FedRAMP Federal Risk And Authorization Management Program

FedRAMPFederal Risk and Authorization Management ProgramFederal Computer Security Program Managers’ ForumClaudio BelloliFedRAMP Information Systems Security ManagerGSAAugust 19, 2014

FedRAMP: A brief historyDec 2012Jul-Sep 2011Feb 2010KundraAnnouncesFedRAMPSecurity WorkingGroup conceptannouncedPublic DraftReleasedConcept, Controlsand Templatesreleased for publiccomment2010Tiger TeamsConveneJun 2010Working with ISIMC& NIST, JABdevelops initialbaselineJan 2012JAB FinalizesBaselineFirst ProvisionalAuthorizationJAB grantsProvisional ATO toAutonomicFedRAMPsecurity controls Resourcesfor LOW andMODERATEreleasedNIST, JAB andGSA work toestablish 3PAOprogramconcept2011Feb/Mar 2011JAB DraftsBaseline3PAOConceptPlannedNov 201020122013June 2014Two-Year FedRAMPOperationalAnniversaryFedRAMP now requiredfor all cloud solutionscovered by policy memo2014Feb 2012CONOPSpublishedTimelines andprocessesarticulatedFedRAMPconducts Govwide consensusmeetings onDec 2011commentsOMB ReleasesPolicy MemoFederal CIO, StevenVanRoekel signsFedRAMP PolicyMay 2013First AgencyAuthorizationHHS Issues ATO toAmazonJun 2012FedRAMP LaunchesTemplates published,staffing in place, CSPsstart applying2

FedRAMP is in Full Operations Repeatable processes for continuous monitoringactivities Agency outreach Additional access controls in the secure repository Agency ATO’s accessible and leveraged by other agencies Guide to FedRAMP updated to reflect lessons learned inIOC Manual dashboards in use for internal, JAB and otherstakeholder reporting Privatization of 3PAO Accreditation– A2LA selected as the accreditation body3

FedRAMP Key Stakeholders & ResponsibilitiesFederalAgencies Contract with Cloud ServiceProvider Leverage ATO or useFedRAMP process whenauthorizing Third PartyAssessmentOrganizationsFedRAMPPMO & JAB Implement anddocument security Use IndependentAssessor Monitor security Provide artifacts Establish processes andstandards for securityauthorizations Maintain secure repository ofavailable security packages Provisionally authorizesystems that have greatestability to be leveragedgovernment-wide Cloud auditor, maintainsindependence from CSP Performs initial andperiodic assessment ofFedRAMP controls Does NOT assist in creationof control documentation4

Agency Responsibilities As of June 5, 2014, all cloud projects must meet the FedRAMPrequirements when initiating, reviewing, granting, and revokingsecurity authorizations– Use of FedRAMP security controls baseline– Use of mandatory templates– Provide FedRAMP PMO with ATO letters– Use FedRAMP repository for all ATOs where re-use is possible Agencies must enforce FedRAMP via contractual provisions– Template contract language available on FedRAMP.gov– Includes generic security section as well as control specific contract clauses Agencies must report to OMB via PortfolioStat cloud services thatcannot meet FedRAMP requirements5

FedRAMP Relationship to theNIST Risk Management Framework1. Categorize theInformationSystem6. Monitor6. - zeInformationInformationSystemSystem-Provisional Auth.ATO-AgencyATOATO-Agency-Low Impact-Moderate ImpactNISTRMF4. Assess the4. AssesstheSecurityControls2.the2. SelectSelect theControlsControls-FedRAMP Low or-FedRAMP Low orModerate BaselineModerate Baseline3. ImplementSecurity Controls-Describe in SSPSecurity-UseControlsof an-FedRAMPIndependentAccredited3PAOAssessor (3PAO)6

FedRAMP Security Assessment Framework (SAF)and NIST Risk Management Framework7

Timeline for the SAFDocumentSSPNIST RMF 1, 2, 3AuthorizeAssessSAPSARTestingNIST RMF 4POAMNIST RMF 5MonitorConMon ReportsNIST RMF 6JABP-ATOs9 mosAgencyATOs4 mosCSPSupplied 6wks8

SAF Process Area: DocumentDocumentSystem Security PlanCategorize theInformation SystemSelect the SecurityControlsImplement the SecurityControls NIST RMF Step 1 Determine impact levelby using the FIPS 199Form FedRAMP only supportsLow and Moderateimpact levels NIST RMF Step 2 Use the FedRAMP low ormoderate baselinesecurity controls 125 controls for low 325 for moderate NIST RMF Step 3 Use FedRAMP templates Templates includeconsiderations specificto cloudimplementations Implementationguidance in Guide toUnderstandingFedRAMP9

SAF Process Area: AssessAssessSecurity Assessment PlanTestingAssess the Security Controls NIST RMF Step 4Independent Assessors must be usedFedRAMP accredits independent assessors through the 3PAO accreditation programHighly encourage all agencies to use accredited 3PAOs for FedRAMP assessmentsUse FedRAMP SAP templateFedRAMP tailored test casesCreate unique test cases for any CSP alternative implementations10

SAF Process Area: AuthorizeAuthorizeSecurity AssessmentReportPlan of Action andMilestones (POA&M)Authorize the Information System NIST RMF Step 5 Independent Assessors provide a SAR detailing risks of the system CSP must create POA&M which determines timeline for remediation and/ormitigations of each risk identified in the SAR Authorizing official makes a risk based decision for authorization of CSP If CSP has risk posture that is acceptable, agencies will still have certain responsibilitiesfor the authorization (e.g. multi-factor authentication, access control, TIC, etc.) Two types of authorizations: JAB Provisional ATOs and Agency ATOs CSP supplied packages will NOT have an authorization, but WILL have a SAR andPOA&M11

SAF Process Area: MonitorMonitorContinuous MonitoringMonitor Security Controls NIST RMF Step 6 Risk Management Framework with cloud gets away from a “point in time” approach tosecurity authorizations 3 key steps: Operational Visibility, Change Control, and Incident Response FedRAMP Continuous Monitoring Strategy and Guide defines the process for CSPs tomeet continuous monitoring requirements through periodic reporting, making plansfor changes to the system, and how to respond appropriately to incidents that mayoccur within a CSP system once authorized12

Overview: FedRAMP SAF Standardizes RMF forCloudFedRAMPSAF ProcessDocumentAssessAuthorizeMonitorNIST SP 800-37StepFedRAMP Standard1. Categorize SystemLow and Moderate Impact Levels2. Select ControlsControl Baselines for Low and ModerateImpact Levels3. ImplementSecurity ControlsUse FedRAMP templatesImplementation Guidance in “Guide toUnderstanding FedRAMP”4. Assess the Security FedRAMP accredits 3PAOsControls3PAOs use standard process and templates5. Authorize theSystemATOs with JAB P-ATO or Agency ATOCSP Supplied packages6. ContinuousMonitoringUse Continuous Monitoring Strategy andGuide13

FedRAMP Authorization PathsJAB Provisional Authorization (P-ATO) Prioritizes authorizing cloud services that will be widely used across governmentCIOs of DoD, DHS and GSA must agree that the CSP:– Strictly meets all the controls– Presents an acceptable risk posture for use across the federal government Conveys a baseline level of likely acceptability for government-wide useCSPs must use an accredited Third Party Assessor Organization (3PAO)FedRAMP PMO manages continuous monitoring activities; agencies review resultsAgency ATO Issued by the agency onlyAgencies have varying levels of risk acceptanceAgency monitors the CSPs continuous monitoring activitiesOption to use a 3PAO or independent assessor to perform independent testingCSP Supplied Submitted directly by CSP to FedRAMPCSP without ATOCSP must use an accredited 3PAO14

Authorization Process – JAB and Agencies6 months JABP-ATOSystem Security PlanISSO ity Assessment SPAddressesJABConcerns3PAOTests &CreatesSARSAR & POA&M ReviewISSO tesPOA&MAuthorizeFinal JABReview /P-ATO SignOffQuality of documentation will determine length of timeand possible cycles throughout the entire processSystem Security PlanAgencyATOCSPImplements SecurityAssessment sts &CreatesSARSAR & POA&M esPOA&MAuthorizeFinalAgencyATO SignOff4 months 15

Authorization Progress to DateJAB Provisional Authorizations 12 cloud services approved FedRAMP authorizations cover 250 government contracts Agencies expected to update ATO memos for these servicesAgency issued ATOs 5 cloud services authorized by agenciesFedRAMP Pipeline 25 cloud services in process for JAB Provisional or AgencyAuthorization 8 cloud services awaiting kick-offFedRAMP Cost Savings 40 million in cost savings based on known FISMA reporting16

Available P-ATOs and Agency ATOsAutonomicResourcesIaaSOracleFMCSPaaSAmazonUS EastWestIaaSAmazonGovCloudIaaSAkamaiCDNIaaSAT&T StaaSIaasLockheedMartinSolaS-IIaaSHP ECS-VPCIaaSIBMPaaSCGI FederalIaaSMicrosoftGFSIaaSEconomicSystemsFHR PaaS, SaaSAINSeCaseSaaS17

June Deadline and PortfolioStatJune 2014 All CSPs used by Federal agencies need to meet FedRAMP requirements– Baseline security controls, independent assessment, use templates, makedocumentation available in the repository for leveraging Agencies must enforce FedRAMP with cloud providers via contractsPortfolioStat Reporting New questions regarding FedRAMP Agencies must rationalize lack of FedRAMP compliance Agencies must identify plans to meet FedRAMP requirementsPortfolioStat Analysis PMO reviews PortfolioStat reporting by agencies Compare with other data points Provide OMB with analysis for Agency PortfolioStat session18

FedRAMP Security Controls Baseline UpdateSecurity Controls Baseline Update– Extensive public comment period– PMO and JAB reviewsFedRAMP BaselineCategory of Changes# ControlsRevision 3 Baseline298Withdrawn by NIST from Previous FedRAMP Baseline(41)Removed by Analysis FedRAMP Baseline(8)Not Selected in Rev. 4(4)Carryover Controls245Added by NIST39Added by analysis41Revision 4 Baseline32519

NIST SP 800-53 Rev 4 Update Overview Rev. 4 Documentation Update Effort–––––15 total documents to be releasedUpdates affected 13 core FedRAMP templates and documentsCreation of 2 additional documentsApproximately 1250 pages of edits3000 hours of work to complete Major Overhauls and New Documentation– CONOPS updated to FedRAMP Security Assessment Framework– Guide to Understanding FedRAMP including new lessonslearned– Creation of test cases for 80 new controls due to NIST notupdating test cases for 800-53 Revision 420

NIST SP 800-53 Rev 4 Templates All FedRAMP Rev-4 documents andtemplate updates released on June 6,2014 PMO will follow NIST style of publiccomment period on documentation PMO will have periodic updates todocumentation available for publiccomment periods with advance noticepublished on www.fedramp.govPMO is always open to suggestions for new formats,problems with documents, or other feedback ontemplates21

NIST SP 800-53 Rev 4 Transition PlanTransition Plan– CSPs divided in to 3 categoriesTransitionTimeframesInitiationIn ProcessContinuous MonitoringMust use newrequirements forauthorizationMust update atfirst annualassessmentMust update at annualassessment – at least 6months to planDetailed Transition Plan for CSPs– Overview of controls selected for annual assessment New controls (80) Core controls ( 40) Controls selection based on risk management approachOverall level of effort:– Normal annual assessment 100-120 controls– Rev 4 transition 150 controls22

NIST SP 800-53 Rev 4 Transition Plan (continued) CSPs in the in-process and continuous monitoringstages have to update to new baseline during annualassessment– Providers must implement new controls Documentation (SSP and supporting documents)must be updated using the new templates to indicateimplementation of Rev 4 controls– Testing will be around 140/150 controls– Annual core controls– New Controls– Delta of Controls needed to be assessed due to changes to system23