The way to find out is a gap analysis: a side-by-side comparison of how a company's cloud product works today against everything FedRAMP will require of it. FedRAMP is the U.S. government's security program for cloud software, and federal agencies are expected to use cloud products that have passed it, which FedRAMP calls being certified. The difference between where the product is now and where it needs to be is the company's distance to certification, and the gap analysis shows exactly what has to change to close it.
Step 1: Decide which certification to aim for
FedRAMP doesn't offer a single, one-size-fits-all certification. A company first makes three choices, and together they decide which requirements apply:
- Which version of FedRAMP: FedRAMP 20X is the newer version, designed for cloud products that run on cloud platforms that are already FedRAMP certified. Rev5 is the older version, suited to products that run on infrastructure the company owns and operates itself.
- Who grants the certification: Under FedRAMP 20X, FedRAMP certifies the product directly. Under Rev5, a federal agency usually has to sponsor the certification, meaning it agrees to back the product through the process.
- Which level, or class: FedRAMP 20X has four tiers, called classes, labeled A through D. Class A asks the least of a company and Class D the most, and FedRAMP advises companies to be realistic about their readiness and warns against aiming straight for Class D.
Step 2: Compare the product against those requirements
With a target chosen, the company checks where it stands on each of the following:
- Security work it has already done: A company that completed a SOC 2 Type II audit (a widely used commercial security audit), a GovRAMP certification (a similar program for state and local governments) or a FedRAMP Rev5 certification within the past 12 months can use that work as a starting point, because it qualifies the company for FedRAMP 20X Class A.
- The specific requirements for the chosen class: Under FedRAMP 20X, these are called Key Security Indicators (KSIs): a list of security outcomes the company must show it achieves, with more of that proof required to be automated at Classes B, C and D. Under Rev5, the requirements are a set of security controls drawn from NIST SP 800-53, the federal government's catalog of security practices.
- The materials FedRAMP reviews: FedRAMP and federal agencies review a set of materials called a certification package, which describes how the product is secured. The package must reflect the product's security status as checked within the previous 7 days.
- An outside review: Classes B, C and D require a review by an independent assessor, a security firm that FedRAMP recognizes, completed within the previous 3 months.
- A public listing: Before applying, the product must be listed on the FedRAMP Marketplace, FedRAMP's public online directory of cloud products.
Step 3: Close the gaps
Once the comparison shows what's missing, the company moves into what FedRAMP calls the Implementation Phase: confirming exactly which parts of the product the certification will cover, fixing what the gap analysis found and preparing evidence. Many companies bring in an advisor, an outside firm that guides them through the process, and a good advisor will say candidly when a product isn't ready yet.
Sources
Related Articles
- Where do I start with FedRAMP 20X?
- What is a FedRAMP gap analysis?
- Is a FedRAMP gap analysis the same as a 3PAO readiness assessment?
- How long does a FedRAMP gap analysis take?
- Can we run a FedRAMP gap analysis ourselves?
- What documents do we need to start a FedRAMP gap analysis?
- Who on our team should be involved in a FedRAMP gap analysis?
- How do we decide which FedRAMP gaps to fix first?
- How do I show leadership how close we are to FedRAMP certification?