5 lessons learned from the FedRAMP process
Connecting state and local government leaders
Advice for those starting down the long and difficult road toward cloud authorization by the Federal Risk and Authorization Management Program.
The Federal Risk and Authorization Management Program, for good reasons, set a high bar for certifications. Developing a cloud solution to be authorized by FedRAMP is, therefore, a non-trivial pursuit. During the past year my firm has been immersed in the successful pursuit of FedRAMP authorizations for four distinct cloud offerings, and my colleagues and I have learned a lot about the process and its importance for government IT. Here are five of the most important lessons we have learned along the way.
1. Get the whole village engaged.
Unfortunately, the notion of streamlining the FedRAMP authorization process by handing it over to the security team is just not feasible. Particularly as the process evolves, it is essential to engage a large part of an organization in the pursuit of, and adherence to, FedRAMP. This large pool of talent shouldn’t be limited to developers, IT staff and highly technical types. Every employee in the organization will play a part in the initiative. HR, for example, may train new employees as they onboard. Service teams will educate both new and veteran clients to make sure best practices are in place, and sales people will need to field questions from customers.
2. Get organized. Very, very organized.
Unless your organization is one of those rare cloud companies whose employees wonder how to fill their days, the FedRAMP certification process will give already-busy employees much more to do. To avoid a significant strain to the organization, consider deploying a ticket system to ensure that every step is documented and clear. There will likely be too much to do in the allotted time, so providing clarity on priorities will be invaluable to employees. Spending as much time as possible up front ensuring that stakeholders are aligned with priorities will ultimately save a lot of time and effort for everyone.
3. Embrace the change.
As is often true with organizational change, managers may encounter some resistance to the necessary changes teams must adopt in the pursuit of FedRAMP authorization. To eliminate any tension, managers should create and foster a culture that sees these changes as a positive. This approach will ultimately yield two benefits: first, your employees will feel good about being part of the process and, second, the positive attitude will be far more motivating for employees who are encountering additional strain on an already heavy workload.
4. Get help.
Prior to beginning the FedRAMP certification process, we had been through dozens of similar processes with federal agencies. We had also achieved ISO 27001 certification (Europe’s standard for information security management systems). So we came at the FedRAMP project with an inflated sense of confidence. Even though the FedRAMP requirements are detailed and thorough, there are a surprising number of judgment calls about how to comply. Also, by now you should have a sense that FedRAMP will ask a lot from your organization. For these reasons, consider hiring a security consultancy that is experienced in FedRAMP -- it will provide a real return on investment.
5. Educate your federal customers.
As more providers receive FedRAMP authorization, knowledge of the standards will improve. Today, however, few agencies have staff members (beyond the security team) who have a solid understanding of FedRAMP, what it means and, most important, their department’s obligations when using a cloud provider. As you near the awarding of the provisional authority to operate, be sure to plan for an education campaign that informs your customers of the changes and new regulations before they encounter them on their own. Think of it like a product launch -- succinctly explain the features and benefits for your audience.
6. This one’s free.
No doubt you will celebrate the day you receive your provisional FedRAMP ATO, and for good reason. The journey may take more than two years to complete. Have fun and enjoy the accomplishment, but make sure (in the months leading up to the award) the entire organization understands that the FedRAMP award is the beginning, not the end. Maintaining your accreditation will take time and effort. As a team member said, “The party was fun, but I better go and start the scanners.” Happiness is about having realistic expectations, so start setting them.
The FedRAMP process can seem daunting and will, without a doubt, put new stresses on your staff. It’s important to remember that FedRAMP compliance will really make your cloud solution safer, more secure and more resilient. This achievement isn’t just a credential, it’s an accomplishment.