Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Cloud service providers looking to work with the government, whether it’s at the state and local level or at the federal level, will have to adhere to certain cybersecurity standards. At the federal level, the program is called FedRAMP: the Federal Risk and Authorization Management Program.

The Cybersecurity Maturity Model Certification, CMMC, is a critical part of ensuring robust and equal information security from top to bottom throughout the Department of Defense’s supply chain. A common misconception about CMMC, stemming from previous pre-CMMC security, is that it primarily applies to prime contractors and big businesses.

Most of the time on the Ignyte blog, we talk about overarching security frameworks like FedRAMP, CMMC, and ISO 27001. Sometimes, though, it’s worth digging deeper into smaller-scale elements of these frameworks. Today’s target is ISO 27017, the ISO/IEC publication focusing on cloud service security. What does this document entail, who needs to use it, and what does compliance involve? Let’s discuss.

FedRAMP has strict requirements for the security of the companies looking to earn their certification. Among the many requirements you need to navigate are tests from your C3PAO, simulating malicious actors and common threat vectors. In order to understand what you need to do to pass, it’s worth going over what penetration testing is, what red teaming is, what the scope of FedRAMP pen testing includes, and what the rules of engagement encompass.

Here at Ignyte, we talk a lot about the major governmental cybersecurity frameworks like FedRAMP and CMMC or the international framework ISO 27001. What we don’t talk about as much – but which is no less important – are smaller-scale or more limited frameworks. SOC is one such framework, and it’s extremely important for those who need it. There’s also a lot of confusion surrounding it, both in business and as a layperson. What is SOC for?

While we talk a lot on this site about the US Government’s various cybersecurity frameworks, like FedRAMP and CMMC, there’s one significant framework that deserves just as much attention: ISO 27001. ISO 27001, being an ISO standard, is an international framework for cybersecurity divorced from any one country’s government.

Seeking a FedRAMP authority to operate is a critical part of any cloud service looking to work with the government in an official capacity. It’s required if you are going to handle controlled unclassified information on behalf of the government or its contractors, and since the requirements trickle down, you don’t even necessarily have to be part of the government’s prime contractors to need your ATO.

The Department of Defense DFARS Cybersecurity Clause, more commonly known as the DoD Cyber Clause (or just DFARS 7012), is the long-standing set of rules the DoD has put in place for all members of the DoD supply chain and defense industrial base. It has also spread beyond those boundaries through the use of DFARS 7012 clauses in contracts for other parts of the federal government.

FedRAMP is the Federal Risk and Authorization Management Program, and it’s one of the most widely used governmental cybersecurity frameworks across the United States. It’s meant to serve as the gatekeeper for any contractor looking to work with the federal government to ensure that everyone across the board has a minimum level of cybersecurity in place to protect themselves, the government, and each other from risks and threats. FedRAMP is not alone.

The overall defense industrial base is growing increasingly aware of the needs of modern information and cyber security. From recent major supply chain attacks to the constant threat of nation-state actors trying to compromise systems, it’s important to be committed to the best security you can implement, no matter where you are in the supply chain. One of the tools provided to you, and required by the Defense Federal Acquisition Regulation Supplement, is the SPRS.