recommended reading

GSA Has a New Plan for Cloud Providers Navigating Changing Security Standards

Maksim Kabakou/Shutterstock.com

The General Services Administration released a transition plan on Tuesday that provides guidance to cloud computing service providers that will have to adhere to new baseline security standards slated for release in June.

The transition plan will govern how CSPs adhere to upcoming changes to the Federal Risk and Authorization Management Program, or FedRAMP, based on the fourth revision of the National Institute of Standards and Technology’s Special Publication 800-53.

The plan provides specific guidance to CSPs at varying stages.

CSPs in the early “initiation” phase will have to implement new baseline standards and test SP 800-53 Rev. 4 controls before receiving authorization. Those in the FedRAMP pipeline before June 1 will be assessed against current FedRAMP baseline standards – based on NIST’s SP 800-53 Rev. 3 – but will have one year from the authorization date to implement the new baseline, submit new documents using updated templates and test their controls against new Rev. 4 controls.

Similarly, CSPs with FedRAMP-accredited solutions with an annual continuous monitoring assessment completed prior to June 1 will have “one year from the date of their last assessment” to implement the new baseline and complete testing. CSPs with an annual assessment scheduled between June 1, 2014 and Jan. 1, 2015, must implement the new baseline and complete testing in 2015.

“This is a matter of communicating with providers, being transparent and letting people know what we’re doing,” FedRAMP Director Maria Roat said.

GSA’s FedRAMP team has been touting the coming updates for some time as it partnered with technical teams at the Homeland Security and Defense departments and the Defense Information Systems Agency. Roat said GSA is in the process of wrapping up test cases for the new controls right now, after which the FedRAMP Program Management Office will publish the new FedRAMP security control baseline and accompanying templates.

According to the transition document, the new FedRAMP security baseline will be a substantial upgrade from its prior implementation, signifying a more rigid approach to the government’s cloud security and risk posture.

“The FedRAMP Program Management Office anticipates that the level of effort will require testing between 140 to 150 controls,” the document stated. “There are approximately 72 new Rev. 4 controls and 70 core controls for annual testing.  The FedRAMP PMO will prioritize and adjust the number of controls required for testing based on the CSPs risk posture.”

(Image via Maksim Kabakou/Shutterstock.com)

Threatwatch Alert

Thousands of cyber attacks occur each day

See the latest threats

JOIN THE DISCUSSION

Close [ x ] More from Nextgov
 
 

Thank you for subscribing to newsletters from Nextgov.com.
We think these reports might interest you:

  • Featured Content from RSA Conference: Dissed by NIST

    Learn more about the latest draft of the U.S. National Institute of Standards and Technology guidance document on authentication and lifecycle management.

    Download
  • PIV- I And Multifactor Authentication: The Best Defense for Federal Government Contractors

    This white paper explores NIST SP 800-171 and why compliance is critical to federal government contractors, especially those that work with the Department of Defense, as well as how leveraging PIV-I credentialing with multifactor authentication can be used as a defense against cyberattacks

    Download
  • Toward A More Innovative Government

    This research study aims to understand how state and local leaders regard their agency’s innovation efforts and what they are doing to overcome the challenges they face in successfully implementing these efforts.

    Download
  • From Volume to Value: UK’s NHS Digital Provides U.S. Healthcare Agencies A Roadmap For Value-Based Payment Models

    The U.S. healthcare industry is rapidly moving away from traditional fee-for-service models and towards value-based purchasing that reimburses physicians for quality of care in place of frequency of care.

    Download
  • GBC Flash Poll: Is Your Agency Safe?

    Federal leaders weigh in on the state of information security

    Download
  • Data-Centric Security vs. Database-Level Security

    Database-level encryption had its origins in the 1990s and early 2000s in response to very basic risks which largely revolved around the theft of servers, backup tapes and other physical-layer assets. As noted in Verizon’s 2014, Data Breach Investigations Report (DBIR)1, threats today are far more advanced and dangerous.

    Download

When you download a report, your information may be shared with the underwriters of that document.