FedRAMP steps toward automated authorization
Connecting state and local government leaders
The Federal Risk and Authorization Management Program announced draft guidance to help stakeholders document their system security plans in machine-readable language.
Taking steps to fulfill a pledge to streamline the authorization of cloud services, the Federal Risk and Authorization Management Program announced it had drafted FedRAMP-specific guidance to ensure stakeholders can fully express their system security plans in machine-readable language, paving the way to automation.
Developed by the National Institute of Standards and Technology, the Open Security Controls Assessment Language is a common machine-readable language that will lay the foundation for future automation efforts. Described as a kind of security Rosetta stone, OSCAL features a set of formats that will allow tools to speak the same language so data in control catalogs, baselines and security and assessment plans can be easily transferred to support multiple regulatory frameworks.
OSCAL will offer a number of advantages, according to a Dec. 17 FedRAMP blog.
- Agencies will be able to expedite their reviews of the FedRAMP security authorization packages.
- The FedRAMP Program Management Office expects to be able to build tools to further cut the cost and improve the quality of security reviews.
- Cloud service providers will be able to automate the documentation of security and privacy control implementation for their system security plans.
- Third-party assessors will be able to automate activities related to planning, execution and reporting of cloud assessments.
Additionally, a number of FedRAMP baselines, catalogs, profiles and templates are available in XML, JSON and YAML formats, as are tools to convert content between formats and guidance for developers generating OSCAL-compliant FedRAMP content.
"The automation enabled by the OSCAL formats will reduce complexity, decrease implementation costs, and enable the simultaneous, continuous assessment of a system’s security against multiple sets of requirements. Additionally, paperwork will be significantly reduced," according to NIST's OSCAL website.
Both FedRAMP and NIST are looking for comments on the current OSCAL catalog, profile and system security plan models. NIST is also seeking tool developers and vendors that would like to implement the models in commercial and open source offerings as well as software and service providers to help represent control implementation information about their products.