Mission critical cloud: Comments due for FedRAMP high

This Friday marks the end of the comment period for the Federal Risk and Authorization Management Program high baseline draft.  Expected to be adopted by the end of 2015, the requirement will enable agencies to use cloud environments for high-impact information.

The FedRAMP high baseline draft is mapped to National Institute of Standards and Technology security controls and presents a high/high/high categorization level for confidentiality, integrity and availability.

The Jan. 27 release of the FedRAMP high baseline draft came after three months of work, but it had been anticipated for much longer than that, said Matthew Goodrich, director of FedRAMP, which is part of the General Services Administration’s Office of Citizen Services and Innovative Technologies.

Currently, FedRAMP authorizes systems only at the low- and moderate-impact levels set by the Federal Information Security Management Act. But adding high-impact cloud systems is part of the FedRAMP roadmap.

The Cloud First policy “mandates that agencies take full advantage of cloud computing benefits to maximize capacity utilization, improve IT flexibility and responsiveness, and minimize cost,” according to GSA.

The draft baseline provides a process for cloud service providers to use to be able to handle sensitive data. It adds 18 new controls to those already in place via FedRAMP low and moderate and is based on NIST’s Special Publication 800-53, Revision 4, Security and Privacy Controls for Federal Information Systems and Organizations.

Specifically, the draft requirements are designed for law enforcement, health care and financial data – as long as they are not part of the National Security System (NSS) or non-classified systems.

“What you’re looking at when you look at high-impact data is largely going to be things that can deal with life-and-death situations, such as law enforcement.” Goodrich said. It also applies to health information and data that, if compromised, could spell financial ruin, he added.

The FedRAMP team did specific vetting to create the baseline through the five agencies that represent 75 percent of the market for high-impact data governmentwide, Goodrich said. Those are the Defense, Homeland Security, Health and Human Services, Justice and Veterans Affairs departments.

The draft does not specifically address the intelligence community, although it is represented in those agencies, Goodrich said, adding that intell organizations would typically have NSS or classified systems. “The IC community is not specifically a part of this focus,” Goodrich added.

“The high-impact baseline is basically taking out the elements of human error,” Goodrich said. “There’s a lot more automation, there’s a lot more involvement from the beginning.”

The process for certifying vendors at the high level would be the same as it is for the other baselines, and vendors would be reviewed using the same process of continuous monitoring. Government agencies using in-house systems would also adhere to the same requirements.

The big question at this point is whether the changes will come at the cost of performance or other tradeoffs.

That’s why the draft is open for public comment, Goodrich said.  The FedRAMP office wants to better understand any concerns the industry might have or ways they could more effectively achieve the same intensive security that we’re looking for, he added.

The FedRAMP team wants the requirements to be as standard as possible so “there’s not a constant state of flux in terms of what agencies and vendors are responsible to do,” he said. Nevertheless, if industry or agencies have issues, the FedRAMP office will “analyze them on an as-needed basis,” Goodrich said. If NIST updates its security controls, for example, that would also lead to changes in FedRAMP high, he added.

Goodrich said his office is also open to establishing other baselines if there is sufficient agency demand.

“We’re hearing a lot from providers that they’re not only willing to go to the high [baseline], but have capabilities that can meet these new demands,” Goodrich said. “It’s really helping us promote the Cloud First initiative and giving [agencies] the ability to use cloud across the entire enterprise in a way that they might not have been able to before.”

Comments on the draft are due by March 13. A second draft will be published for additional comments, including insights from FedRAMP officials.

“We can really make sure we have a full dialogue around the comments and the requirements before they become final,” Goodrich said. “The goal is to have it final by the end of the calendar year.”

Once comments are received, the FedRAMP office will  review and address the comments received. The baseline will then be released for a second round of comments in summer 2015.