Experts from the State Risk and Authorization Management Program (StateRAMP) said they expect the security requirements of state, local and tribal governments and institutions of higher education (SLEDs) to evolve in ways that support membership in the organization of non-profit cloud security.
“What we anticipate will happen is that states will start putting out policies and guidelines that say, ‘Here are our security checks. To comply with them, you can work independently through our system, which will probably be a long process for you as a service provider. ‘Or if you have already done StateRAMP, it automatically meets these requirements. And we’ll also accept FedRAMP because we understand the value of the work you’ve done there,’” Ellen Polk, account manager for StateRAMP, said April 26 during a webinar titled “Getting Started with StateRAMP.”
What’s more, he said states should recognize StateRAMP-ready and authorized accreditations, even if they’re not formally part of their cloud authorization programs. In fact, that is already happening in some states with their own “RAMP” programs. For example, him Texas Risk and Authorization Management Program Offers Provisional Certifications to cloud service providers already certified by StateRAMP and the Federal Risk and Authorization Management Program (FedRAMP).
“At StateRAMP we are working on standardization across the board, so if you go through the StateRAMP process and let’s say you get a StateRAMP authorization for your product, you should be able to take that authorized product and its security suite to your entire state. . and local government customers regardless of whether or not they have formally announced that they are doing StateRAMP,” Polk said. “Most of the security policies of the state government are based on [National Institute of Standards and Technology Special Publication] 800-53, which are the same basic controls that we use here at StateRAMP and which are also required by FedRAMP.”
Another effort to ease the review and verification process for cloud service providers looking to do business with SLED organizations would incorporate a two-way relationship between StateRAMP and other security frameworks, such as the Criminal Justice Information Services Security Policy, IRS Publication 1075 and the Centers for Medicare. and the Minimum Acceptable Risk Standards for Exchanges of Medicaid Services. This means providers who have met those requirements can “cross-match” them with their StateRAMP requirements and vice versa, Polk said, adding that guidance documents on this are likely to be released this year.
Last month, StateRAMP announced the formation of the Approvals Committee to ease cloud service providers’ path to validation. Because CSPs must have a SLED sponsor to work toward Ready or Authorized status, a FedRAMP authorization does not carry over. Recognizing that not all companies seeking StateRAMP authorization have relationships with SLED agencies, the organization established the committee to act “as authorizing officers on behalf of the government if a vendor is unable to secure a government sponsor.”
StateRAMP offers companies three “paths to success” to achieve readiness or clearance status. The release path provides the most involvement from the Knowledge Services consulting team. Knowledge Services serves as the program management office (PMO) for StateRAMP. Through Launch, the team helps vendors map StateRAMP-required controls to the ones the company already has, and translates documents like SOC 2 into StateRAMP templates to see what holes need to be filled.
Guided is a second path to accreditation through audits, gap analysis and other consulting services. Both Launch and Guided also require reviews from third party testing organizations.
The third track is called Fast Track and is for products, services or offers that already have federal authorization, such as authorization to operate, provisional authorization to operate or ready status. The process, which includes sharing FedRAMP documentation redacted to protect information as needed, takes weeks rather than months.
“The added value of this is independent verification and validation,” Shea Simpson, senior information security analyst at the PMO, said during the webinar. “We have enough CSPs that not only have FedRAMP anymore, but are [Joint Authorization Board]-authorized. But they want to show that at the state level, the higher education level, the tribal government, the regional institution level, they have also gone through the StateRAMP process.”
StateRAMP launched in January 2021 and now has more than 800 government and service provider members, Polk said. Starting March 14 10 states have announced that they are adopting StateRAMP.
“The goal and part of the mission of StateRAMP is how we provide state governments with enough information about the cloud products they use to process, store and transmit data in the cloud,” he said. “How do we get them enough information so they can make informed risk-based decisions, and how do we help as many providers as possible, regardless of size, get into this ecosystem?”
Stephanie Kanowitz is a freelance writer living in Northern Virginia.