shawndwells
commented
4 years ago
- RFI and RFP Challenges
There are agencies providing RFI or RFP with requirements that a solution's provider must be able to achieve a FedRAMP ATO when the contract is signed or sponsor only close to ATO. Demonstrates the agency lacking the education on the services the FedRAMP PMO provides. The PMO stated being brought into discussion with said agency(s) to explain FedRAMP services to move forward.
Huge, huge +1 on this. We (Red Hat) are currently undergoing FedRAMP Tailored for a SaaS offering and there is immense confusion/chaos behind getting a sponsor.
Contracts require having FedRAMP, however for products newly introduced into the market, there is a chicken-and-egg problem. Agencies believe services MUST have FedRAMP in order to use it, not fully understanding the Agency ATO path. Most have been under the impression sponsorship will cost them several million (!!) dollars.
Even when doing government-to-FedRAMP PMO conversations, agencies receive different messaging depending who in the FedRAMP PMO they speak to.
trevorbryant
Currently, FedRAMP does not support a model for a full-SaaS solution.
After talking with FedRAMP PMO team, the following are identified:
This is an inappropriate financial risk to solution providers. Each control requires budget to implement, and those companies with small budgets (awaiting Series B, etc) are unable to fairly compete with larger corporations.
Some control families are obvious, some are not. The PMO was under the impression that CSP SSPs provide clear guidance on CSP and customer controls. The guidance given to the PMO was misguided and not necessarily true. For example, not every solution using Azure can obtain Microsoft's SSP and a SaaS may not know what's inherited or not. Even if a CSP's SSP can be shared, the security strategy is for that CSP and not anything else. There's a lot of "figure it out" action, hence item 1. above.
3) RFI and RFP Challenges
There are agencies providing RFI or RFP with requirements that a solution's provider must be able to achieve a FedRAMP ATO when the contract is signed or sponsor only close to ATO. Demonstrates the agency lacking the education on the services the FedRAMP PMO provides. The PMO stated being brought into discussion with said agency(s) to explain FedRAMP services to move forward.
4) Privacy Act, Public PII, and Confidentiality
The Privacy Act provides clear guidance on what is PII and what is not. The Act allows agencies to categorize what is called Public PII. The current FedRAMP model does not provide a way forward for Confidentiality levels that are Public PII and considered Low. This can remove the option for a SaaS to target a Tailored baseline (which is how I got into this mess in the first place).
Quote shopping yields high costs for 3PAOs, which are a requirement to achieving FedRAMP marketplace. 3PAOs cost in the 200-500k range, depending on the quality desired. Lack of regulation to the 3PAO competitive market absorbs the majority costs that need to be planned and budgeted to achieve FedRAMP. This is (on average) a ~250-500% markup from traditional A&As, making FedRAMP the largest expense and providing less cost-effective security.
Not a challenge with any SaaS, but FedRAMP in general. There is nothing at the policy level that requires any agency or solution provider to take the FedRAMP route. An agency can implement a solution into their own private GovCloud and further assess and authorize that system for use. The agency can provide its services internally or establish MOU/MOA/TIC to provide its services to other agencies, allowing for a more cost-effective security. Agencies today have this type of implementation already prior to FedRAMP.
The PMO acknowledges these items.
A unique challenge discovered along the way is that not all agencies actually know what FedRAMP is or how it works. Some agency POCs are under the impression that the FedRAMP PMO authorizes the use of a service into the marketplace, or a service directly to that agency. The PMO only prepares the authorization package to the agency POC and the agency authorizes the use of that service.