Accomplish and Maintain Continuous FedRAMP Compliance with Carbide

The Federal Risk and Authorization Management Program (FedRAMP) was created to provide standardized security requirements, a conformity assessment program, authorization packages of cloud services, and standard contract language for cloud service providers (CSP) and cloud service offerings (CSO) that wish to provide products and services to US federal agencies.

FedRAMP is based on the NIST 800-53 controls, with additional guidance surpassing the NIST baseline, and specifically addresses the unique aspects of cloud services.

FedRAMP is governed by 4 different US government executive branch entities, the Joint Authorization Board (JAB), the Office of Management and Budget (OMB), the Chief Information Officer (CIO) Council, and the National Institute for Standards and Technology (NIST) who develop, manage, and operate it. The JAB is the main governing body for FedRAMP and includes the Department of Defense (DoD), Department of Homeland Security (DHS), and General Services Administration (GSA). The JAB can also revoke a CSP’s Provisional Authority to Operate (P-ATO), which would prevent them from working with federal agencies.

Becoming FedRAMP authorized opens you to new opportunities working in the federal government’s cloud services ecosystem. There are two pathways to achieving FedRAMP authorization. The first is path is a JAB Provisional Authorization and the second is through an Agency Authorization. The JAB selects 12 cloud service offerings (CSO) a year to work with for a JAB Provisional Authority to Operate (P-ATO).

Both paths involve 3 phases: Preparation, Authorization, and Continuous Monitoring. And the CSP, in coordination with the JAB, a 3PAO and/or their agency partner, must complete the security authorization package (SSP, SAP, SAR, and  POA&M, before they can achieve either their Provisional Authority to Operate (P-ATO) from the JAB or an Authorization to Operate (ATO) from their partner agency. Ultimately, once these are achieved the CSP’s offering can then be listed on the FedRAMP marketplace with the stamp of approval from the government. Listing in the FedRAMP marketplace makes you much more likely to get additional business from government agencies.

FedRamp applies to all cloud service providers (CSP) and cloud service offerings (CSO) that wish to provide products and services to the US government. They must demonstrate that they meet all FedRamp requirements.

Any cloud services with federal information must be FedRAMP authorized, and it is mandatory for all federal agency cloud services, regardless of their impact level.