What documents do we need to start a FedRAMP gap analysis?

A gap analysis can start with documents most cloud companies already have: records of how their systems are set up and how data moves through them, a list of the outside services they rely on, an explanation of how they use encryption, their security policies, and any recent SOC 2 Type II report, a widely used commercial security audit. A FedRAMP gap analysis is a review of how far a company's product is from meeting the requirements of FedRAMP, the U.S. government's security program for cloud software, and these documents describe the starting point that the requirements are measured against.

The most useful inputs:

These documents line up with what FedRAMP will eventually ask for. The main summary document in a FedRAMP application, called the Certification Package Overview, asks for information about the product's systems, how information flows through them, the outside services it uses, its use of encryption and its relevant policies, so existing records on those topics are the best starting material. Companies aiming for Class A, the entry-level of FedRAMP's four certification tiers, also supply evidence from security work they have already done, such as a full SOC 2 Type II report and, if one applies, a bridge letter covering the time between the end of the audit period and the present. Gap analysis software can put these documents to work: NYLE Gap Analysis reads SOC 2 reports, policies and architecture documents to pre-fill answers, and uploads are analyzed in memory and never stored.

What the documents are measured against:

Under FedRAMP 20X, the program's newer version, the requirements are grouped into three sets of rules: Boundary rules, which define which systems are covered and how the product's data is shared; Assurance rules, which cover how the company keeps proving its security over time; and Package rules, which cover what it submits. On top of these sit the Key Security Indicators (KSIs), measurable security outcomes that show the product's protections work in practice. The official, machine-readable version of all these rules is published on FedRAMP's GitHub page, and FedRAMP's Definitions page sets the meaning of key terms.

What a FedRAMP 20X certification package contains:

The certification package is the set of materials FedRAMP and federal agencies review to decide whether to trust a product, and under FedRAMP 20X it has three parts: