recommended reading

GSA Has a New Plan for Cloud Providers Navigating Changing Security Standards

Maksim Kabakou/Shutterstock.com

The General Services Administration released a transition plan on Tuesday that provides guidance to cloud computing service providers that will have to adhere to new baseline security standards slated for release in June.

The transition plan will govern how CSPs adhere to upcoming changes to the Federal Risk and Authorization Management Program, or FedRAMP, based on the fourth revision of the National Institute of Standards and Technology’s Special Publication 800-53.

The plan provides specific guidance to CSPs at varying stages.

CSPs in the early “initiation” phase will have to implement new baseline standards and test SP 800-53 Rev. 4 controls before receiving authorization. Those in the FedRAMP pipeline before June 1 will be assessed against current FedRAMP baseline standards – based on NIST’s SP 800-53 Rev. 3 – but will have one year from the authorization date to implement the new baseline, submit new documents using updated templates and test their controls against new Rev. 4 controls.

Similarly, CSPs with FedRAMP-accredited solutions with an annual continuous monitoring assessment completed prior to June 1 will have “one year from the date of their last assessment” to implement the new baseline and complete testing. CSPs with an annual assessment scheduled between June 1, 2014 and Jan. 1, 2015, must implement the new baseline and complete testing in 2015.

“This is a matter of communicating with providers, being transparent and letting people know what we’re doing,” FedRAMP Director Maria Roat said.

GSA’s FedRAMP team has been touting the coming updates for some time as it partnered with technical teams at the Homeland Security and Defense departments and the Defense Information Systems Agency. Roat said GSA is in the process of wrapping up test cases for the new controls right now, after which the FedRAMP Program Management Office will publish the new FedRAMP security control baseline and accompanying templates.

According to the transition document, the new FedRAMP security baseline will be a substantial upgrade from its prior implementation, signifying a more rigid approach to the government’s cloud security and risk posture.

“The FedRAMP Program Management Office anticipates that the level of effort will require testing between 140 to 150 controls,” the document stated. “There are approximately 72 new Rev. 4 controls and 70 core controls for annual testing.  The FedRAMP PMO will prioritize and adjust the number of controls required for testing based on the CSPs risk posture.”

(Image via Maksim Kabakou/Shutterstock.com)

Threatwatch Alert

Thousands of cyber attacks occur each day

See the latest threats

JOIN THE DISCUSSION

Close [ x ] More from Nextgov
 
 

Thank you for subscribing to newsletters from Nextgov.com.
We think these reports might interest you:

  • Modernizing IT for Mission Success

    Surveying Federal and Defense Leaders on Priorities and Challenges at the Tactical Edge

    Download
  • Communicating Innovation in Federal Government

    Federal Government spending on ‘obsolete technology’ continues to increase. Supporting the twin pillars of improved digital service delivery for citizens on the one hand, and the increasingly optimized and flexible working practices for federal employees on the other, are neither easy nor inexpensive tasks. This whitepaper explores how federal agencies can leverage the value of existing agency technology assets while offering IT leaders the ability to implement the kind of employee productivity, citizen service improvements and security demanded by federal oversight.

    Download
  • Effective Ransomware Response

    This whitepaper provides an overview and understanding of ransomware and how to successfully combat it.

    Download
  • Forecasting Cloud's Future

    Conversations with Federal, State, and Local Technology Leaders on Cloud-Driven Digital Transformation

    Download
  • IT Transformation Trends: Flash Storage as a Strategic IT Asset

    MIT Technology Review: Flash Storage As a Strategic IT Asset For the first time in decades, IT leaders now consider all-flash storage as a strategic IT asset. IT has become a new operating model that enables self-service with high performance, density and resiliency. It also offers the self-service agility of the public cloud combined with the security, performance, and cost-effectiveness of a private cloud. Download this MIT Technology Review paper to learn more about how all-flash storage is transforming the data center.

    Download

When you download a report, your information may be shared with the underwriters of that document.