The Federal Risk and Authorization Management Program (FedRAMP) was designed to support the federal government’s “cloud-first” initiative by making it easier for federal agencies to contract with cloud providers. Like FISMA, DFARS, CJIS, and HIPAA, FedRAMP’s security controls are based on NIST 800-53.
If your cloud service business contracts with the U.S. federal government, you are required to comply with FedRAMP. However, with concerns over cloud security deepening in the wake of numerous high-profile cloud breaches, FedRAMP certification may be a worthwhile investment even if your company does not currently contract with the U.S. government.
Benefits of FedRAMP Certification
FedRAMP certification is a long, arduous, and potentially expensive process. Unlike FISMA, which allows organizations to perform their own assessments, FedRAMP certification must be performed by a certified third-party assessment organization (3PAO). However, FedRAMP certification offers many benefits to cloud service providers, including:
• The U.S. government is the single largest buyer of goods and services in the world, and federal agencies are reliable customers that continue to buy even during economic downturns, when private-sector firms cut back. Your company may eventually want to tap this very stable, highly lucrative market.
• The U.S. government is “cloud-first.” To federal agencies, “cloud-first” isn’t just marketing hyperbole; it’s a directive from the White House to “evaluate safe, secure, Cloud Computing options before making any new investments.”
• FedRAMP is “do once, use many times.” Unlike the FISMA standard, which requires organizations to seek an Authority to Operate (ATO) from each individual federal agency they do business with, a FedRAMP ATO qualifies a cloud service provider to do business with any federal agency.
• The FedRAMP certification process will uncover your risks and vulnerabilities and improve your company’s data security. All of your customers will benefit from the security controls you put in place to comply with FedRAMP – and this is a big selling point. Private-sector companies know how arduous the FedRAMP certification process is, and they see it as a gold standard of data security.
• You will be able to better compete in the highly competitive cloud services market. As cloud services companies multiply, and concerns over cloud security grow, FedRAMP certification will help your company stand out in a crowded marketplace.
• Completing the FedRAMP certification process will make other security audits easier. FedRAMP controls are based on NIST 800-53, which is the basis for numerous other standards that your company likely needs to comply with, including HIPAA, DFARS, and CJIS.
Choosing a 3PAO
The FedRAMP compliance process begins with selecting the right 3PAO. In addition to FedRAMP experience, make sure that your 3PAO has expertise in cloud security and has worked with private-sector firms as well as government agencies. It is also critical that your 3PAO be well-versed in FISMA, as FedRAMP maps to the same NIST 800-53 standards that FISMA does.
Also make sure to ask questions about the tools your 3PAO will be using during the certification process; specifically, will the 3PAO be using spreadsheets or modern GRC software? If your 3PAO is still stuck on spreadsheets, the certification process could end up taking a lot longer and costing a lot more.
Michael Peters is the CEO of Lazarus Alliance, Inc., the Proactive Cyber Security™ firm, and Continuum GRC. He has served as an independent information security consultant, executive, researcher, and author. He is an internationally recognized and awarded security expert with years of IT and business leadership experience and many previous executive leadership positions.
He has contributed significantly to curriculum development for graduate degree programs in information security, advanced technology, cyberspace law, and privacy, and to industry standard professional certifications. He has been featured in many publications and broadcast media outlets as the “Go-to Guy” for executive leadership, information security, cyberspace law, and governance.