organization, as well as other factors such as the readiness of the organization, the completeness of documentation, and the efficiency of the assessment process.
For larger organizations with complex systems and extensive infrastructures, the process can take considerably longer, often spanning several months to over a year. Conversely, smaller organizations with simpler systems may complete the process more quickly, typically within several months.
Factors influencing the duration of the authorization process include:
- Scope and Complexity: The size and complexity of the organization’s IT systems and cloud offerings play a significant role. Organizations with extensive infrastructures or offering multiple services may require more time to assess and implement the necessary controls.
- Preparedness: Organizations that have already implemented robust security measures aligned with FedRAMP requirements may progress more swiftly through the authorization process. Conversely, organizations lacking sufficient security measures may need additional time to implement and document necessary controls.
- Documentation Quality: The quality and completeness of documentation provided to assessors are crucial. Well-documented security policies, procedures, and technical implementations can expedite the assessment process, while incomplete or inaccurate documentation may lead to delays.
- Assessment Efficiency: The efficiency of the third-party assessment organization (3PAO) conducting the security assessment can impact the process duration. Prompt communication, thorough evaluations, and timely resolution of issues can streamline the authorization process.
- Regulatory Changes: Changes in FedRAMP requirements or guidelines may affect the authorization process duration. Organizations must stay updated on regulatory updates and adjust their compliance efforts accordingly.
In summary, while there is no fixed timeline for the FedRAMP authorization process, organizations should anticipate potential delays and allocate resources accordingly, especially considering the unique characteristics and complexities of their IT environments. Engaging with experienced consultants or advisors familiar with the FedRAMP process can also help navigate challenges and expedite the authorization journey.
2. Are there any alternative approaches or strategies for small businesses or startups to navigate the complexities of FedRAMP compliance without substantial financial investment?
Navigating the complexities of FedRAMP compliance can indeed pose challenges for small businesses and startups, especially considering the substantial financial investment often required. However, there are alternative approaches and strategies that these organizations can consider to achieve FedRAMP compliance without breaking the bank:
- FedRAMP Ready Solutions: Explore FedRAMP Ready solutions available in the marketplace. These are pre-vetted cloud service offerings that have undergone initial security assessments by third-party assessment organizations (3PAOs) and are deemed suitable for FedRAMP authorization. Utilizing FedRAMP Ready solutions can streamline the compliance process and reduce the burden on small businesses and startups.
- Leverage Shared Services: Consider leveraging shared services and resources provided by larger organizations or cloud service providers (CSPs) that have already obtained FedRAMP authorization. Small businesses can benefit from the security controls implemented by these providers, reducing the scope of their own compliance efforts and associated costs.
- Partner with Experienced Consultants: Engage with experienced consultants or advisory firms specializing in FedRAMP compliance. These professionals can provide guidance tailored to the specific needs and constraints of small businesses and startups, helping them navigate the compliance process efficiently and cost-effectively.
- Focus on Essential Controls: Prioritize implementation of essential security controls required for FedRAMP compliance, focusing on those directly relevant to the organization’s cloud offering and the protection of sensitive data. By focusing resources on critical areas, small businesses can achieve compliance without overburdening their budgets.
- Utilize Open Source Solutions: Explore open-source security solutions and tools that can help meet FedRAMP requirements at a lower cost. Many open-source projects offer robust security features and can be customized to fit the needs of small businesses and startups without the high licensing fees associated with commercial products.
- Continuous Monitoring and Improvement: Implement continuous monitoring practices to ensure ongoing compliance with FedRAMP requirements. Regularly assess and update security controls, address vulnerabilities, and adapt to evolving threats to maintain compliance without incurring significant additional costs.
By adopting a strategic and resource-conscious approach to FedRAMP compliance, small businesses and startups can navigate the complexities of the process while minimizing financial investment and maximizing the security of their cloud offerings.
3. What are the consequences for organizations that fail to meet FedRAMP requirements, both in terms of regulatory penalties and reputational damage?
Failing to meet FedRAMP requirements can have several consequences for organizations, including regulatory penalties and reputational damage:
- Regulatory Penalties:
- Organizations that fail to meet FedRAMP requirements may face regulatory penalties imposed by government agencies responsible for oversight. These penalties can include fines, sanctions, or other enforcement actions, depending on the severity of the non-compliance and its impact on security and data protection.
- Regulatory penalties may vary based on the nature of the violation, the organization’s compliance history, and the discretion of regulatory authorities. Serious or repeated violations may result in more severe penalties, including suspension or revocation of authorization to operate in federal cloud environments.
- Loss of Business Opportunities:
- Non-compliance with FedRAMP requirements can lead to loss of business opportunities, particularly in the federal government sector. Federal agencies and departments typically require cloud service providers to demonstrate FedRAMP compliance before engaging in contracts or procurement activities.
- Organizations that fail to meet FedRAMP requirements may be disqualified from bidding on government contracts or providing services to federal agencies, limiting their market opportunities and revenue potential.
- Reputational Damage:
- Non-compliance with FedRAMP can damage an organization’s reputation and erode trust among customers, partners, and stakeholders. Public disclosure of non-compliance or security incidents can tarnish the organization’s image and undermine confidence in its ability to protect sensitive data and systems.
- Reputational damage can have long-lasting effects on the organization’s brand equity, customer loyalty, and competitive position in the market. Negative publicity surrounding security breaches or compliance failures may deter potential customers and partners from doing business with the organization, leading to financial losses and diminished market share.
- Legal Liability:
- Non-compliance with FedRAMP requirements may expose organizations to legal liability, including lawsuits, regulatory investigations, and civil penalties. Organizations may be held accountable for breaches of contractual obligations, negligence in safeguarding sensitive information, or violations of data protection laws and regulations.
- Legal proceedings arising from non-compliance can result in costly litigation expenses, settlement payments, or damage awards, further exacerbating the financial and reputational consequences of non-compliance.
In summary, organizations that fail to meet FedRAMP requirements risk facing regulatory penalties, loss of business opportunities, reputational damage, and legal liability. It is essential for organizations to prioritize compliance efforts and invest in robust security measures to mitigate these risks and safeguard their operations, customers, and stakeholders.
