A FedRAMP gap analysis works best as a cross-team effort, not a project for the compliance team alone. FedRAMP is the U.S. government's security program for cloud software, and a gap analysis is a review of how far a company's product is from meeting its requirements. Because those requirements reach into how the product is built and run, the review should involve executive leadership, the security and compliance team, the engineers and product teams who build the product, the senior person who will be formally accountable for the FedRAMP application, and an outside advisor if the company uses one.
Who does what
- Executive leadership: Leaders need to commit to the effort, and how much support it gets from the top is one of the factors that decide how long certification takes.
- Security and compliance engineers: These are the people who manage the company's security risks and the rules it follows, work often called governance, risk and compliance (GRC). Every step of the work should be coordinated closely with them.
- The engineers and product teams who build the product: In the pilot program for FedRAMP 20X, the program's newer version, the most successful companies were the ones whose efforts were led by their engineering and product teams.
- An accountable official: The company's FedRAMP application must name the person responsible for it, and a senior official must sign off on the reasons for any rule the company chooses not to follow.
- An advisor, if one is used: An outside advisory firm can tailor the steps to the company's situation.
What to avoid:
FedRAMP is blunt that certification "should not be treated as a compliance exercise!" A compliance group working cut off from the engineering teams is, in FedRAMP's words, a "guaranteed way" to make certification harder.
Why in-house knowledge pays off:
Involving the people who build and run the product means FedRAMP knowledge stays inside the company. Teams that learn FedRAMP as they work can talk credibly with federal agencies, and they can sustain federal business with or without a consultant.
Sources
Related Articles
- How do I know how far my company is from FedRAMP certification?
- Where do I start with FedRAMP 20X?
- What is a FedRAMP gap analysis?
- Is a FedRAMP gap analysis the same as a 3PAO readiness assessment?
- How long does a FedRAMP gap analysis take?
- Can we run a FedRAMP gap analysis ourselves?
- What documents do we need to start a FedRAMP gap analysis?
- How do we decide which FedRAMP gaps to fix first?
- How do I show leadership how close we are to FedRAMP certification?