FedRAMP Authorization: Why ‘Moderate’ Matters
September 4, 2020
Aaron Higbee
CTO, Cofense
FedRAMP, the federal program created to assess the security of cloud service providers (CSPs), saves time and cuts costs for U.S. government agencies that would otherwise conduct their own assessments. CSPs are granted authorizations at three impact levels: low (includes low-baseline and low-impact SaaS “li-SaaS”), moderate, and high, aligned to the impact levels based on NIST guidelines. While the high-impact level protects the most sensitive government data, the moderate-impact level meets the needs of many agencies. And the gaping chasm in requirements between moderate and low is revealing.
Federal IT: Phishing Attack Ground Zero
Spear phishing continues to be the most significant vulnerability among federal agencies. As phishing threats rapidly evolve and increase, mission criticality has become the focus of agency CIOs and their teams, striving to maintain delivery of vital government services besieged by phishing attacks.
No agency is immune to this crisis. The second-largest Federal agency and the largest civil agency, the Department of Veterans Affairs (VA) knew that threat actors could target their enterprise security program. The DDoS attacks on CISA and the Health and Human Services Department in early March only strengthened their mission to ensure their people are attuned to the real cyber threats.
“Within our enterprise security program, we believe that the individual employee is probably both the strongest and weakest link, and so we put a lot of emphasis on education. We added our Cofense [Reporter] button just in time. … The individual employee – it starts and ends with them.” VA CIO Jim Gfrerer
Cofense PhishMe keeps people attuned to real cyber threats with simulations based on the latest threats known to bypass Secure Email Gateways (SEGs), powered by phishing specific threat intelligence and research. It also conditions users to actively report phishing attacks, which expedites SOC team analysis. This ultimately builds employee resilience to phishing while improving an agencies’ security posture.
Why Cofense Didn’t Take the Low Road
Why make the financial commitment, endure a rigorous authorization process and establish a continuous monitoring program when we could have simply self-attested our PhishMe security controls for a li-SaaS classification? That’s what KnowBe4 did for their security awareness training and simulated phishing platform. Because Cofense is a security company that prioritizes providing the highest level of protection to our customers, and a low-level certification just wasn’t good enough. That is why Cofense PhishMe is in the process of achieving FedRAMP moderate status.
Moderate vs. Low Impact Levels
Got PII? Cofense Has You Covered
Cofense recognizes that our products and services handle our customers’ personally identifiable information (PII). That’s why we went all in to certify at the FedRAMP moderate level, complying with 325 stringent controls to secure our customers’ data according to confidentiality, availability, and integrity. A moderate FedRAMP authorized CSP has a far more stringent set of controls as compared to a CSP with a low or li-SaaS ranking.
The impact level of a moderate service offering is based on the sensitivity of the data that an information system processes, stores, and transmits. Cofense opted for moderate FedRAMP compliance for our Cofense PhishMe solution. This required the documentation of our highly secure environment that will withstand comprehensive, rigorous and continuous review before we may engage with Federal agencies as a FedRAMP CSP.
Controls: The Numbers Say It All
Additional security controls are added as the levels progress to ensure that government data is adequately protected. High-level systems have 421 baseline controls, moderate-level systems have 325 controls, while low-level systems have only 125 controls and li-SaaS require a minimal 36 controls. Cofense opted for the moderate level, which will allow us to support a mass of government agencies.
Continuous Assurance with Cofense
With a moderate FedRAMP authorized solution, there is a strict security implementation as well as operational requirements and assurance that PII data be protected. With a li-SaaS implementation, there is no such assurance. And it doesn’t end there. FedRAMP requires that authorized CSPs engage in continuous monitoring after authorization is achieved. The authorization can be revoked if the CSP is found to be at any point in non-compliance with FedRAMP requirements. Cofense opted for a moderate FedRAMP authorization embracing these strict requirements and ongoing monitoring to meet our customers’ security needs and assure their peace of mind. Cofense PhishMe just completed the security assessment review with the sponsoring agency and FedRAMP PMO, and we are now in the final stages of the authorization process.
Next Steps to Secure Your Mission Critical
Are you confident your organization is prepared for an attack? Threat actors are targeting weaknesses such as social media, contracts and supply chains to infiltrate federal networks. In this “not if, but when” scenario, time is of the essence. Are you wasting precious time and effort in an agency ATO process for a non FedRAMP authorized vendor? Will your current phishing platform be FedRAMP Moderate authorized for 2021?
These are key questions to consider as you evaluate whether the cybersecurity culture in your agency can withstand phishing threats, and as you consider an email phishing simulation product provider. Proofpoint’s Security Awareness Training Solution has been “in process” for FedRAMP Moderate authorization for over a year, while Cofense PhishMe has been in process since March 16, 2020 and is on track to achieving FedRAMP ATO-Moderate in Q4 of 2020 (and possibly sooner).
Cofense PhishMe makes managing and measuring your phishing simulation program easy. With threat actors constantly innovating, simulations must be based on the latest threats known to bypass SEGs. Your approach to phishing awareness must engage users when they are active in their email client with the most relevant threats and accurately measure their performance. All without burdening your team with time-consuming scheduling, struggling to determine what simulation comes next and manually creating reports to demonstrate success. Cofense’s commitment to FedRAMP Moderate authorization for the Cofense PhishMe product along with our key capabilities make us an essential partner in protecting your mission critical.
Fill Out the Form to Request a Demo for a 1:1 consultation with one of our experts.
All third-party trademarks referenced by Cofense whether in logo form, name form or product form, or otherwise, remain the property of their respective holders, and use of these trademarks in no way indicates any relationship between Cofense and the holders of the trademarks. Any observations contained in this blog regarding circumvention of end point protections are based on observations at a point in time based on a specific set of system configurations. Subsequent updates or different configurations may be effective at stopping these or similar threats.
The Cofense® and PhishMe® names and logos, as well as any other Cofense product or service names or logos displayed on this blog are registered trademarks or trademarks of Cofense Inc.