The Federal Risk and Authorization Management Program has issued two requests for comment on proposed changes to its Key Security Indicators and a new standard for secure configurations of cloud service offerings.
The public comment period for both RFCs started on Sept. 10 and will close on Oct. 10.
Updated & New Key Security Indicators
KSIs outline the security capabilities expected from cloud service providers that intend to achieve and sustain a FedRAMP 20x authorization. The proposed updates to existing Phase One KSIs aim to address ineffective or insufficient ones. The changes also include new KSIs for the FedRAMP Low and Moderate baseline to bridge gaps and incorporate additional controls.
Cloud service providers pursuing Moderate authorization during the Phase Two pilot must showcase advanced maturity in depth and automation.
New Secure Configuration Standard
FedRAMP is also seeking public comment on a recommended secure configuration standard, required by Executive Order 14144, titled “Strengthening and Promoting Innovation in the Nation’s Cybersecurity,” as amended by EO 14306, “Sustaining Select Efforts to Strengthen the Nation’s Cybersecurity and Amending Executive Order 13694 and Executive Order 14144.”
The new standard aims to formalize FedRAMP’s requirements and recommendations, detailing the security configurations federal agencies need to attain before deploying a cloud service. Once finalized, the standard will be applicable to both FedRAMP 20x and FedRAMP Rev5, with the latter proceeding without a beta testing phase.
