Latest / CMMC Compliance Guide / FedRAMP Authorization vs. Equivalency: What Your Business Needs to Know

Transcript

FedRAMP Authorization vs. Equivalency: What Your Business Needs to Know · CMMC Compliance Guide

• 0:42
  Stacey: Hey there, welcome to the CMMC Compliance Guide Podcast.
• 0:46
  Stacey: I'm Stacy from Justice IT Consulting, where we help businesses like yours navigate CMMC and NIST 800-171 compliance.
• 0:55
  Stacey: We're hired guns getting companies fast tracked to compliance, but today we're here to give you all those secrets for free.
• 1:02
  Stacey: So if you want to tackle it yourself, you're equipped to do so.
• 1:05
  Stacey: Let's dive into today's episode and keep your business on track.
• 1:09
  Stacey: Today we're talking FedRAMP.
• 1:11
  Stacey: If you're relying on cloud services for compliance, understanding the differences between FedRAMP authorization and equivalency is crucial.
• 1:19
  Stacey: It can impact timelines, costs, and the level of effort required during your CMMC assessment.
• 1:25
  Stacey: So, Brooke, can you tell us what is FedRAMP?
• 1:28
  Brooke: Sure.
• 1:29
  Brooke: FedRAMP is a federal risk authorization management program, FedRAMP.
• 1:35
  Brooke: So there's different levels of it, but it's basically a set of standards for cloud service providers like Microsoft, Google, Amazon, a ton of others.
• 1:48
  Brooke: It's a framework for them to uh to to for some stringent security standards for them to follow to make sure federal agency data is kept safe.
• 2:00
  Brooke: And specifically, really uh for us uh dealing with the DOD with CMMC, um it's uh it's a place where we can rest assured that uh CUI and SPD is uh CUI is controlled unclassified uh information and SPD is security protection data uh where that stuff is uh can be stored safely.
• 2:23
  Stacey: Can you tell us what the key characteristics are for FedRAMP authorization?
• 2:28
  Brooke: Uh sure.
• 2:28
  Brooke: So uh FedRAMP is uh uh FedRAMP authorization uh is really ATO and authorization to operate.
• 2:35
  Brooke: So the uh the government gives you authorization to operate and and sell your services to uh to uh federal agencies, in this case a DOD.
• 2:44
  Brooke: So this uh there's uh has to be a sponsoring agency, like the DOD in this case, uh, that sponsors you uh sponsors a company, a cloud service provider, to uh go through the FedRAMP process.
• 2:57
  Brooke: Uh uh this it's also considered a more permanent solution than FedRAMP equivalency, which is what we're kind of comparing it to, um uh because it can be reused across other agencies.
• 3:07
  Brooke: Uh once you're on the FedRAMP marketplace, you're on the FedRAMP marketplace.
• 3:11
  Brooke: There is a continuous monitoring portion of it and and other things, but you're on the it's as opposed to equivalency, you're on the uh FedRAMP marketplace and and uh you're they can basically uh shop with you.
• 3:24
  Brooke: So uh it also helps out with assessments, which uh may be the next question, I think.
• 3:30
  Stacey: Yes.
• 3:31
  Stacey: So really what we're looking for is what does the process look like for FedRAMP authorization?
• 3:38
  Stacey: What would that look like for our listeners who are seeking that?
• 3:42
  Brooke: Uh yeah, so uh really, I mean, high level the process is uh you get a there's a um sponsoring agency, in this case a DOD, uh uh that has to sponsor you to be able to go through it.
• 3:55
  Brooke: So if if there's not a federal agency that wants your product, you're just kind of out of luck.
• 3:59
  Brooke: Um but um they can uh one of them can sponsor you.
• 4:03
  Brooke: Uh you go through a Reddit's assessment, you uh engage with a C3, excuse me, uh a 3PAO, not a C three PAO.
• 4:11
  Brooke: Same concept except C three PAO is a CMMC third party assessment organization.
• 4:16
  Brooke: This is just a a third-party organiz uh assessment organization, so it's a 3PAO.
• 4:21
  Brooke: Uh they do the assessment, they generate their documents um the uh and the reports, and then uh the sponsoring agency approves you or or not.
• 4:31
  Brooke: But uh anyway, the sponsoring agency approves you after that.
• 4:35
  Stacey: Are there any advantages to FedRAMP authorization?
• 4:39
  Brooke: There are uh advantages other than being able to be uh resold across federal agencies.
• 4:44
  Brooke: That's that's of course one.
• 4:46
  Brooke: You know, you can have uh anyway, other agencies can can uh go through the process and and uh use you for their services as well.
• 4:55
  Brooke: But the one big advantage as far as CMMC goes uh is that um it uh it effectively cuts uh that may be a bad word to use, but it effectively uh lowers the amount of hours used to do the assessment uh when you compare to uh FedRamp equivalency versus uh FedRAMP authorized.
• 5:15
  Brooke: Uh so if you have authorized, you say, here's my authorization, and uh we're good to go.
• 5:20
  Brooke: So there's that's about as far as they need to check into it at that point.
• 5:24
  Brooke: That's as far as the assessor needs to check into it at that point.
• 5:27
  Stacey: Can you tell us how working with FedRAMP Authorized Services simplifies the CMMC assessment process for businesses?
• 5:36
  Brooke: Uh uh yeah, I can.
• 5:37
  Brooke: And actually I think I probably just uh spilled the beans there in the in the previous answer.
• 5:41
  Brooke: But um so yes, the uh um during a CMMC assessment, uh certification assessment, uh if you have a FedRAMP authorized service as opposed to a FedRAMP equivalent service, like I said, it's uh you um basically show them the certificate of the FedRAP authorization uh and they verify that and they're good to go.
• 6:04
  Brooke: If it's equivalency, uh then there's they have to go through the whole body of evidence.
• 6:09
  Brooke: So it's a lot there's it's a lot quicker there.
• 6:11
  Stacey: You had mentioned FedRAMP equivalency a couple of times.
• 6:14
  Stacey: Could you go into the key characteristics of FedRAMP equivalency?
• 6:19
  Brooke: Sure.
• 6:19
  Brooke: Uh so FedRAMP equivalency uh is uh it's basically it's a snapshot of of a cloud service provider being uh FedRamp equivalent.
• 6:31
  Brooke: So um, but that's not they don't go through the same process and and it's still rigorous.
• 6:38
  Brooke: And the way the uh DOD defines it um as FedRAMP uh uh uh official, I guess, FedRAMP equivalency, um, then uh they have to go through the same process using a uh 3PAO, uh, and they have to come in and assess the organization, they have to still generate the documents, uh, but they don't go through the rest of the process of the DOD then going through all that, reviewing everything and then approving it.
• 7:05
  Brooke: Um but you get those documents, uh, you get um uh you get your way, you get that equivalency, and then you can use that equivalency.
• 7:14
  Brooke: However, in the CMMC process, uh you still uh the as I mentioned a while ago, the assessors still have to go through all of that documentation of the body of evidence uh and customer responsibility matrix and all that, of course, but uh to uh verify that product uh that cloud service offering is still still valid, still equivalent.
• 7:35
  Stacey: Is there a specific process that our listeners need to be aware of when it comes to FedRAMP equivalency?
• 7:42
  Brooke: Process I kind of went over, but the um um uh through PAO uh has to do their uh due diligence and and make sure that uh you cover all uh controls uh and that there's no POAM uh items.
• 7:57
  Brooke: Uh but they have to generate their security assessment plan, security assessment report, um, and uh all that is very time intensive uh with a through PAO.
• 8:06
  Brooke: Uh so neither the authorization process or the uh equivalency process is is cheap or easy, I can tell you that.
• 8:14
  Brooke: But uh but yes, there's uh they start with that through PAO and go through that process and generate the security assessment plan and security uh security assessment report.
• 8:26
  Stacey: Are there any challenges when it comes to Fed ramp equivalency?
• 8:31
  Brooke: Uh yes, as far as uh CMMC goes, again, uh I've already said this, uh, but I'll say it again as we're saying with equivalency.
• 8:40
  Brooke: Um uh each time uh uh well uh when you're assessed, uh when you uh get a certification assessment, the assessor has to go through the body of evidence and has to go through all that in the security assessment report, uh security assessment plan and and their body of evidence and and uh figure out uh uh if they're still uh FedRAMP equivalent or not.
• 9:04
  Brooke: They have to go through all that as opposed to the um FedRAMP authorization where you say, here's my authorization, here's the authorization right here, and they say, Okay, but that that uh cloud service offering is good.
• 9:16
  Stacey: Is there anything else businesses should keep in mind when it comes to using FedRAMP equivalent services during their CMMC assessment?
• 9:24
  Brooke: Uh yeah, really it's uh it's just the the time involved uh in uh using a FedRAP when you use FedRAMP equivalency uh cloud service offering, uh, then the time involved in doing the assessment is gonna be greater than uh one where there's not a uh uh where where it's uh FedRAP authorized.
• 9:45
  Stacey: You've mentioned now FedRAMP authorization and equivalency.
• 9:49
  Stacey: Can you give us the key characteristic differences of FedRAMP authorization versus equivalency?
• 9:56
  Brooke: Uh yeah, sure.
• 9:57
  Brooke: So uh so FedRAMP authorization uh is a uh is a more permanent solution.
• 10:04
  Brooke: Uh it requires a sponsoring agency, uh, and you're you're basically you're good after that.
• 10:10
  Brooke: There's other things that go into it.
• 10:11
  Brooke: It's a very high level, but uh you're good after that.
• 10:14
  Brooke: And equivalency uh is like I said, is a point-in-time um a point-in-time assessment, and it requires a lot more time on this, on the uh assessor's part to uh review the uh FedRAMP equivalent service, uh cloud service offering that you may be using.
• 10:32
  Stacey: Are there any significant impacts on businesses that do get certified?
• 10:36
  Brooke: The FedRAMP authorized again, really just uh uh it's gonna take less time, uh, FedRAMP equivalency, um uh whatever cloud service offerings you may have, and if you have two or three that are equivalent and not just one, uh, you know, it's gonna take more time to go through those and uh and and assess those for the assessor.
• 10:57
  Brooke: So that means uh more time, more money for you, uh, and the assessor, of course.
• 11:02
  Brooke: Um and you know, you can always run into uh getting getting the uh body of evidence and getting all the documentation, you've got to do that well in advance because uh it is not it's not always very easy to get that from the vendor.
• 11:19
  Brooke: Um if you're getting it from Microsoft, uh you can get it.
• 11:23
  Brooke: Uh it very well may not be very quick at all.
• 11:26
  Brooke: But uh so uh yeah, there's that.
• 11:29
  Brooke: There's uh time everywhere with equivalency.
• 11:32
  Brooke: And uh with FedRamp uh authorized, it's just a whole lot easier.
• 11:37
  Stacey: When should you use FedRamp Authorized versus FedRamp equivalent services?
• 11:44
  Brooke: Well, uh really as far as uh when you should use one over the other, I would say uh you should, if at all possible, you should use uh FedRamp authorized services.
• 11:56
  Brooke: Um they they'll make your life a whole lot easier.
• 11:59
  Brooke: Um and there's less documentation to have to uh keep track of uh and gather from the vendors.
• 12:07
  Brooke: Um federal app equivalency, if you just can't find what is in your uh budget or um uh what quite fits your needs in uh Federal in the FedApp marketplace, uh what's authorized for the DOD, um, then uh you can go FederApp equivalency, but you just gotta keep in mind that you're gonna need that documentation.
• 12:27
  Brooke: Uh and that, like I said, uh it could it could be the tenth of never when you get that, or the tenth of uh almost never maybe when you get that documentation from companies like Microsoft.
• 12:38
  Brooke: Um or you know, the I guess it's possible the assessor may want, you know, uh more paperwork than was provided.
• 12:47
  Brooke: Uh but it's you know, FedRAMP equivalency can be used and can be done.
• 12:52
  Brooke: Um but it's uh but there's it's a lot more time intensive.
• 12:56
  Brooke: So if you can, it's it's always best to use FedRAMP authorized.
• 13:00
  Stacey: What should companies do to plan ahead when it comes to choosing FedRAMP authorized versus equivalent services?
• 13:09
  Brooke: Uh well, so uh really just uh engage that CSP early.
• 13:13
  Brooke: Uh figure out if they're FedRAMP authorized or FedRA FedRAMP, I can't speak today, uh FedRAMP equivalent.
• 13:19
  Brooke: Um if they're neither, it's a no-go if it's uh C UR or SPD.
• 13:24
  Brooke: Uh figure out figure out if they're either authorized or equivalent.
• 13:28
  Brooke: Uh and then if they're equivalent, um some you'll uh either have to sign a NDA, or you probably have to sign NDA.
• 13:36
  Brooke: Um, but uh it'll be a process to get that paper paperwork because they don't just want to turn it over to anybody.
• 13:43
  Brooke: Uh so going through that FedRamp equivalency, uh a company that's used that's FedRamp equivalent, um you just gotta start early and make sure you have that paperwork as as soon as possible.
• 13:54
  Stacey: Well, that wraps up our episode on FedRamp Authorization and FedRAMP equivalency.
• 14:00
  Stacey: If you have any questions about what we cover today, please feel free to reach out to us.
• 14:05
  Stacey: We're here to help and fast track your compliance journey.
• 14:08
  Stacey: So please, please, please text, email, or call in your questions.
• 14:12
  Stacey: We will answer them for free here on the podcast.
• 14:15
  Stacey: You can find our contact information at cmccomplianceguide.com.
• 14:19
  Stacey: Stay tuned for our next episode.
• 14:21
  Stacey: Until then, stay compliant and stay secure.