Ensure Compliance with a FedRAMP-Authorized Solution For CMMC SSP Solution
%20(1).webp)
After the Community Working Group panel discussion with Pete Waterman, I had some thoughts and resources related to Pete's last question that couldn't fit in the time we had (or the Zoom chat character limit).
The CSP Question: How should we approach 20x? What strategies can we use so we don't have to build a ton of custom tools and do lots of extra work for 20x?
You’ll find great content that applies to a CSP’s approach to FedRAMP 20x in NIST 800-37 r2 focused on “Streamlining the Risk Management Framework” (RMF). Unfortunately, it’s a whopping 183 pages long.
I've sorted through the details, so you don't have to. Here I'll summarize a few key points relevant to FedRAMP 20x and provide some general suggestions .
If you have a thoughtfully designed system development life cycle (SDLC) process you are well on your way to doing the RMF and likely cover many KSIs already.
Example: CI/CD pipeline with security testing steps, Change Management process, infrastructure as code, etc.
From NIST SP 800-37 r2:
“The best RMF implementation is one that is indistinguishable from the routine SDLC processes carried out by organizations. That is, RMF tasks are closely aligned with the ongoing activities in the SDLC processes, ensuring the seamless integration of security and privacy protections into organizational systems — and taking maximum advantage of the artifacts generated by the SDLC processes to produce the necessary evidence in authorization packages to facilitate credible, risk-based decision making...” - pages 23 & 42
“to facilitate credible, risk-based decision making” — this is precisely what FedRAMP 20x is all about
20x rewards early architecture decisions.
The DevSecOps concept of “shift left” applies to GRC like it applies to your SDLC. As you make smart choices in the design and gap assessment phase you will save resources during the audit and continuous monitoring periods.
For example, we use a vulnerability scanning tool that typically runs on a VM/server, but we wanted our GovCloud environment to only use containers with no managed OS (to reduce our attack surface, complexity, and OS vulnerability management).
We designed a way to deploy the scanning tool in Kubernetes. By making that decision at the architecture design step we eliminated a lot of security compliance work later on.
From NIST SP 800-37 r2:
“Without the early integration of security and privacy requirements, significant expense may be incurred by the organization later in the life cycle to address security and privacy concerns that could have been included in the initial design. When security and privacy requirements are defined early in the SDLC and integrated with other system requirements, the resulting system has fewer deficiencies, and therefore, fewer privacy risks or security vulnerabilities that can be exploited in the future… Risk management activities begin early in the SDLC and continue throughout the life cycle.” - Pages 162, 181
One of the driving goals of FedRAMP 20x is to maximize automation so that “80%+ of requirements will have automated validation.”
If you have a small team you can lean on automation including AI and buy GRC software to supplement your limited resources.
Our 20x process and submission has involved minimal staff (we’re talking 1-2 full-time) since we leverage AI tools and built off existing GRC work done, like prior audits and existing security posture.
A bit cheesy, but for ASAP (as soon) and ASAP (as secure) as possible, you should be AAAP (as automated as possible).
From NIST SP 800-37 r2:
“Organizations should maximize the use of automation, wherever possible, to increase the speed, effectiveness, and efficiency of executing the steps in the Risk Management Framework (RMF).
Automation is particularly useful in the assessment and continuous monitoring of controls, [and] the preparation of authorization packages… Organizations have significant flexibility in deciding when, where, and how to use automation or automated support tools for their security and privacy programs.” - Pages xii, 14
An in-depth review of how to effectively automate the testing of controls is given in [NIST IR 8011v1r1 IPD Testable Controls and Security Capabilities for Continuous Monitoring Volume 1]
So you’ve done a SOC 2 Type 2 or similar audit, how does that help with FedRAMP 20x?
Ideally you can align many of the same capabilities and evidence you produced for your previous audit to the FedRAMP 20x KSIs.
Here is what NIST SP 800-37 r2 has to say:
“Maximize the use of common controls to promote standardized, consistent, and cost-effective security and privacy capability inheritance.…
Maximize the use of automated tools to manage security categorization; control selection, assessment, and monitoring; and the authorization process.” - NIST SP 800-37 r2, page 25, 44
This has been extremely successful for us at Paramify.
We use common controls (risk solutions) to maximize inheritance and maintain consistent implementations across 800-53 and 800-171 control sets (FedRAMP Rev 5, CMMC, SOC 2, and other compliance frameworks) and the 20x KSIs.
We use Paramify to manage assessment and monitoring. No need for each CSP to reinvent the wheel.
→ Request a video demo of Paramify to see how Risk Solutions can make your implementation more consistent
20x is cloud-native, so it’s already zoomed in on the bottom of the customer responsibility matrix. As such you should never “fully inherit” an entire KSI validation.
There is a part you need to configure and demonstrate for each KSI, unlike the NIST 800-53 catalog where you can fully inherit certain controls (e.g., Physical and Environmental Security) as a fully cloud-hosted offering.
Note: The NIST 800-53 “Related Controls” provided by the PMO with the initial set of KSIs fully excluded controls from the Maintenance (MA), Media Protection (MP), and Physical and Environmental Protection (PE) control families that are included in the FedRAMP Rev 5 Low Baseline (see https://www.paramify.com/blog/ksi-vs-control for a full treatment of this).
Q: If I have a partial on a KSI will I fail FedRAMP 20x?
A: The goal is an accurate, continuous risk assessment, not a perfect test score.
If your assessment is accurate and ongoing, the 20x process is working properly. Now you get to focus on the G and R of GRC instead of just worrying about compliance.
Risk-based decisions need to be made by agencies who use your cloud offering and need to be made on an ongoing basis by each CSP.
“Respond to risk based on the results of ongoing monitoring activities, risk assessments, and outstanding items in plans of action and milestones.” - NIST SP 800-37 r2, page 78, 97
It’s important to remember:
The goal is not simply to report on status but to enable risk-based decision making.
I like this from NIST IR 8011v1r1 IPD: “The objective of continuous monitoring is to respond to identified risks, not just to display results or generate reports” - NIST IR 8011v1r1 IPD, page 40, 43
FedRAMP 20x is developing rapidly. As mentioned repeatedly in the CWG panel discussion on June 25, the GitHub community discussions and official FedRAMP 20x website are essential for staying up to date with requirements and knowing how to approach 20x.
Now you understand why this couldn’t fit in the panel discussion meeting time or Zoom chat. But, I hope it’s helpful for CSPs as you consider a strategy for 20x.
I’d be happy to talk in this GitHub discussion about individual questions. Of course, this is one person’s opinion (who works for a GRC vendor) so take it with 2 tablespoons of salt.
If you’re looking for help getting FedRAMP 20x ready, the team here at Paramify would love to help.
Feel free to reach out with questions, request a video demo of our process, or sign up for a live demo below.
Sources:
.webp)
.webp)
.webp)