6/23 FAB Community Call: Brian Conrad Roundtable (1)

Format:

• 60 min total

• Brian + 1-3 participants asking the pre-canned questions

• FCAB members only, not publicly advertised

• 20ish minutes for audience follow up question

• Not recorded

• Funding

• Resourcing

• Interpreting legislation

Regarding A2LA

How do PMO QA staff stay up-to-date on tech?

What is the appetite for creating an open database of guidance the PMO gives during the review process?

Is a formal appeals process on the roadmap now that FedRAMP is statutory?

How can the CSP escalate the issue if a PMO reviewer or 3PAO does not understand the technology or is technically wrong in an assessment?

• A contractual relationship exists between the CSP and 3PAO. Performance issues ought to be stipulated in said contract.

• The sooner you let PMO know, the better. PMO has its escalation procedures. A performance guide exists for 3PAOs. Remediation starts with a consultation and can escalate up to and including calling into question their FedRAMP recognition.
• An intervening meeting can be brokered when practical.
• The contract is ultimately king.

Are there any plans to work more closely with states, and what is the reasoning behind excluding states from the MAX folder?

How does that impact burden or reciprocity?

Is there an update on a FedRAMP High secure document repository (OMB Max Replacement)?

With the proliferation of AI models, what is the current guidance on a FedRAMP CSO connecting to an external non-FedRAMP AI model? Under what circumstances would that be allowed, given that CSP commercial offerings may be integrated with AI models not owned or operated by the CSP, making it nearly impossible to get the AI model inside the security boundary?

• FedRAMP is starting from the ground up to build initial capability and then evolving with the industry as possible. Brian sees AI as part of this, but tech maturity isn’t quite there.

• The general rule is to refer to boundary guidance. Ideally, AI models would get authorized, so there isn’t a path for a CSP to get an ATO when using a 3rd party AI model that would ingest federal data.

What is the guidance around connecting FedRAMP moderate and FedRAMP high instances? Would this be allowed if CSPs or end-users could build controls and show that no high data ends in a moderate environment?

Industry representation on FSCAC includes representing large CSP players (three hyper-scalers, one 3PAO, and one small CSP). What is the plan to include the voice of more SMB/typical CSPs? What about representation for CSPs without a current status?

How can we ensure consistency with the quality of the Agency review process to ensure that the review is cleaner once it gets to the PMO? Sometimes agencies provide a green light on an architectural element only to have it converted into a High POAM during PMO review.

• The PMO has thought about this in the context of wanting to reduce time-to-authorization.

• A primary issue is that the agency authorization process is done serially.

• Presently the PMO looking for CSPs/packages to test out a more parallel process in terms of simultaneous PMO and Agency reviews.

State governments/agencies are asking to be within the FedRAMP authorization boundary. What is the best way to handle this request? Is it allowed?

• Government community clouds are acceptable.
• Must be identified as such in SSP
• PMO will be concerned about where federal data will live and how it will be accessed.
• FedRAMP PMO has no interest in State-level needs.

• States can be freely given access to SSPs, SAPs, and SARs.

Will the in-house GRC system be FedRAMP High ATO'ed? Can you provide vendors with free or minimally paid tenancy within this GRC system to eliminate this hurdle for vendors?

While the FedRAMP PMO may consider the SAP and SAR the vendor's proprietary info, if the CSP is also DISA/DoD IL4/5 authorized, DoD doesn't always feel the same way...

The software supply chain EO alluded to FedRAMP alternatives. Are there any plans to map to other frameworks?

• The challenge is 800-53 is very perspective while others aren’t.

• FISMA is a hurdle that is federal law.

• From Brian’s perspective, he asks how we [FedRAMP] can look at the organizational maturity of CSP coming into FedRAMP because they’ve done other work with other compliance bodies. Something like an organizational maturity matrix on compliance. SOC2 and Li-SaaS had a big gap, for example. It’s a challenge.
• This is a two-edged sword. Even if you took all compliance bodies and dropped them on top of 800-53, there would still be FedRAMP-specific work.
• The question is, are CSPs willing to invest without guaranteed ROI? Getting listed on the marketplace doesn’t guarantee market success. A business mind is required to determine ROI prospects. Lowering the burden is one thing, but the federal market dictates this.
• With small businesses, FedRAMP is looking to see what can be done to get them in fast. FedRAMP wants to lower barriers but not the cyber barriers. Brian has a couple of ideas being explored (not public).

Would there be another model for getting started, e.g., 500k is cheap for FedRAMP but not affordable for small shops?

• Some ideas are being kicked around. Where can we have self-attestation vs. 3PAO validation?
• Scenario: If you reduce the work required from 3PAO, they will likely raise prices. Lowering barriers to entry is a complex thing to do. Looking at ways to eliminate sponsor req for small businesses.

Is there a working group around the automation process specifically?

With an angle of trying to lower the barrier for small SaaS providers. There is an idea of a PaaS where apps can reside in those environments to reduce compliance burden. There are some folks already doing this with DoD. Is anything like this planned for FedRAMP or other agencies are thinking about?