More than two and a half years into the Federal Risk Authorization and Management Program (FedRAMP), program managers are calling the initiative a success but looking forward toward significant improvements.<\/p>\n\n\n\n
The office put together a roadmap for the next two years and released the document \u2014 “FedRAMP Forward” \u2014 on Wednesday.<\/p>\n\n\n\n
The roadmap (see the full timetable below) includes a number of key initiatives centered on increasing awareness of the program’s core components, improving efficiencies in authorizations and implementation and continuing to adapt to the ever-changing world of cyber.<\/p>\n\n\n\n
RELATED<\/i><\/p>\n\n\n\n
FedRAMP updated to comply with NIST guidelines<\/i><\/p>\n\n\n\n
FedRAMP OnRAMP eases cloud compliance<\/i><\/p>\n\n\n\n
Cloud to get original SIN on IT Schedule 70<\/i><\/p>\n\n\n\n
Learning from the last 30 months, the program office is planning to start \u2014 or restart \u2014 a number of initiatives, including relaunching FedRAMP.gov as a central repository for information and updates, creating a high baseline for sensitive data and developing security overlays to give agencies a singular view of compliance with the various requirements mandated by federal law.<\/p>\n\n\n\n
But the most significant change moving forward is geared toward lowering costs while simultaneously speeding up the authorization process.<\/p>\n\n\n\n
The roadmap points out that each authorization costs the government approximately $250,000 and takes between six and 10 months to complete.<\/p>\n\n\n\n
“A framework by which agencies can reuse these authorizations is critical,” the report reads. “FedRAMP’s ‘do once, use many times’ framework creates a multiplier effect of cost savings for agencies using the same cloud environments.”<\/p>\n\n\n\n
Program managers are looking to give a wider, enterprise scope to the authorization process, including within agencies and across government. To achieve this, managers will be setting up inter-agency working groups to identify service providers and products that are used in multiple areas.<\/p>\n\n\n\n
“The first thing we always hear from agencies is, ‘Why should I do it first because then everyone else is getting it for free,'” FedRAMP Director Matthew Goodrich said. “So we want to make sure we’re showing the benefits of FedRAMP across the government. If you do one, another agency does one, you’re all going to benefit in the end. The entirety of government is going to save in the end.”<\/p>\n\n\n\n
For example, a single agency might need to approve several cloud providers for various services. The time and cost for doing all of these would be prohibitive.<\/p>\n\n\n\n
At the same time, other agencies with similar needs might be working on the same issue and finding the time and cost commitments equally daunting.<\/p>\n\n\n\n
Rather than operating separately, well-crafted working groups would be able to divide the work among several agencies, saving time and money without sacrificing rigor.<\/p>\n\n\n\n
“The intent is for agencies to assume the bulk of responsibility for authorizing the cloud providers they use,” said Kathy Conrad, acting associate administrator for the Office of Citizen Services and Innovative Technologies.<\/p>\n\n\n\n
The Joint Authorization Board (JAB) would still be the main authorizers for “those that have very high use across government and where it is more appropriate for the JAB to take that government-wide view,” Conrad said.<\/p>\n\n\n\n
Per the schedule, the working groups are expected to launch within 12 months.<\/p>\n\n\n\n
Timeline of initiatives over next two years:<\/p>\n\n\n\n
6 Months<\/b><\/p>\n\n\n\n
\u25a0 Baseline FedRAMP use across federal government with various data points including PortfolioStat and FISMA reporting<\/p>\n\n\n\n
\u25a0 Provide practical implementation guidance for agency ATOs for initiating assessments and authorizations, reuse of ATOs and implementing solutions within an ATO cloud service<\/p>\n\n\n\n
\u25a0 Publish draft multi-agency authorization methodology following FedRAMP Security Assessment Framework (SAF)<\/p>\n\n\n\n
\u25a0 Develop and launch online FedRAMP training program<\/p>\n\n\n\n
\u25a0 Relaunch FedRAMP.gov to improve user experience and usability<\/p>\n\n\n\n
\u25a0 Publish agency procurement guidance in collaboration with OMB and OFPP<\/p>\n\n\n\n
\u25a0 Publish guidelines for third-party assessment organizations (3PAOs) to address inconsistencies for security assessment activities, artifacts and methodologies<\/p>\n\n\n\n
\u25a0 Identify existing workflow tools, control automation and document automation capabilities<\/p>\n\n\n\n
\u25a0 Publish draft requirements for reuse of external industry compliance evidence for assessment, authorization and continuous monitoring<\/p>\n\n\n\n
\u25a0 Publish roadmap for evolution of continuous monitoring to include ongoing authorizations, near real time risk analysis and greater emphasis on risk management<\/p>\n\n\n\n
\u25a0 Publish guidelines with key indicators for authorizing officials to effectively perform risk analysis and more readily identify and respond to changes in risk posture of systems with existing authorizations<\/p>\n\n\n\n
\u25a0 Publish draft high baseline for public comment<\/p>\n\n\n\n
\u25a0 Develop framework for FedRAMP assessment overlay for compliance with relevant IT policies<\/p>\n\n\n\n
\u25a0 Publish draft initial FedRAMP assessment overlay with one to two IT policies<\/p>\n\n\n\n
12 Months<\/b><\/p>\n\n\n\n
\u25a0 Normalize agency reported data and enhance guidance on agency reporting of FedRAMP and cloud statistics through PortfolioStat<\/p>\n\n\n\n
\u25a0 Document agency success stories for FedRAMP, establishing a best practice reference guide<\/p>\n\n\n\n
\u25a0 Identify and launch working groups for multi-agency authorizations<\/p>\n\n\n\n
\u25a0 Publish draft multi-agency continuous monitoring methodology following FedRAMP SAF<\/p>\n\n\n\n
\u25a0 Develop FedRAMP training module for agency procurement officials<\/p>\n\n\n\n
\u25a0 Develop FedRAMP 3PAO training module in concert with FedRAMP Accreditation Board<\/p>\n\n\n\n
\u25a0 Update 3PAO requirements to ensure consistency for security assessment activities, artifacts and methodologies<\/p>\n\n\n\n
\u25a0 Conduct Industry Day on tools and processes for automation of CSP documentation and assessment and continuous monitoring evidence<\/p>\n\n\n\n
\u25a0 Identify and map one external industry compliance framework for reuse of evidence for assessment, authorization and continuous monitoring<\/p>\n\n\n\n
\u25a0 Publish guidelines and requirements for automating and correlating continuous monitoring data across agency and JAB authorized systems<\/p>\n\n\n\n
\u25a0 Finalize high watermark baseline<\/p>\n\n\n\n
\u25a0 Conduct concurrent assessments of FedRAMP and additional IT policies<\/p>\n\n\n\n
18 Months<\/b><\/p>\n\n\n\n
\u25a0 Identify procurement options for agencies to obtain FedRAMP implementation support<\/p>\n\n\n\n
\u25a0 Publish report documenting current status of FedRAMP metrics and statistics<\/p>\n\n\n\n
\u25a0 Develop targeted FedRAMP training module for agency program managers<\/p>\n\n\n\n
\u25a0 Publish draft requirements for automation of FedRAMP documentation<\/p>\n\n\n\n
\u25a0 Complete pilot assessment of one CSP reusing evidence form external compliance framework<\/p>\n\n\n\n
\u25a0 Automate and correlate continuous monitoring data across two agency and two JAB authorizations<\/p>\n\n\n\n
\u25a0 Identify need for additional agency baseline requirements<\/p>\n\n\n\n
\u25a0 Finalize FedRAMP assessment overlay framework<\/p>\n\n\n\n
\u25a0 Publish formal guidance methodology for assessment overlay IT mandates<\/p>\n\n\n\n
24 Months<\/b><\/p>\n\n\n\n
\u25a0 Transition of continuous monitoring from JAB to multi-agency model for JAP P-ATOs that do not reach or achieve government-wide use<\/p>\n\n\n\n
\u25a0 Continued updates to reference and guidance documents<\/p>\n\n\n\n
\u25a0 Finalize automation requirements for FedRAMP documentation<\/p>\n\n\n\n
\u25a0 Publish additional mappings of external industry compliance framework for evidence reuse<\/p>\n\n\n\n
\u25a0 Automate and correlate continuous monitoring and incident reporting data across all JAB and participating agency FedRAMP authorizations<\/p>\n\n\n\n
\u25a0 Publish draft flexible baseline based on identified agency needs<\/p>\n\n\n\n
\u25a0 Develop two additional FedRAMP assessment overlays for compliance with additional IT initiatives<\/p>\n","protected":false},"excerpt":{"rendered":"
Timeline lays out improvements to be phased in over next 24 months.<\/p>\n","protected":false},"author":7,"featured_media":67853,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_yoast_wpseo_meta-robots-noindex":"","_yoast_wpseo_meta-robots-nofollow":"","_yoast_wpseo_canonical":"","_acf":"","_yoast_wpseo_primary_category":15,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","_smg_distribution_targets":[]},"categories":[63,15,14],"tags":[],"coauthors":[2349],"class_list":["post-22079","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cloud","category-management","category-it-networks"],"acf":{"subheadline":"","legacy_arc_id":"LSU2IVNVINDK7NIYWDP5NCZB3I","arc_canonical_url":"\/management\/2014\/12\/17\/fedramp-forward-plans-next-two-years-of-cloud-authorization\/","remove_feature_photo":false,"is_sponsored":false,"subtype":"","redirect_url":"","disable_inline_ads":false,"native_logo_pretext":"Presented By:"},"yoast_head":"\n