Tag Archives: FedRAMP

Integrating NIST Supply Chain Risk Management into SLED Compliance Programs

Posted on by
Reply

From data breaches exposing citizen records to cloud outages halting Government portals, supply chain disruptions in State, Local and Education (SLED) institutions have been making headlines lately. According to a 2026 Black Kite report, Public Administration is the most vulnerable industry, with 68% of its vendors having critical vulnerabilities, followed by educational services at 65%.

To protect your institution from vendors’ cybersecurity risks and operational disruptions, your best approach is to implement gold-standard supply chain risk management practices within a cybersecurity framework. Here’s a breakdown of NIST supply chain risk management for SLED teams to help you connect each best practice to your organization’s compliance program.

Why Supply Chain Risk Is Now a SLED Compliance Concern

For SLED entities, supply chain risks have advanced from operational planning and now sit at the center of the compliance programs. Auditors and regulators are asking more pointed questions, going beyond cybersecurity concerns to establish that your organization can:

  • Maintain a secure global supply chain
  • Deliver uninterrupted public services
  • Protect sensitive citizen data
  • Operate as a reliable partner in Government infrastructure

Vendor Oversight Has Become an Audit and Grant Compliance Issue

During routine audit and grant compliance reviews, auditors and grant makers scrutinize your vendors and third-party systems to establish that you’re in control of supply chain risks. The same scrutiny extends to Federal grant applications, where reviewers assess whether your vendor management approach strengthens the overall project and supports your overall cybersecurity posture.

Cybersecurity Mandates Are Reaching Into the Supply Chain

Cybersecurity requirements at the State and Federal levels reference supply chain security expectations. Frameworks such as GovRAMP (fka StateRAMP) and FedRAMP, along with guidelines from the Cybersecurity and Infrastructure Security Agency (CISA), extend security protocol beyond your internal networks. These frameworks recognize that modern vendor networks rely heavily on external software and service providers and require you to implement a unified cybersecurity strategy to build resilient networks and reduce the risk of a supply chain compromise.

Education Institutions Face Distinct Vendor Obligations

If your educational institution manages student data, you have distinct vendor-related obligations under the Family Educational Rights and Privacy Act (FERPA) and various State-level privacy laws. When you partner with an external vendor for learning management platforms, communication tools or admin solutions, you must verify they match your organization’s data protection standards and broader information technology controls.

The Risk Extends Beyond Information Systems

The need for your SLED organization to manage supply chain risk goes well beyond securing digital information systems. Supply chain risks can:

  • Impact important community services
  • Compromise data integrity
  • Erode public trust
  • Create compliance and legal exposure
  • Disrupt operational continuity and service delivery

What NIST SP 800-161r1 Covers

The broader National Institute of Standards and Technology Risk Management Framework (NIST RMF) addresses how you can manage cybersecurity risks across your information systems. NIST SP 800-161r1 functions as the specialized cybersecurity supply chain risk management (C-SCRM) companion to the NIST RMF.

NIST has organized the NIST SP 800-161r1 recommendations into three sequential stages:

StageWhat It Covers
Foundational PracticesEstablishing governance structures, roles and supply chain risk frameworks
Sustaining PracticesBuilding operational maturity and integrating risk management into processes
Enhancing PracticesIntroducing automations and developing predictive risk capabilities

The institute updates the NIST SP 800-161 framework regularly to meet current data privacy and cybersecurity demands. However, your SLED organization doesn’t need to implement all three tiers of supply chain risk management at once. You can start with foundational practices and build incrementally and still meet NIST requirements.

Integrating NIST Supply Chain Risk Management in Your Compliance Program

NIST SP 800-161r1 offers a widely accepted framework aligned with established industry standards for building a supply chain risk management program for your SLED organization. While your approach may vary, here are the key steps to successfully integrate the NIST framework into your compliance program.

Step 1: Map Your Supply Chain and Assign Criticality

To manage supply chain risks, you need a complete picture of your supply network. Conduct a full inventory of your vendors and software providers in every department.

Then, categorize your suppliers based on how failure or disruption in their system could impact your operations or data. NIST SP 800-161r1 recommends you use FIPS 199 impact levels to categorize systems based on their impact (Low, Moderate, High) to inform the overall risk rating of the supplier..

Here are the main actions to execute at this step:

  • Establish a cross-functional team to oversee your vendor and technology risk.
  • Define clear roles and responsibilities for managing supply chain risk.
  • Secure executive support for proper funding.
  • Standardize how your organization identifies critical suppliers and assesses risk.
  • Put internal controls in place to monitor compliance and enforce policies.
  • Embed risk consideration into your supplier selection and procurement processes.
  • Promote organization-wide awareness of supply chain risk and its impact.

Step 2: Build a Risk Assessment Process for Vendors

Your next step in integrating NIST supply chain risk management into your compliance program is to establish risk management activities for determining whether to continue working with your vendors. The NIST SP 800-161r1 recommends the following best practices to build repeatable vendor risk assessments:

  • Conduct regular third-party risk assessments to identify emerging vulnerabilities.
  • Review vendor development practices and software supply chain controls.
  • Establish continuous monitoring criteria to track supplier performance and risk exposure.
  • Define a clear risk tolerance threshold and what constitutes acceptable risk.
  • Standardize how your organization will share risk information with every stakeholder.
  • Provide targeted training programs that focus on vendor and supply chain risks.
  • Involve suppliers in contingency planning and incident response readiness.

For this step, you can use a Government GRC software to centralize documentation and automate workflows. The right tools help reduce the manual overhead that makes vendor risk management difficult to sustain at scale.

Step 3: Integrate Supply Chain Risk Into Ongoing Compliance Programs

Embed supply chain risk management into your compliance lifecycle so it aligns with the governance processes of your SLED organization. This step will look different depending on your organization’s existing control frameworks and compliance requirements.

Map your vendor risk findings to NIST 800-53, GovRAMP or other compliance requirements so your supply chain risk data flows in the reporting you use for compliance purposes. Include your vendor risk status in regular risk management reporting for leadership and the audit committee to have risk visibility. 

You can also coordinate vendor review cycles with grant renewal calendars and audit preparation timelines so they double as compliance deliverables. Additionally, incorporate supply chain risk expectations into vendor contracts to formalize security requirements and incident notification obligations at the agreement level.

Step 4: Move Toward Continuous Monitoring

Your last step to integrate NIST supply chain risk management into your compliance program is to build ongoing visibility into vendor risk:

  • Establish supplier risk metrics and track them.
  • Introduce automated alerts or workflow triggers when vendor status changes.
  • Use insights from assessments you conduct to identify patterns and develop more predictive approaches to vendor risk before issues escalate.
  • Automate cybersecurity oversight procedures wherever possible to reduce manual burden and improve consistency.

Treat your supply chain security as a living program that evolves with emerging threats, changing vendor relationships and shifting regulatory requirements.

Build a Program That Serves Both Compliance and Resilience

When your organization offers important State, Local or education services that communities rely on, it’s important to recognize and address supply chain risks. The NIST SP 800-161r1 framework provides the best structure to build your vendor oversight program. A structured platform helps SLED teams manage supply chain risks while remaining compliant with relevant authorities.

See how Onspring’s platform supports supply chain risk management efforts and get a demo today.

Top 10 FedRAMP Events for Government in 2026 

Posted on by
Reply

As Federal agencies modernize IT infrastructure through cloud adoption, navigating the FedRAMP authorization process while meeting stringent security standards remains essential. FedRAMP provides a standardized approach to security assessment, authorization and continuous monitoring, enabling agencies to adopt cloud technologies with confidence. Carahsoft Technology Corp., The Trusted Government IT Solutions Provider™, provides expertise and a broad portfolio of FedRAMP-authorized Cloud Service Providers (CSPs), helping both agencies and vendors manage cloud security compliance. Throughout 2026, the FedRAMP community will gather at key events nationwide to discuss evolving requirements, implementation strategies and solutions that accelerate secure cloud modernization. Below are FedRAMP-focused events where Carahsoft and our partners will be present, offering opportunities to connect and explore authorized solutions designed for Federal security needs. 

GovRAMP Symposium 

March 9, 2026 | Washington, DC | In-Person Event 

The GovRAMP Symposium convenes senior Federal, State and Local leaders to explore how secure innovation, policy and procurement intersect to advance trusted modernization across Government agencies. Hosted in partnership with Billington CyberSecurity, the half-day program serves as the opening session of the Billington State and Local Cybersecurity Summit, setting the stage for collaboration and framework harmonization as a national security strategy. Attendees will gain insights from sessions exploring how harmonizing the NIST, FedRAMP and GovRAMP, Department of War (DoW) and other regulatory frameworks can create a secure, interoperable innovation base for artificial intelligence (AI) and other emerging technologies. The event concludes with a fireside chat held in conjunction with Billington CyberSecurity and a networking reception. 

As the Exclusive Government IT Solutions Partner for this event, Carahsoft is committed to supporting agencies navigating the path to FedRAMP and GovRAMP compliance through our extensive portfolio of authorized cloud solutions and trusted technology partners. We are dedicated to connecting Public Sector agencies with the FedRAMP-authorized solution providers and compliance expertise they need to simplify their authorization journey and accelerate secure modernization. Through our deep partner ecosystem and longstanding presence in the FedRAMP marketplace, Carahsoft helps Government leaders identify the right solutions to meet their unique security and operational requirements. 

Billington State and Local CyberSecurity Summit  

March 9-11, 2026 | Washington, D.C. | In-Person Event  

Billington CyberSecurity is the recognized leader in Federal cybersecurity education events. Following the success of its inaugural State and Local CyberSecurity Summit in 2024, the 3rd Annual Summit will bring together top Federal, State, Local and Tribal Government officials along with industry experts to learn from one another and bolster future defenses. Attendees can expect expert panels examining emerging threats, evolving regulations and best practices for ensuring transparency, trust and resilience across the technology landscape. The event features critical sessions on protecting digital supply chains and navigating cybersecurity for multiple sectors, including healthcare, infrastructure and education.  

Carahsoft and NightDragon are proud to co-sponsor the State and Local Billington CyberSecurity Summit, reflecting our ongoing commitment to strengthening the cybersecurity and FedRAMP compliance posture of State and Local agencies across the nation. By co-sponsoring the All-Attendee Reception in the Exhibit Hall on Tuesday, March 10th, we are creating valuable opportunities for Government cybersecurity leaders to connect with Carahsoft’s partner vendors, share compliance challenges and discover solutions designed to meet the rigorous standards of Federal and State security frameworks. Our participation underscores Carahsoft’s dedication to ensuring that State and Local agencies have access to the authorized technologies and trusted partnerships needed to protect critical infrastructure and citizen data against evolving threats. 

FedRAMP Community Working Group – Rev5 

April 1, 2026 |1:00-2:00pm ET | Virtual Event 

Join the FedRAMP Community Working Group (CWG) for updates to National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53, Revision 5 (Rev5) – Security and Privacy Controls for Information Systems and Organizations. These public working groups interact primarily through GitHub discussions and are supported by monthly meetings on specific topics. FedRAMP CWG – Rev5 meetings will be held the first Wednesday of every month throughout 2026 and are open to anyone in the community. 

Carahsoft supports Federal agencies by leveraging our expertise in Federal cloud security and compliance. Our team helps Federal agencies identify and acquire secure solutions from our portfolio of FedRAMP authorized CSPs. Additionally, Carahsoft provides support for our vendor partners navigating the FedRAMP authorization process, offering guidance on compliance requirements and best practices. These CWG sessions will feature discussions on updates to Rev5, vital information for professionals in the FedRAMP community. 

FedRAMP Community Working Group – 20x 

April 8, 2026 | 1:00-2:00pm ET | Virtual Event 

FedRAMP’s other CWG meeting will focus on the FedRAMP 20x program, a modernization initiative designed to streamline the Federal cloud authorization process through increased automation, reuse and community-driven approaches. The CWG will take place one week after the Phase 2, Cohort 2 FedRAMP 20x application period ends. Participants will learn more about new opportunities and approaches for CSPs when it comes to navigating the authorization process for Government cloud services. These meetings will be held on the second Wednesday of each month throughout 2026. 

As a trusted partner to Government agencies, Carahsoft facilitates access to our extensive network of FedRAMP authorized CSPs while ensuring solutions align with evolving Federal security standards. Utilizing our extensive industry expertise, Carahsoft provides critical insights and resources throughout the authorization journey to streamline the path to FedRAMP compliance. These CWG sessions offer essential updates on program developments, technical requirements and implementation strategies for secure cloud environments. 

Cloud Security Summit  

April 16, 2026 | Reston, VA | In-Person Event 

As Government agencies embrace cloud transformation, the need for secure, compliant and resilient environments has never been greater. The Public Sector Cloud Security Summit brings together Federal leaders and industry experts to share strategies for protecting sensitive data, modernizing cloud architectures and navigating evolving cybersecurity requirements. Attendees will discover practical approaches to FedRAMP modernization, alignment with Office of Management and Budget (OMB) guidance, Zero Trust implementation, automated monitoring and managing shared responsibility in multicloud and hybrid environments. Sessions will address strengthening cloud supply chain security through enhanced vendor risk management, software assurance and greater visibility across cloud service providers. 

Carahsoft is a tabletop sponsor for the Public Sector Cloud Security Summit and a proud partner of the Advanced Technology Academic Research Center (ATARC). Our team will be available throughout the event to discuss how our comprehensive portfolio of FedRAMP authorized CSPs can help agencies accelerate secure cloud modernization while maintaining compliance. 

DGI Virtual Workshop 

May 7, 2026 | 1:00-3:00pm ET | Virtual Event 

The Digital Government Institute’s (DGI) virtual workshop, Embracing Private Cloud: A Strategic Shift for Government Agencies, explores how Public Sector IT leaders can leverage private cloud architectures to drive digital transformation and modernize legacy systems. Through expert-led discussions and real-world uses cases, attendees will learn how to enable seamless migration, optimize workloads and build resilient hybrid environments tailored to Government needs. Whether planning a cloud transition or refining an existing deployment, this free workshop provides actionable guidance and best practices for IT leaders, architects and program managers driving innovation in Government. 

Carahsoft is partnering with DGI for this event to support Federal cloud security education and compliance initiatives. With an extensive portfolio of FedRAMP authorized solutions, Carahsoft is committed to assisting these educational opportunities that empower Government decision makers to confidently pursue cloud modernization. Our team will be available throughout the event to help connect attendees with the right technology for seamless, secure cloud migration.  

Offset Symposium 2026 

May 14, 2026 | Washington, DC | In-Person Event 

The Offset Symposium, hosted by Second Front, is the premier defense and GovTech event that convenes leaders from Government, the Department of War (DoW) and industry to examine how software-defined capabilities are reshaping national security. Through keynote discussions, expert panels and live technology demonstrations, Offset explores evolving cyber threats, operational challenges and emerging technologies. Sessions emphasize practical lessons learned from real deployments, offering attendees insight into how organizations are overcoming accreditation barriers, integrating commercial technology and delivering capability at scale. The symposium also spotlights FedRAMP and Government cloud compliance, underscoring FedRAMP’s role in enabling secure cloud adoption across the Federal landscape. Offset showcases FedRAMP-compliant solutions, demonstrating how accredited platforms and Development, Security and Operations (DevSecOps) pipelines are being used to deploy resilient, scalable software that supports mission-critical Government operations. 

Carahsoft partner Second Front returns with one of the year’s most anticipated events focused on accelerating defense innovation and technology adoption. As a gold sponsor, Carahsoft will showcase our broad portfolio of FedRAMP authorized CSPs and engage with defense decision makers seeking to accelerate cloud modernization while maintaining rigorous security standards. Registration for this event is now open! 

GovForward: The ATO and Cloud Security Summit 

July 23, 2026 | Washington, DC | In-Person Event 

The Authority to Operate (ATO) and Cloud Security Summit is where Government innovation meets cloud security excellence. Our eighth annual forum brings together Federal, State and Local Government leaders, alongside industry experts and solution providers, to address the evolving security, compliance and modernization challenges facing the Public Sector. The Summit offers a collaborative environment for exploring strategies to streamline the ATO process, advance secure cloud adoption and strengthen cybersecurity posture. The program features engaging keynote presentations and interactive panel discussions, designed to provide attendees with actionable insights into the latest policies, technologies and best practices shaping secure cloud adoption across the Public Sector.  

Carahsoft is proud to host GovForward: The ATO and Cloud Security Summit for the eighth consecutive year, a testament to our long-standing commitment to advancing secure cloud adoption across the Public Sector. Over the years, this summit has grown into one of the most trusted forms for Federal, State and Local leaders navigating the intersection of cloud modernization and compliance, and 2026 promises to be our most impactful year yet. GovExec is pleased to offer continuing professional education (CPE) credits through the National Association of State Boards of Accountancy (NASBA) for qualified attendees, providing valuable professional development opportunities. To get a sense of the depth and quality of programming this summit delivers, explore last year’s resources at our resource hub. Vendors interested in sponsorship opportunities are encouraged to contact us at GovForward@Carahsoft.com. Stay tuned for a detailed agenda! 

Black Hat USA 

August 1-6, 2026 | Las Vegas, NV | In-Person Event 

Black Hat USA 2026 is the premier global gathering where cybersecurity professionals, researchers and industry leaders come together to learn, share research and help shape the future of information security. The event features a comprehensive program of hands-on trainings, expert briefings and keynote sessions. Attendees will have the opportunity to explore ground-breaking research covering applied security, exploit development, malware analysis and more. Black Hat USA 2026 encourages collaboration, critical thinking and practical skill building, making it an essential event for professionals committed to staying at the forefront of information security. 

Carahsoft will be hosting a networking reception at Black Hat USA 2026, providing a great opportunity to connect with Government cloud security professionals, industry peers and FedRAMP experts. Join us for meaningful conversations about the evolution of FedRAMP and explore Carahsoft’s portfolio of secure, compliant cloud technologies. Stop by and speak with our team about the cutting-edge solutions in our portfolio that ensure sensitive Government information is secure. 

Billington CyberSecurity Summit 

September 8-10, 2026 | Washington, DC | In-Person Tradeshow 

The Billington CyberSecurity Summit 2026 is the 17th annual gathering of Government and industry cyber leaders, serving as a premier forum for Federal, State and Local cybersecurity professionals to discuss critical threats, policy developments and defense strategies. This three-day summit brings together thousands of attendees and hundreds of expert speakers across more than 40 sessions and breakout discussions to explore topics like AI integration in cybersecurity, Zero Trust architecture, threat intelligence, operational resilience and emerging defense capabilities. The event offers extensive networking opportunities, solution showcases and deep-dive sessions that address the most pressing cybersecurity challenges facing the Public Sector. Sessions have not yet been released for 2026, but previous years have covered topics ranging from AI-driven threat detection to securing critical infrastructure and implementing proactive cyber defense strategies. 

Carahsoft is committed to supporting DoW and Federal cybersecurity professionals at the Billington Cybersecurity Summit 2026 with a comprehensive resource presence featuring educational materials, expert consultations and technology demonstrations. Our cybersecurity specialists will be available throughout the three-day event to provide guidance on implementing Zero Trust frameworks, securing defense networks, addressing compliance requirements and exploring innovative solutions to combat evolving cyber threats. Visit our space to access resources tailored to DoW cybersecurity challenges, connect with solutions providers who understand defense mission requirements and engage in discussions about strengthening your organization’s cyber resilience and operational readiness.  

GovRAMP Cyber Summit 

November 15-17, 2026 | San Antonio, TX | In-Person Event 

The GovRAMP Cyber Summit brings national thought leaders, cybersecurity practitioners, policymakers and industry experts to address the most pressing security, compliance and modernization challenges facing Government today. Designed as a collaborative forum, the Summit focuses on aligning and operationalizing cybersecurity frameworks, such as FedRAMP, GovRAMP, Criminal Justice Information Services (CJIS) and more, to help agencies reduce duplication, strengthen compliance and accelerate the secure adoption of cloud and emerging technologies. Through keynote presentations and in-depth discussions, attendees will gain insight into how Government and industry leaders are working to improve reciprocity, streamline authorization processes and balance risk management with operational efficiency.  The Summist also features collaborative learning labs on topics such as AI and machine learning (ML), procurement considerations, authorization timelines and available industry tools. By bringing together voices from across Government and the Private Sector, the GovRAMP Cyber Summit empowers participants to advance secure, scalable technology adoption and strengthen cybersecurity outcomes across State and Local Government environments. 

Carahsoft will serve as the presenting sponsor of the GovRAMP Cyber Summit. With Carahsoft’s extensive portfolio of both FedRAMP and GovRAMP authorized solutions, we are uniquely positioned to support agencies navigating multi-level cloud security requirements. We look forward to connecting State and Local Government leaders with the industry-leading solutions needed to secure and strengthen their agencies’ environments. 

AWS re:Invent 

November 30-December 4, 2026 | Las Vegas, NV | In-Person Event 

Join AWS for a week of innovation, collaboration and global representation at AWS re:Invent, the company’s flagship annual conference that brings together tens of thousands of cloud professionals from around the world, including developers, architects, security leaders and business decision makers. This event serves as the stage for major AWS announcements, offering attendees early insight into the latest advancements across cloud infrastructure, AI and ML, security, compliance, data and application modernization. A series of in-depth technical sessions allows participants to explore through strategic, hands-on learning. AWS re:Invent features high-impact keynotes, targeted breakout sessions and an expansive expo floor, where attendees can engage directly with AWS partners and solution providers. 

Carahsoft partner AWS returns with re:Invent, the most impactful cloud computing event of the year. Carahsoft will be hosting a Public Sector networking reception at re:Invent 2026, providing an exclusive opportunity for Government cloud leaders to connect with peers, AWS experts and our network of FedRAMP authorized CSPs. Our team will be present, offering best practices, expert guidance and more! 

RAMPCon: Coalfire 

Date TBD | Location TBD | In-Person Event 

RAMPCon: Coalfire is a two-day, forward-thinking event filled with keynotes, expert panels and candid conversations. Bringing together leaders from Government and industry, the event will examine the evolution of FedRAMP alongside other frameworks such as CMMC and GovRAMP. Attendees will explore the growing role of automation, continuous monitoring and AI-driven security, gaining practical insight into what the next chapter Federal cloud adoption holds, from policy and authorization strategy to operational scale and resilience. 

Coalfire, a Carahsoft partner, returns in 2026 with their impactful FedRAMP event RAMPCon. With our FedRAMP expertise, Carahsoft is here to back this essential gathering of the cloud compliance community. Our team will be at the event, connecting Government agencies with the resources and solutions needed for successful FedRAMP authorization. 

As cloud technology reshapes Government operations, staying informed on FedRAMP requirements, best practices and authorized solutions is essential to secure, compliant modernization. These events offer valuable opportunities to engage with FedRAMP experts, connect with peers and discover cutting-edge cloud security solutions from authorized providers. Whether you are beginning your FedRAMP authorization, optimizing existing compliance processes or exploring new cloud capabilities, Carahsoft and our portfolio of FedRAMP-authorized CSPs stand ready to support your mission. Join us at these premier 2026 events to gain actionable insights, explore proven compliance strategies and see how Carahsoft can help you achieve secure, efficient cloud adoption that meets the highest Federal security standards. 

To learn more or get involved in any of the above events please contact us at FedRAMPMarketing@carahsoft.com. 

For more information on Carahsoft and our industry leading partners’ technology, visit our FedRAMP solutions portfolio and FedRAMP events page. 

Healthcare Cybersecurity in the Federal Government: Protecting Patient Data at Scale

Posted on by
Reply

Federal healthcare programs process millions of patient records every day. One small gap in protection could put sensitive healthcare data at risk. As a GRC or infosec leader, you understand that modern cyber threats target these systems with a dual purpose: to steal vital patient data and to lock down critical files for ransom.

These healthcare programs manage patients’ medical histories, prescriptions and payment information. Although the COVID-19 pandemic accelerated digital health initiatives to improve data protection, it also made data more attractive targets for cybercriminals.

Explore the healthcare cybersecurity challenges that Federal agencies face, along with practical ways to strengthen defenses. You’ll also discover how automation can help your team achieve cybersecurity compliance without unnecessary complications.

The Scale of Patient Data in Federal Healthcare

Federal healthcare systems, such as the Center for Medicare and Medicaid Services (CMS)  or the Veterans Affairs (VA) programs, deal with vast amounts of patient data. This could be electronic health records (EHRs), billing details or research databases that connect hospitals, clinics and vendors across the country.

A breach of this data affects not only the institution but the patients as well. It can delay timely care, disrupt healthcare services and leave patients vulnerable to the exploitation of their sensitive information.

For example, a ransomware attack on a large health system makes electronic records temporarily inaccessible. The staff has no option but to revert to paper-based processes to keep services up and running. This can result in inaccuracies and slowed care. When Federal healthcare programs are targeted, the impact can ripple across states and agencies.

Federal healthcare programs operate under strict regulations designed to protect patient data. The Health Insurance Portability and Accountability Act (HIPAA) Security Rule sets national standards for healthcare covered entities, including specific government agencies, and business associates regarding the protection of electronic health information.

For Federal use of cloud services, FedRAMP ensures that cloud providers meet rigorous security standards. Compliance lays the foundation for a structured approach to managing risks and maintaining accountability across systems.

Common Cyber Threats Federal Healthcare Organizations Face

Healthcare organizations at the Federal level face a range of cyber threats. These risks come from various sources, including employees, medical devices and external parties such as contractors and agencies. The most common include:

  • Phishing attacks targeting employees for credential theft
  • Ransomware locking down entire databases
  • Medical devices, such as imaging machines and connected monitors, introducing entry points due to inconsistent software updates or monitoring
  • Simple human mistakes, such as misconfigured access permissions or password sharing, exposing critical systems

This is why security awareness training is as important as technical defenses. If your staff is educated to proactively identify these cybersecurity threats, you can strengthen your institution’s first line of defense against them.

Implementing an automated cybersecurity platform can further help. With an efficient security tool, you can create policies that protect patient data at every step of its lifecycle.

How To Protect Patient Data at the Federal Level

When your agency maintains strong compliance practices, you are better positioned to detect and respond to threats and recover quickly from incidents. Here are ways to meet and go beyond HIPAA and protect health data at the Federal level.

Stay Prepared for Effective Incident Responses

Even with strong controls, incidents still occur. That’s why clear incident response plans are essential. These plans define roles, responsibilities and communication protocols for teams during a cyber event.

For instance, if a breach occurs in your agency’s health system, your IT, risk, compliance and leadership teams can minimize its impact with timely coordination. To make this happen, they need to regularly test their response plans to identify gaps before a real incident occurs.

You can also implement tabletop exercises in your agency. These practices allow teams to simulate ransomware attacks or data breaches to refine their decision-making skills and strategies.

Post-incident reviews are equally important. Agencies can learn from events without assigning blame.

Ensure Data Governance

Data governance is a practical approach to managing the storage, accessibility and sharing of healthcare data. It enables Federal agencies to clearly define ownership and access rights over critical patient data while establishing retention policies. This reduces confusion and improves accountability within teams.

Strong governance also supports cybersecurity compliance by ensuring that controls are applied consistently across systems. For example, your Federal agency can use a centralized platform to track who can access patient records and log any changes. This way, you can meet HIPAA and FedRAMP requirements and maintain a clear audit or incident investigation record.

Reduce Risk With Visibility and Automation

Many emerging technologies are helping Federal healthcare organizations manage cybersecurity more effectively. Centralized platforms provide visibility across multiple systems, helping security teams spot unusual activity quickly.

Moreover, automation reduces manual work and lowers the chance of human error, such as misconfigured permissions or missed updates. For instance, automated alerts can notify administrators if an unusual login occurs outside regular hours. These small interventions can prevent a minor vulnerability from escalating into a full-scale breach.

Establish Secure Digital Health Systems

Connected medical devices are essential for modern healthcare, but they require human monitoring to operate efficiently. You need processes that make sure that your digital healthcare devices are patched and configured securely. They should also support quick and smooth monitoring of any unusual behavior.

If your agency works with any third-party system, it must also meet Federal cybersecurity standards. This adds another layer of oversight to protect patient data from unexpected threats.

For example, a Federal hospital network implemented continuous monitoring of imaging devices and connected patient monitors. Its IT team uses these technologies to quickly identify and isolate potential intrusions. This enables them to protect patient data before things go south while maintaining clinical operations.

Increase Security Awareness Across the Organization

Technology alone isn’t enough. It needs the same level of collaboration from humans to efficiently protect healthcare data. For that, you need to launch security awareness programs to educate your employees on identifying phishing attempts, handling sensitive data and following proper protocols.

This step shows visible improvements in employee vigilance. Staff who understand the “why” behind security policies are more likely to follow them consistently, reducing risk for the entire organization.

Align People, Process and Technology

In cyber-resilient organizations, strong processes, capable people and reliable technology all work together to protect critical data at scale. While leadership support encourages accountability and consistency, clear procedures guide teams in responding to threats confidently.

When people, processes and technology collaborate, agencies are better prepared to handle cyberattacks. This approach also establishes an environment where patient data is protected at every step of care delivery.

How GRC Platforms Support Federal Healthcare Teams

Many Federal agencies today rely on flexible, no-code platforms that simplify risks, compliance and incident management. Healthcare teams usually include professionals who aren’t that tech-savvy. These tools allow them to track controls, document incidents and manage workflows without heavy IT involvement.

With an AI-powered GRC platform like Onspring, you can take advantage of an AI framework in healthcare to automate your agency’s repetitive tasks and centralize its information. Free up your staff from administrative work and allow them to focus on proactive security measures.

The platform scales with your agency’s needs. As healthcare programs grow or regulations evolve, your workflows can be updated without overhauling the whole system. Onspring also offers GovCloud support for Government environments for cybersecurity teams to manage and automate security-related functions.

Discover How Technology Reduces Cybersecurity Risks at the Federal Level

Removing Complexity from Compliance: Buoyant and TestifySec

Posted on by
Reply

Traditionally, achieving an Authorization to Operate (ATO) has been a grueling marathon. It often demands expensive consulting fees, lengthy manual documentation and no clear visibility into where your architecture actually stands against NIST 800-53 requirements. For organizations running cloud-native architectures on Kubernetes, this complexity is magnified. You aren’t just securing a perimeter; you’re securing hundreds of microservices communicating in real-time.

Buoyant and TestifySec are changing that narrative. By combining FIPS-validated service mesh technology with pipeline-native compliance automation, we are helping organizations and agencies shrink compliance timelines with cryptographic proof at every step.

How to meet NIST 800-53 requirements?

To sell to Government agencies or to operate within them, you need a secure product and proof of that security. Compliance frameworks like FedRAMP and FISMA both rely on the NIST 800-53 control catalog. They require both the technical implementation of security controls and verifiable evidence that validates them.

The partnership between Buoyant and TestifySec helps alleviate the resources needed to implement these controls through:

  • The Technical Foundation (Buoyant): Buoyant Enterprise for Linkerd provides automatic mutual TLS (mTLS) encryption for all service-to-service communication. Additionally, it uses FIPS 140-2/140-3 validated cryptographic modules, satisfying strict Federal requirements for data in transit, and provides a FIPS dashboard to simplify the auditing process.
  • The Compliance Automation Layer (TestifySec): Even with encryption in place, proving it to auditors can take months. TestifySec automates this by capturing cryptographically-signed attestations directly from CI/CD pipelines—including evidence of Linkerd’s encryption configurations. These attestations map to NIST 800-53 controls and generate System Security Plans (SSPs) in OSCAL format, replacing manual screenshots and developer surveys with tamper-evident proof.

Why are Buoyant and TestifySec better together?

Whether you are a software vendor seeking FedRAMP authorization or a Federal agency modernizing under FISMA guidelines, this partnership offers three distinct advantages:

  1. Velocity Without Friction: Linkerd provides automatic mTLS for all in-cluster traffic, covering both the control plane and data plane without requiring changes to application code. TestifySec captures attestations for these configurations automatically—no screenshots or developer surveys required.
  2. Continuous Compliance: Compliance isn’t a “one and done” event. TestifySec provides ongoing validation and automated reporting alongside Linkerd’s FIPS dashboard that offers real-time proof of encryption and readily available CMVP numbers for auditors.
  3. Simplified Procurement: Both Buoyant and TestifySec are available through Carahsoft, making it easier to leverage existing contract vehicles to acquire the full solution and removing red tape from the purchasing process.

 

The shift to Kubernetes shouldn’t be a compliance hurdle. By combining the world’s fastest, lightest FIPS-validated service mesh with pipeline-native compliance automation, Buoyant and TestifySec are making the Federal market accessible to the next generation of innovators and helping agencies secure their missions faster.

Learn more about FIPS-validated encryption with Buoyant and the partnership with TestifySec.

Carahsoft Technology Corp. is The Trusted Government IT Solutions Provider, supporting Public Sector organizations across Federal, State and Local Government agencies and Education and Healthcare markets. As the Master Government Aggregator for our vendor partners, including Buoyant, we deliver solutions for Geospatial, Cybersecurity, MultiCloud, DevSecOps, Artificial Intelligence, Customer Experience and Engagement, Open Source and more. Working with resellers, systems integrators and consultants, our sales and marketing teams provide industry leading IT products, services and training through hundreds of contract vehicles. Explore the Carahsoft Blog to learn more about the latest trends in Government technology markets and solutions, as well as Carahsoft’s ecosystem of partner thought-leaders.

FedRAMP 20x: Modernizing Cloud Security Authorization Through Automation and Continuous Assurance

Posted on by
Reply

FedRAMP authorization has long required extensive documentation, static point-in-time assessments and timelines of 18–24 months. This approach has slowed innovation for Federal agencies seeking secure cloud solutions and for vendors pursuing Government contracts.

FedRAMP 20x reimagines authorization through automation, machine-readable evidence and continuous monitoring, shifting compliance from document-driven processes to data-driven assurance. It also reshapes how Federal agencies, Cloud Service Providers (CSPs) and Third-Party Assessment Organizations (3PAOs) collaborate to secure Government environments.

The Shift from REV 5 to 20x

Traditional FedRAMP authorization follows a linear, document-heavy process where CSPs write extensive System Security Plans (SSPs), undergo annual assessments and exchange static artifacts with 3PAOs. FedRAMP 20x maintains the same security requirements from National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53 Revision 5 (REV 5) but transforms how evidence is validated. Instead of screenshots or single-moment spreadsheets, 20x uses logs, configuration files and automated integrations that reflect real-time security posture. This enables continuous assurance, with systems remaining audit-ready and controls validated through actual telemetry and configuration baselines.

The result is a more dynamic, risk-focused model that moves beyond top-down waterfall processes that often obscure security conditions.

Modernized Compliance

FedRAMP 20x requires robust compliance automation built on five pillars:

  1. Control normalization
  2. Engineering
  3. Infrastructure
  4. Evidence generation
  5. Reporting

Controls must be technically engineered into Continuous Integration/Continuous Deployment (CI/CD) pipelines, an approach often described as “compliance-as-code.” Supporting infrastructure must generate evidence in a reliable, machine-readable format such as NIST Open Security Controls Assessment Language (OSCAL) or JavaScript Object Notation (JSON) so CSPs, agencies and 3PAOs can share data rather than documents. This approach transforms compliance work from writing narratives and taking screenshots to building monitoring systems that continuously validate control effectiveness.

While artificial intelligence (AI) tools are emerging as assistants, the foundation remains consistent instrumentation and automated evidence collection. Organizations must invest in platforms capable of real-time logging, automated vulnerability scanning, Application Programming Interface (API)-driven evidence collection and continuous control monitoring, moving beyond spreadsheets or basic ticketing systems to true automated Governance, Risk and Compliance (GRC).

Maintaining Security Standards

FedRAMP 20x reduces the barriers to entry for small CSPs. Under the traditional REV 5 model, many providers faced prohibitive costs and timelines, often waiting indefinitely for Joint Authorization Board (JAB) review without agency sponsorship. The 20x pilot eliminates this sponsor requirement and accelerates review: organizations using automation have achieved authorization in six months.

RegScale, FedRAMP 20x blog, embedded image, 2025

RegScale, leveraging its own platform with features like automated evidence collection and AI-assisted control validation, completed its SSP and evidence in approximately three weeks and achieved full authorization within six months of audit start. This acceleration does not weaken security; rather, continuous monitoring and real-time evidence provide greater assurance than annual snapshots.

Another benefit of the 20x approach is that the machine-readable evidence can be reused for other frameworks, enabling a “certify once and comply many” approach across:

  • System and Organization Controls 2 (SOC 2)
  • International Organization for Standardization (ISO) 27001
  • Cloud Security Alliance (CSA) Security, Trust, Assurance and Risk (STAR)

For cloud-native organizations already operating with infrastructure as code (IaC) and automated pipelines, 20x aligns Federal compliance with modern DevSecOps practices.

Cultural and Organizational Change Management

The greatest challenge with FedRAMP 20x is cultural, not technological. Many organizations already possess the necessary tools but continue to rely on manual processes built over 15–20 years. Shifting to automation requires replacing “no hope” environments, where compliance is viewed as endless documentation, with the recognition that more efficient, sustainable operations are both possible and necessary.

Teams must actively retrain themselves to think operationally rather than as checklist validators. The transition also requires breaking down silos between security and compliance teams, agencies and 3PAOs, ensuring all stakeholders rely on the same real-time telemetry instead of debating the meaning of outdated screenshots. Federal agencies must also educate risk owners and embrace new evidence formats and methodologies. Ultimately, this is as much an organizational transformation as a technical one.

Continuous Monitoring and Real-Time Risk Management

FedRAMP 20x redefines relationships between CSPs, agencies and 3PAOs by replacing periodic reviews with continuous monitoring and near real-time risk visibility. Instead of exchanging PDFs, stakeholders share dashboards, datasets and evidence repositories that all parties can access. Auditors can review assessments based on evidence collected minutes or hours ago rather than relying on outdated artifacts.

Continuous monitoring supports 20x by allowing agencies to track configuration drift, Plan of Action and Milestone (POA&M) status and control effectiveness in regular cadences. The definition of “continuous” varies by control type; some require minute-by-minute validation, while policy controls may be quarterly or semi-annual.

For agencies, continuous assurance delivers better risk management capabilities, but only if they invest time in understanding how to interpret machine-readable formats such as OSCAL. Adoption varies, with some agencies already capable while others continue developing this capacity.

Moving Forward with Confidence

FedRAMP 20x is a strategic shift that aligns Federal authorization with modern DevSecOps, delivering faster innovation without reducing security standards. Since launching in March 2025, the pilot has processed 27 submissions and granted 13 authorizations, demonstrating scalability and viability.

With 20x, agencies gain improved risk visibility, reduced vendor timelines and access to innovative cloud solutions previously delayed by lengthy authorizations. However, success is not guaranteed. It requires adopting continuous assurance, investing in platforms that support machine-readable evidence and educating risk owners to interpret dynamic data. CSPs must centralize systems of record, instrument environments for continuous evidence collection and adopt standardized mappings that facilitate automation.  

The organizations that thrive will be those that use FedRAMP 20x as a motivator to replace outdated habits, engineer controls properly and embrace automation as an enhancement, not a replacement, of human expertise.

Discover how FedRAMP 20x is transforming Federal cloud authorization by watching the webinar, “FedRAMP 20x in Motion: What Early Results Mean for Federal Agencies,” featuring insights from RegScale and the CSA.

Carahsoft Technology Corp. is The Trusted Government IT Solutions Provider, supporting Public Sector organizations across Federal, State and Local Government agencies and Education and Healthcare markets. As the Master Government Aggregator for our vendor partners, including RegScale, we deliver solutions for Geospatial, Cybersecurity, MultiCloud, DevSecOps, Artificial Intelligence, Customer Experience and Engagement, Open Source and more. Working with resellers, systems integrators and consultants, our sales and marketing teams provide industry leading IT products, services and training through hundreds of contract vehicles. Explore the Carahsoft Blog to learn more about the latest trends in Government technology markets and solutions, as well as Carahsoft’s ecosystem of partner thought-leaders.

Maximize Federal Data Protection with Commvault’s End-of-Fiscal-Year Bundle 

Posted on by
Reply

As Federal agencies approach the final stretch of fiscal year 2025, the challenge of securing comprehensive data security coverage while maximizing remaining budget dollars has become increasingly critical. Commvault has partnered with Carahsoft to deliver a strategic end-of-fiscal-year opportunity that combines substantial cost savings with the highest level of Federal security authorization available in the data protection market. 

Consolidating Data Protection Under a Single Platform 

Federal agencies often work with a range of vendors to meet their diverse data protection needs, which can introduce added complexity, training considerations and operational demands. Commvault’s Data Protection Bundle addresses this challenge by unifying data protection, Active Directory protection and air-gapped data security capabilities under one comprehensive platform. 

This consolidation approach delivers measurable operational benefits that extend beyond cost reduction. Agencies can significantly minimize the time required for deployment and training, reduce management costs and improve their response capabilities during critical events such as ransomware attacks or data loss incidents. When every minute counts in a recovery scenario, having a unified platform can mean the difference between rapid restoration and extended downtime. 

Setting the Security Standard with FedRAMP High Authorization 

Federal agencies operate under stringent security requirements that often limit their technology choices, particularly when handling sensitive or classified information. Commvault distinguishes itself as the only data protection provider to achieve FedRAMP High authorization while maintaining availability across all major cloud platforms. 

This security credential represents the highest level of authorization available for cloud services serving Government customers, demonstrating Commvault’s ability to meet the most demanding Federal security standards. For agencies required to maintain strict compliance protocols, this authorization eliminates the complexity of lengthy security evaluations while ensuring their data protection solution meets or exceeds all regulatory requirements. 

Simplifying Deployment Across Diverse Government Environments 

Government agencies face unique infrastructure challenges, from legacy on-premises systems to modern cloud deployments, often with varying levels of technical resources and expertise. Commvault’s unified platform architecture addresses these challenges by maintaining consistency across all deployment scenarios—whether on-premises, cloud, virtual or physical environments. 

Since the underlying code remains consistent across all implementations, agencies experience significantly reduced deployment times compared to managing multiple vendor solutions. This consistency also translates to streamlined training processes and lower administrative overhead, particularly valuable for agencies with limited technical staff or those supporting geographically distributed operations. 

Leveraging Strategic Procurement Advantages 

The Data Protection Bundle is readily available through General Services Administration (GSA) Schedule contracting, providing Federal buyers with the streamlined procurement process they understand and trust. This availability is enhanced by Carahsoft’s partnership with Commvault to offer additional savings of up to 60% off manufacturer’s suggested retail price (MSRP)—savings that stack on top of existing GSA Schedule discounts that agencies have historically leveraged. 

While the focus remains on end-of-fiscal-year procurement opportunities, Commvault has committed to honoring this pricing structure through the end of the calendar year, providing agencies with flexibility in their planning and implementation timelines. 

Supporting Widespread Federal Adoption 

Commvault’s platform is already deployed across numerous Federal agencies, spanning both Department of Defense (DoD) and civilian organizations. Many of these agencies utilize Commvault to protect shared environments through a single unified platform, demonstrating the solution’s ability to scale across diverse Government requirements while maintaining the security boundaries and operational control that Federal organizations require. 

This existing Federal footprint provides new adopters with confidence in the platform’s proven ability to meet government-specific mandates while offering opportunities for knowledge sharing and best practice development across agency lines. 

Federal agencies looking to strengthen their data protection capabilities while maximizing end-of-fiscal-year budget efficiency should evaluate how Commvault’s comprehensive bundle addresses their mission-critical requirements. With proven FedRAMP High authorization, substantial cost savings and streamlined GSA procurement, this solution offers a strategic pathway to enhanced data security and operational efficiency. 

Visit Commvault’s FedRAMP page to discover how this end-of-fiscal-year opportunity can strengthen your agency’s data protection strategy and deliver significant cost savings. 

Carahsoft Technology Corp. is The Trusted Government IT Solutions Provider, supporting Public Sector organizations across Federal, State and Local Government agencies and Education and Healthcare markets. As the Master Government Aggregator for our vendor partners, including Commvault we deliver solutions for Geospatial, Cybersecurity, MultiCloud, DevSecOps, Artificial Intelligence, Customer Experience and Engagement, Open Source and more. Working with resellers, systems integrators and consultants, our sales and marketing teams provide industry leading IT products, services and training through hundreds of contract vehicles. Explore the Carahsoft Blog to learn more about the latest trends in Government technology markets and solutions, as well as Carahsoft’s ecosystem of partner thought-leaders.

Palo Alto Networks Cortex Cloud™ — Unified Efficiency, Now with Dual FedRAMP Authority

Posted on by
Reply

In a testament to its commitment to secured and streamlined cloud security, Palo Alto Networks Cortex Cloud™ has already achieved FedRAMP High and Moderate authorizations since launching in February 2025. This significant milestone positions Cortex Cloud as the only CNAPP in the FedRAMP Marketplace holding both High and Moderate designations, underscoring its unique ability to cater to the diverse security needs of the U.S. Government.

The Federal Risk and Authorization Management Program (FedRAMP) is the Government’s rigorous standard for assessing, authorizing and continuously monitoring cloud services. By achieving both High and Moderate authorizations, Cortex Cloud demonstrates its adherence to stringent security controls, paving the way for Federal agencies to confidently adopt its innovative platform.

Unlocking Efficiency Through a Unified Security Platform

At a time when Government agencies are prioritizing modernization and efficiency, Cortex Cloud offers a powerful, unified solution. As the next generation of Prisma® Cloud, it transcends traditional, siloed security tools by integrating best-in-class cloud detection and response (CDR) with industry-leading, cloud-native application protection platform (CNAPP) capabilities.

This platform-centric approach delivers measurable benefits:

  • Streamlined Procurement – By choosing Cortex Cloud with FedRAMP High authorization to secure your environment, agencies can bypass the complexities and delays of redundant security assessments.
  • Reduced Complexity and Risk – By integrating security across the entire cloud lifecycle (from code to cloud to SOC) Cortex Cloud eliminates the operational overhead and potential vulnerabilities associated with managing disparate security tools.
  • Enhanced Operational Efficiency – The unified platform provides comprehensive visibility and context, enabling security teams to prioritize risks effectively, automate responses and reduce the mean time to respond (MTTR) to threats.
  • Intelligent Risk Reduction – Cortex Cloud’s cloud posture security capabilities offer agentless visibility and intelligently group-related issues, empowering security teams to focus on the most critical risks with minimal effort.
  • Proactive Threat Prevention – Stop attacks in real time with cloud detection and response (CDR), maintaining the integrity and availability of Government systems, as breaches are prevented before impacting mission-critical operations.
  • Securing the Application Lifecycle – Cortex Cloud’s application security features enable agencies to identify and remediate vulnerabilities in the software supply chain, preventing risks from ever reaching production.

Meeting Diverse Government Needs with a Single, Powerful Platform

The dual FedRAMP High and Moderate authorizations empower Cortex Cloud to address a wide spectrum of Government requirements:

  • FedRAMP High – For the most sensitive, unclassified data where compromise could severely impact national security, economic stability or public safety. Cortex Cloud meets over 400 rigorous security controls for mission-critical applications.
  • FedRAMP Moderate – For Federal information where loss of confidentiality, integrity or availability would have serious adverse effects. Cortex Cloud adheres to over 300 security controls, suitable for a broad range of data, including PII.

Furthermore, Cortex Cloud’s GovRAMP High and Moderate certifications highlight its commitment to serving State and Local Governments with equally robust and efficient cloud security solutions.

Driving Productivity and Cost Savings

The U.S. Government’s focus on maximizing efficiency and productivity aligns perfectly with the benefits offered by Cortex Cloud’s unified platform.

By consolidating security functions and providing intelligent insights, Cortex Cloud helps agencies:

  • Optimize Resources – Security teams can operate more efficiently, focusing on strategic initiatives rather than managing a complex web of point solutions.
  • Improve Security Outcomes – Comprehensive visibility and integrated threat intelligence lead to a stronger security posture and reduced risk of costly breaches.
  • Accelerate Cloud Adoption – Agencies can confidently embrace the scalability and flexibility of the cloud while maintaining the highest security standards.

Cortex Cloud’s FedRAMP High and Moderate authorizations are more than just certifications; they represent a commitment to providing Government agencies with an efficient, unified and highly secure cloud security platform. By streamlining operations, reducing complexity and delivering comprehensive protection, Cortex Cloud empowers the U.S. Government to achieve its modernization goals while safeguarding its most critical assets.

Secured in America. Built for Government.

Headquartered in California, Palo Alto Networks proudly celebrates two decades of cybersecurity innovation and leadership. Across the United States, we employ more than 8,800 people in 49 states with physical offices in California, New York, Texas and Virginia. Championing American production excellence, we assemble all of our hardware firewalls in the United States, with our primary assembly and fulfillment center located in Texas. With over $1.8 billion in annual R&D, Palo Alto Networks is driving continuous innovation to maintain American technological leadership and excellence.

Learn more about our commitment to serve Federal organizations as the Government’s cybersecurity partner of choice.

Carahsoft Technology Corp. is The Trusted Government IT Solutions Provider, supporting Public Sector organizations across Federal, State and Local Government agencies and Education and Healthcare markets. As the Master Government Aggregator for our vendor partners, including Palo Alto Networks, we deliver solutions for Geospatial, Cybersecurity, MultiCloud, DevSecOps, Artificial Intelligence, Customer Experience and Engagement, Open Source and more. Working with resellers, systems integrators and consultants, our sales and marketing teams provide industry leading IT products, services and training through hundreds of contract vehicles. Explore the Carahsoft Blog to learn more about the latest trends in Government technology markets and solutions, as well as Carahsoft’s ecosystem of partner thought-leaders.

Meeting the AI Mandates with Confidence: Why Federal Teams Trust Snyk

Posted on by
Reply

Federal agencies are moving fast to unlock the potential of AI—from improving citizen services to driving mission outcomes. But with all that innovation comes a new wave of complexity and risk.  Security, trust, and transparency can’t be afterthoughts. They need to be part of the build process from day one.  That’s where Snyk for Government comes in—now FedRAMP authorized, we’ve taken it even further with the launch of the Snyk AI Trust Platform May 2025. 

AI isn’t magic. It’s built on code, containers, infrastructure templates, and APIs—and increasingly, it’s generating code on its own, generating 40% more vulnerabilities than human developers. Agencies need to track, fix, and manage continuously.  With Snyk, you can shift left and Secure-by-Design:

  • Spot and fix risks early—automatically and at scale
  • Keep developers moving fast while staying compliant
  • Build AI systems that are secure from the ground up

Meet the Snyk AI Trust Platform

Launched in May 2025, the Snyk AI Trust Platform is the first of its kind: an AI-native, agentic security platform designed for how modern teams build today. It gives agencies the tools to move quickly without compromising trust.

This isn’t just DevSecOps—it’s security built for the era of AI-driven, autonomous software development.

How Snyk is supporting new federal AI mandates

Trusted, Transparent AI Development

As agencies embrace AI, expectations around objectivity and transparency are front and center. Snyk helps teams meet those expectations with tools that focus on real technical risks—not subjective filters.

  • Credible vulnerability intelligence: Sourced from standards-based orgs like CVE, CWE, and NIST
  • Customizable policy enforcement: Agencies stay in full control with Snyk Guard’s real-time, no-bias policy engine
  • Integrated into your pipeline: From GitHub to Terraform to container registries—Snyk fits your workflow, not the other way around

 Scaling Secure AI Infrastructure

New funding and fast-tracked initiatives mean federal developers need security tools that keep up.

  • FedRAMP authorized: Snyk is cleared for use across federal cloud environments
  • Automation where it counts: Agentic tools like Snyk Assist and Snyk Agent surface issues and fix them before they ship

 Building Export-Ready, Trusted AI Systems

As global collaboration increases, secure supply chains are more important than ever. Snyk helps you ship software that’s secure, auditable, and globally trusted.

  • Standards-aligned: Support for SBOMs, AIBOMS, international compliance, and NIST-aligned policies
  • Agentic AI security: Governance that scales to GenAI assistants and LLMs—wherever and however they run
  • Broad ecosystem support: Integrates with the open tools your dev teams already use

Whether you’re modernizing legacy systems, launching new GenAI services, or strengthening cross-agency pipelines, Snyk helps federal teams move fast, stay secure, and build trust into every line of code.

? Ready for a tailored AI readiness assessment?
 Let’s talk: federal@snyk.io

Carahsoft Technology Corp. is The Trusted Government IT Solutions Provider, supporting Public Sector organizations across Federal, State and Local Government agencies and Education and Healthcare markets. As the Master Government Aggregator for our vendor partners, including Snyk, we deliver solutions for Geospatial, Cybersecurity, MultiCloud, DevSecOps, Artificial Intelligence, Customer Experience and Engagement, Open Source and more. Working with resellers, systems integrators and consultants, our sales and marketing teams provide industry leading IT products, services and training through hundreds of contract vehicles. Explore the Carahsoft Blog to learn more about the latest trends in Government technology markets and solutions, as well as Carahsoft’s ecosystem of partner thought-leaders.

Breaking Down Barriers: How SAS and Carahsoft Are Making Trustworthy AI More Accessible to Government Agencies

Posted on by
Reply

Government agencies face a unique challenge when it comes to adopting new technologies: they need cutting-edge capabilities, but they also need absolute certainty that those tools meet the highest security and compliance standards. For AI and analytics, this balance has historically been difficult to achieve—until now.

A Major Milestone for Government AI Access

Data and AI leader SAS has achieved FedRAMP® and GovRAMP (formerly StateRAMP®) authorization for SAS® AI and Analytics for Government. Alongside its partner Carahsoft, SAS empowers Government agencies to improve efficiency, reduce risk and enhance data security with SAS® Viya®, its cloud-native data and AI platform.

Enhanced Access to Dependable AI in the Cloud

FedRAMP is a Government-wide program that establishes a standardized approach to security assessment, authorization and continuous monitoring for cloud products and services to ensure the protection of Federal information. GovRAMP, a nationally recognized risk authorization management program, provides a standardized approach to assessing cloud products. With these authorizations, even more Government agencies can use SAS Viya in the cloud operationalize predictive analytics and AI regardless of whether code is developed in SAS or open source. SAS has served as a trusted Government technology provider for nearly five decades and is used in all 15 executive departments of the US Federal Government and all 50 states.

Trust and Transparency at the Core

SAS Viya incorporates trustworthy AI capabilities such as bias detection, explainability, decision auditability and model monitoring, governance and accountability, boosting confidence in Government agencies’ responsible AI initiatives.

This accomplishment demonstrates SAS’ steadfast commitment to providing a secure and reliable solution that Government agencies can rely on to safeguard their data and operations.

“SAS understands that security is table stakes for being a government partner. Security and trust always come first, followed closely by value, innovation and the ability to solve the most pressing problems. That’s what SAS has helped governments with for nearly 50 years” said Ben Stuart, Vice President, US Public Sector at SAS. “These certifications are further evidence of this commitment, and we’re looking forward to bringing SAS Viya to even more Government customers to help them reach their goals and make an impact.”

SAS and Carahsoft’s Partnership Delivers Advanced Software to Government Agencies

The strategic agreement between the two technology leaders designates Carahsoft as a SAS Public Sector distributor, making SAS’ data and AI solutions accessible to US Government agencies through Carahsoft’s reseller partners and various contract vehicles and Government schedules. Through this partnership, Government customers can efficiently acquire SAS products and solutions, including cutting-edge, AI-optimized analytics tools for proactive response to evolving Public Sector challenges. 

With a legacy in Government dating back to the company’s founding in 1976, SAS software is used in more than 1,600 Public Sector departments, ministries and agencies in more than 130 countries worldwide. Recognized as a leading software distributor in the market, Carahsoft provides expanded scale and reach to SAS’s products and solutions, including SAS Viya, across the Public Sector.

Looking Ahead: Empowering Data-Driven Government

SAS, in partnership with Carahsoft, is dedicated to empowering Government agencies with data and AI solutions. SAS and Carahsoft help Government agencies to make informed decisions, optimize operations and enhance public services. SAS and Carahsoft are committed to driving positive change and delivering measurable results for the Public Sector.

Ready to explore how SAS can support your agency’s data and AI initiatives? Learn more about SAS public sector analytics, including FedRAMP and GovRAMP certifications.

Carahsoft Technology Corp. is The Trusted Government IT Solutions Provider, supporting Public Sector organizations across Federal, State and Local Government agencies and Education and Healthcare markets. As the Master Government Aggregator for our vendor partners, including SAS we deliver solutions for Geospatial, Cybersecurity, MultiCloud, DevSecOps, Artificial Intelligence, Customer Experience and Engagement, Open Source and more. Working with resellers, systems integrators and consultants, our sales and marketing teams provide industry leading IT products, services and training through hundreds of contract vehicles. Explore the Carahsoft Blog to learn more about the latest trends in Government technology markets and solutions, as well as Carahsoft’s ecosystem of partner thought-leaders.

Powering the OneGov Mission with a New GSA Offer for Slack

Posted on by
Reply

The U.S. General Services Administration (GSA) has set a bold new direction for Federal procurement with its OneGov Strategy—a transformative mission to modernize how the Government buys and uses technology. The goal is clear: act as one unified enterprise to reduce costs, improve security, enhance productivity and eliminate the fragmented, agency-by-agency purchasing of the past.


Achieving this vision requires powerful, secure and commercially available tools that can be acquired and deployed with minimal friction. Salesforce is supporting the OneGov mission by making Slack’s FedRAMP-authorized collaboration platform more accessible and affordable for every Federal agency.

Unifying Agencies to Operate as a Shared Enterprise


A core tenet of the OneGov strategy is breaking down silos to help the Government function as a single, coordinated enterprise. Slack is purpose-built for this reality. By moving communication from isolated inboxes into organized, searchable channels, Slack creates a transparent environment for collaboration. More importantly, Slack Connect extends this capability across agency lines, allowing for secure, real-time collaboration with other Government entities and external partners. This directly addresses the OneGov goal of unifying the Federal workforce, ensuring that inter-agency teams can operate with the same speed and alignment as internal ones, all within a controlled and auditable platform.

Enhancing Productivity and Accelerating AI Adoption


The OneGov initiative calls for agencies to leverage modern technology to enhance efficiency. Slack delivers on this with powerful, user-friendly features, such as:

  • Workflow Builder, which empowers teams to automate routine processes like approvals and status updates without writing a single line of code, freeing up personnel for mission-critical work.
  • Slack AI, which provides a secure pathway to accelerate artificial intelligence (AI) adoption. Agencies can instantly leverage AI to summarize complex discussions, get immediate answers from internal knowledge bases and draft communications more efficiently.

These tools provide the tangible productivity gains and advanced capabilities needed to build a smarter, more effective Government.

Reducing Costs Through Centralized, Streamlined Procurement


The Salesforce and GSA agreement for Slack is a prime example of the OneGov strategy in action. By establishing a single, Government-wide agreement with transparent, pre-negotiated pricing, we are helping the GSA eliminate duplicative contracts and leverage the full buying power of the Federal Government.


Through November 30, 2025, your agency can access this strategic offer via the GSA Schedule (Contract: 47QSWA18D008F). With no minimum quantities and pricing structured to be Government Purchase Card (GPC) friendly, this offer dramatically reduces procurement friction and empowers teams to quickly acquire the tools they need to support their mission.

This GSA promotion is more than a discount; it is an opportunity to align your agency’s collaboration strategy with the forward-thinking vision of OneGov. It’s a chance to equip your teams with a best-in-class platform that is secure, efficient and cost-effective.


Carahsoft and our partners are committed to helping you navigate this streamlined procurement process. We are ready to provide a quote, schedule a personalized demo and help you realize the full potential of Slack in achieving your agency’s modernization goals.


Ready to join the OneGov movement and transform how your agency collaborates?
Contact our Salesforce team at Carahsoft today or call us at (877) SFDC-007 to learn more and take advantage of this limited-time offer.

Carahsoft Technology Corp. is The Trusted Government IT Solutions Provider, supporting Public Sector organizations across Federal, State and Local Government agencies and Education and Healthcare markets. As the Master Government Aggregator for our vendor partners, including Salesforce we deliver solutions for Geospatial, Cybersecurity, MultiCloud, DevSecOps, Artificial Intelligence, Customer Experience and Engagement, Open Source and more. Working with resellers, systems integrators and consultants, our sales and marketing teams provide industry leading IT products, services and training through hundreds of contract vehicles. Explore the Carahsoft Blog to learn more about the latest trends in Government technology markets and solutions, as well as Carahsoft’s ecosystem of partner thought-leaders.