Complete FedRAMP Advisory
PLAN |
Assess the current status of the RedRAMP program and control capabilities, identify all material gaps in the system boundary and provide a roadmap for moving forward |
Buyer Requirements
- Seeking a FedRAMP advisory with proven effectiveness in achieving P-ATO, Agency ATO, and FedRAMP Tailored authorizations
- Generally familiar with FedRAMP and are committed to achieving FedRAMP authorization
- More…
Prepare - Plan
Buyer Requirements
- Seeking a FedRAMP advisory with proven effectiveness in achieving P-ATO, Agency ATO, and FedRAMP Tailored authorizations
- Generally familiar with FedRAMP and are committed to achieving FedRAMP authorization
- Will be ready within 3-4 week to begin addressing gaps (either through internal teams or with an advisor)
- Uncertain if FedRAMP is even appropriate and need a cost estimate? Buy our Quick-Assess service.
Objective
- Assess the current status of the FedRAMP program and control capabilities, identify all material gaps in the system boundary and provide a roadmap for moving forward
Deliverables
- Issues with the proposed system boundary and out-of-boundary services
- Rating of alignment with respect to FedRAMP CSFs
- Rating of achievement of key security capabilities
- Listing of control gaps related to key security capabilities
- Rating of overall “readiness” status
- High-level roadmap for moving forward
- Slides for management briefing
- Boundary gaps (including use of non-FedRAMPed external and corporate services)
- Control gaps for all in-scope controls with suggested remediation actions
- Control implementation descriptions (for SSP) for controls that are currently implemented
Prepare - Document
Buyer Requirements
- Already know their gaps (e.g., “what” is missing) but need help figuring out the best solutions (e.g., “how” to address the requirements)
- Need a SME resource available for “as needed” consultation
- Need help implementing controls or preparing required documentation
- Seeking an advisor who is experienced in leveraging the advantages of using pre-authorized platforms and services
Objective:
- Guide and support IT engineering efforts to remediate FedRAMP gaps and prepare a complete FedRAMP documentation package that meets all PMO, Agency and 3PAO requirements
Deliverables:
- Detailed control implementation descriptions (for SSP) for controls that are newly implemented
- Complete FedRAMP package ready for review by AO and 3PAO assessor
- System Security Plan (system components and boundaries, data flow, system interconnections, and control implementations)
- Configuration Management Plan, Incident Response Plan, Contingency Plan, and other required attachments
- Initial POA&M
- Policies and Procedures
- Continuous Monitoring Plan
Details
- Provide real-time direction and guidance during the remediation engineering phase as new controls and toolsets are implemented
- Provide input and direction as questions arise while new tools and processes are deployed
- Collaborate with the engineering team as needed to ensure that FedRAMP control requirements are addressed
- Validate adequacy of technical implementations of new/fixed controls
- Leverage existing documentation and interview personnel for required information, and create a complete CSP documentation package for FedRAMP
- Evaluate all available documentation to determine what can be leveraged for FedRAMP
- Review existing “plans” (contingency, incident response, config mgmt., etc.) to determine what can be leveraged
- Document or revise SSP and required attachments (including “plans”)
- Collaborate with client personnel to ensure system diagrams and data flows for the SSP are correct
- Modify control implementation statements as needed to correctly describe controls and reflect all remediation activities
- Document initial POA&M for control gaps and vulnerabilities
- Create continuous monitoring plan
- Optional: Provide hands-on implementation of tools and security engineering