FedRAMP^® Compliance Certification

What is FedRAMP?

Recognizing the benefits of cloud computing and the need to reduce federal IT expenditures, the federal government introduced the “Cloud First” policy with a primary focus for federal agencies to migrate to commercial cloud technologies where practical. With the migration to cloud services, a means for federal agencies to manage risk in the commercial cloud service provider (CSP) environments was needed. As a result, the Federal Risk and Authorization Management Program, or FedRAMP, was developed.

Through the implementation of a rigorous assessment framework, FedRAMP’s goal is to enable agencies to transition to secure and reliable cloud-based solutions. To provide cloud services to the federal government, CSPs must demonstrate compliance with the NIST 800-53 (Security and Privacy Controls for Federal Information Systems and Organizations) and FedRAMP specific security controls. Compliance assessments are performed by Third Party Assessment Organizations (3PAO) accredited by the American Association for Laboratory Accreditation (A2LA).

What is a FedRAMP assessment?

Linford & Company offers FedRAMP compliance certification (primarily known as FedRAMP authorization) services to help organizations demonstrate their compliance with cloud security controls and the requirements of the FedRAMP program. Our FedRAMP compliance assessments and certification services for Cloud Service Providers (CSP) seeking an Agency or Joint Authorization Board (JAB) Authorization to Operate (ATO) include (but are not limited to) the following:

• Pre-assessment/gap analysis of a CSP’s readiness for the FedRAMP process, to include boundary definition review, documentation review, and high-priority control implementation reviews
• Assessment planning and development of the Security Assessment Plan (SAP)
• Assessment/testing execution against the NIST 800-53 controls and FedRAMP control enhancements
• Assessment reporting and development of the final package for submission to the FedRAMP Program Management Office (PMO)/Federal Agencies (as applicable)
• Continuous monitoring of the system after achieving an ATO

The assessment of FedRAMP security controls and the associated supporting documentation, policies, and compliance procedures must be certified by an independent FedRAMP 3PAO (Third Party Assessment Organization) assessor with a background and experience with the FedRAMP controls, the assessment processes, and the ability to document compliance with the controls. Linford & Company is proud to be an accredited FedRAMP 3PAO.

What is the cost of a FedRAMP assessment?

The fees for a FedRAMP assessment vary depending on a variety of factors including the complexity of the assessed IaaS, PaaS, or SaaS platform, the number of FedRAMP authorized leveraged IaaS/PaaS providers where the service is being offered (for SaaS cloud service offerings), whether the IaaS/PaaS providers are FedRAMP authorized, and whether mobile applications are part of the scope, etc. We prioritize providing an accurate, specific, and reliable quote before beginning the audit engagement, thereby greatly reducing the risk of increasing fees later on.

Who needs a FedRAMP assessment?

Companies needing FedRAMP certification are cloud service providers that want to provide their services to the federal government. A FedRAMP compliance assessment is unique when compared to other assessment methodologies or frameworks in that they are very extensive and look across the entire spectrum of people, processes, and technology for an organization’s cloud environment. It requires hundreds of pages of detailed documentation and a continued commitment to maintaining the control environment through a rigorous continuous monitoring effort.

Being FedRAMP certified significantly expands the market for CSPs. FedRAMP compliance assessments and certifications are designed as a “do once, use multiple times” process. Once your organization obtains an Authorization to Operate (ATO) through a federal agency (or the Joint Authorization Board), this authorization can be leveraged by additional federal agencies, thus allowing your cloud service to be marketed across the wide spectrum of federal agencies.