Tag Archives: FedRAMP

Top 10 FedRAMP Events for Government in 2026 

Posted on by
Reply

As Federal agencies modernize IT infrastructure through cloud adoption, navigating the FedRAMP authorization process while meeting stringent security standards remains essential. FedRAMP provides a standardized approach to security assessment, authorization and continuous monitoring, enabling agencies to adopt cloud technologies with confidence. Carahsoft Technology Corp., The Trusted Government IT Solutions Provider™, provides expertise and a broad portfolio of FedRAMP-authorized Cloud Service Providers (CSPs), helping both agencies and vendors manage cloud security compliance. Throughout 2026, the FedRAMP community will gather at key events nationwide to discuss evolving requirements, implementation strategies and solutions that accelerate secure cloud modernization. Below are FedRAMP-focused events where Carahsoft and our partners will be present, offering opportunities to connect and explore authorized solutions designed for Federal security needs. 

GovRAMP Symposium 

March 9, 2026 | Washington, DC | In-Person Event 

The GovRAMP Symposium convenes senior Federal, State and Local leaders to explore how secure innovation, policy and procurement intersect to advance trusted modernization across Government agencies. Hosted in partnership with Billington CyberSecurity, the half-day program serves as the opening session of the Billington State and Local Cybersecurity Summit, setting the stage for collaboration and framework harmonization as a national security strategy. Attendees will gain insights from sessions exploring how harmonizing the NIST, FedRAMP and GovRAMP, Department of War (DoW) and other regulatory frameworks can create a secure, interoperable innovation base for artificial intelligence (AI) and other emerging technologies. The event concludes with a fireside chat held in conjunction with Billington CyberSecurity and a networking reception. 

As the Exclusive Government IT Solutions Partner for this event, Carahsoft is committed to supporting agencies navigating the path to FedRAMP and GovRAMP compliance through our extensive portfolio of authorized cloud solutions and trusted technology partners. We are dedicated to connecting Public Sector agencies with the FedRAMP-authorized solution providers and compliance expertise they need to simplify their authorization journey and accelerate secure modernization. Through our deep partner ecosystem and longstanding presence in the FedRAMP marketplace, Carahsoft helps Government leaders identify the right solutions to meet their unique security and operational requirements. 

Billington State and Local CyberSecurity Summit  

March 9-11, 2026 | Washington, D.C. | In-Person Event  

Billington CyberSecurity is the recognized leader in Federal cybersecurity education events. Following the success of its inaugural State and Local CyberSecurity Summit in 2024, the 3rd Annual Summit will bring together top Federal, State, Local and Tribal Government officials along with industry experts to learn from one another and bolster future defenses. Attendees can expect expert panels examining emerging threats, evolving regulations and best practices for ensuring transparency, trust and resilience across the technology landscape. The event features critical sessions on protecting digital supply chains and navigating cybersecurity for multiple sectors, including healthcare, infrastructure and education.  

Carahsoft and NightDragon are proud to co-sponsor the State and Local Billington CyberSecurity Summit, reflecting our ongoing commitment to strengthening the cybersecurity and FedRAMP compliance posture of State and Local agencies across the nation. By co-sponsoring the All-Attendee Reception in the Exhibit Hall on Tuesday, March 10th, we are creating valuable opportunities for Government cybersecurity leaders to connect with Carahsoft’s partner vendors, share compliance challenges and discover solutions designed to meet the rigorous standards of Federal and State security frameworks. Our participation underscores Carahsoft’s dedication to ensuring that State and Local agencies have access to the authorized technologies and trusted partnerships needed to protect critical infrastructure and citizen data against evolving threats. 

FedRAMP Community Working Group – Rev5 

April 1, 2026 |1:00-2:00pm ET | Virtual Event 

Join the FedRAMP Community Working Group (CWG) for updates to National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53, Revision 5 (Rev5) – Security and Privacy Controls for Information Systems and Organizations. These public working groups interact primarily through GitHub discussions and are supported by monthly meetings on specific topics. FedRAMP CWG – Rev5 meetings will be held the first Wednesday of every month throughout 2026 and are open to anyone in the community. 

Carahsoft supports Federal agencies by leveraging our expertise in Federal cloud security and compliance. Our team helps Federal agencies identify and acquire secure solutions from our portfolio of FedRAMP authorized CSPs. Additionally, Carahsoft provides support for our vendor partners navigating the FedRAMP authorization process, offering guidance on compliance requirements and best practices. These CWG sessions will feature discussions on updates to Rev5, vital information for professionals in the FedRAMP community. 

FedRAMP Community Working Group – 20x 

April 8, 2026 | 1:00-2:00pm ET | Virtual Event 

FedRAMP’s other CWG meeting will focus on the FedRAMP 20x program, a modernization initiative designed to streamline the Federal cloud authorization process through increased automation, reuse and community-driven approaches. The CWG will take place one week after the Phase 2, Cohort 2 FedRAMP 20x application period ends. Participants will learn more about new opportunities and approaches for CSPs when it comes to navigating the authorization process for Government cloud services. These meetings will be held on the second Wednesday of each month throughout 2026. 

As a trusted partner to Government agencies, Carahsoft facilitates access to our extensive network of FedRAMP authorized CSPs while ensuring solutions align with evolving Federal security standards. Utilizing our extensive industry expertise, Carahsoft provides critical insights and resources throughout the authorization journey to streamline the path to FedRAMP compliance. These CWG sessions offer essential updates on program developments, technical requirements and implementation strategies for secure cloud environments. 

Cloud Security Summit  

April 16, 2026 | Reston, VA | In-Person Event 

As Government agencies embrace cloud transformation, the need for secure, compliant and resilient environments has never been greater. The Public Sector Cloud Security Summit brings together Federal leaders and industry experts to share strategies for protecting sensitive data, modernizing cloud architectures and navigating evolving cybersecurity requirements. Attendees will discover practical approaches to FedRAMP modernization, alignment with Office of Management and Budget (OMB) guidance, Zero Trust implementation, automated monitoring and managing shared responsibility in multicloud and hybrid environments. Sessions will address strengthening cloud supply chain security through enhanced vendor risk management, software assurance and greater visibility across cloud service providers. 

Carahsoft is a tabletop sponsor for the Public Sector Cloud Security Summit and a proud partner of the Advanced Technology Academic Research Center (ATARC). Our team will be available throughout the event to discuss how our comprehensive portfolio of FedRAMP authorized CSPs can help agencies accelerate secure cloud modernization while maintaining compliance. 

DGI Virtual Workshop 

May 7, 2026 | 1:00-3:00pm ET | Virtual Event 

The Digital Government Institute’s (DGI) virtual workshop, Embracing Private Cloud: A Strategic Shift for Government Agencies, explores how Public Sector IT leaders can leverage private cloud architectures to drive digital transformation and modernize legacy systems. Through expert-led discussions and real-world uses cases, attendees will learn how to enable seamless migration, optimize workloads and build resilient hybrid environments tailored to Government needs. Whether planning a cloud transition or refining an existing deployment, this free workshop provides actionable guidance and best practices for IT leaders, architects and program managers driving innovation in Government. 

Carahsoft is partnering with DGI for this event to support Federal cloud security education and compliance initiatives. With an extensive portfolio of FedRAMP authorized solutions, Carahsoft is committed to assisting these educational opportunities that empower Government decision makers to confidently pursue cloud modernization. Our team will be available throughout the event to help connect attendees with the right technology for seamless, secure cloud migration.  

Offset Symposium 2026 

May 14, 2026 | Washington, DC | In-Person Event 

The Offset Symposium, hosted by Second Front, is the premier defense and GovTech event that convenes leaders from Government, the Department of War (DoW) and industry to examine how software-defined capabilities are reshaping national security. Through keynote discussions, expert panels and live technology demonstrations, Offset explores evolving cyber threats, operational challenges and emerging technologies. Sessions emphasize practical lessons learned from real deployments, offering attendees insight into how organizations are overcoming accreditation barriers, integrating commercial technology and delivering capability at scale. The symposium also spotlights FedRAMP and Government cloud compliance, underscoring FedRAMP’s role in enabling secure cloud adoption across the Federal landscape. Offset showcases FedRAMP-compliant solutions, demonstrating how accredited platforms and Development, Security and Operations (DevSecOps) pipelines are being used to deploy resilient, scalable software that supports mission-critical Government operations. 

Carahsoft partner Second Front returns with one of the year’s most anticipated events focused on accelerating defense innovation and technology adoption. As a gold sponsor, Carahsoft will showcase our broad portfolio of FedRAMP authorized CSPs and engage with defense decision makers seeking to accelerate cloud modernization while maintaining rigorous security standards. Registration for this event is now open! 

GovForward: The ATO and Cloud Security Summit 

July 23, 2026 | Washington, DC | In-Person Event 

The Authority to Operate (ATO) and Cloud Security Summit is where Government innovation meets cloud security excellence. Our eighth annual forum brings together Federal, State and Local Government leaders, alongside industry experts and solution providers, to address the evolving security, compliance and modernization challenges facing the Public Sector. The Summit offers a collaborative environment for exploring strategies to streamline the ATO process, advance secure cloud adoption and strengthen cybersecurity posture. The program features engaging keynote presentations and interactive panel discussions, designed to provide attendees with actionable insights into the latest policies, technologies and best practices shaping secure cloud adoption across the Public Sector.  

Carahsoft is proud to host GovForward: The ATO and Cloud Security Summit for the eighth consecutive year, a testament to our long-standing commitment to advancing secure cloud adoption across the Public Sector. Over the years, this summit has grown into one of the most trusted forms for Federal, State and Local leaders navigating the intersection of cloud modernization and compliance, and 2026 promises to be our most impactful year yet. GovExec is pleased to offer continuing professional education (CPE) credits through the National Association of State Boards of Accountancy (NASBA) for qualified attendees, providing valuable professional development opportunities. To get a sense of the depth and quality of programming this summit delivers, explore last year’s resources at our resource hub. Vendors interested in sponsorship opportunities are encouraged to contact us at GovForward@Carahsoft.com. Stay tuned for a detailed agenda! 

Black Hat USA 

August 1-6, 2026 | Las Vegas, NV | In-Person Event 

Black Hat USA 2026 is the premier global gathering where cybersecurity professionals, researchers and industry leaders come together to learn, share research and help shape the future of information security. The event features a comprehensive program of hands-on trainings, expert briefings and keynote sessions. Attendees will have the opportunity to explore ground-breaking research covering applied security, exploit development, malware analysis and more. Black Hat USA 2026 encourages collaboration, critical thinking and practical skill building, making it an essential event for professionals committed to staying at the forefront of information security. 

Carahsoft will be hosting a networking reception at Black Hat USA 2026, providing a great opportunity to connect with Government cloud security professionals, industry peers and FedRAMP experts. Join us for meaningful conversations about the evolution of FedRAMP and explore Carahsoft’s portfolio of secure, compliant cloud technologies. Stop by and speak with our team about the cutting-edge solutions in our portfolio that ensure sensitive Government information is secure. 

Billington CyberSecurity Summit 

September 8-10, 2026 | Washington, DC | In-Person Tradeshow 

The Billington CyberSecurity Summit 2026 is the 17th annual gathering of Government and industry cyber leaders, serving as a premier forum for Federal, State and Local cybersecurity professionals to discuss critical threats, policy developments and defense strategies. This three-day summit brings together thousands of attendees and hundreds of expert speakers across more than 40 sessions and breakout discussions to explore topics like AI integration in cybersecurity, Zero Trust architecture, threat intelligence, operational resilience and emerging defense capabilities. The event offers extensive networking opportunities, solution showcases and deep-dive sessions that address the most pressing cybersecurity challenges facing the Public Sector. Sessions have not yet been released for 2026, but previous years have covered topics ranging from AI-driven threat detection to securing critical infrastructure and implementing proactive cyber defense strategies. 

Carahsoft is committed to supporting DoW and Federal cybersecurity professionals at the Billington Cybersecurity Summit 2026 with a comprehensive resource presence featuring educational materials, expert consultations and technology demonstrations. Our cybersecurity specialists will be available throughout the three-day event to provide guidance on implementing Zero Trust frameworks, securing defense networks, addressing compliance requirements and exploring innovative solutions to combat evolving cyber threats. Visit our space to access resources tailored to DoW cybersecurity challenges, connect with solutions providers who understand defense mission requirements and engage in discussions about strengthening your organization’s cyber resilience and operational readiness.  

GovRAMP Cyber Summit 

November 15-17, 2026 | San Antonio, TX | In-Person Event 

The GovRAMP Cyber Summit brings national thought leaders, cybersecurity practitioners, policymakers and industry experts to address the most pressing security, compliance and modernization challenges facing Government today. Designed as a collaborative forum, the Summit focuses on aligning and operationalizing cybersecurity frameworks, such as FedRAMP, GovRAMP, Criminal Justice Information Services (CJIS) and more, to help agencies reduce duplication, strengthen compliance and accelerate the secure adoption of cloud and emerging technologies. Through keynote presentations and in-depth discussions, attendees will gain insight into how Government and industry leaders are working to improve reciprocity, streamline authorization processes and balance risk management with operational efficiency.  The Summist also features collaborative learning labs on topics such as AI and machine learning (ML), procurement considerations, authorization timelines and available industry tools. By bringing together voices from across Government and the Private Sector, the GovRAMP Cyber Summit empowers participants to advance secure, scalable technology adoption and strengthen cybersecurity outcomes across State and Local Government environments. 

Carahsoft will serve as the presenting sponsor of the GovRAMP Cyber Summit. With Carahsoft’s extensive portfolio of both FedRAMP and GovRAMP authorized solutions, we are uniquely positioned to support agencies navigating multi-level cloud security requirements. We look forward to connecting State and Local Government leaders with the industry-leading solutions needed to secure and strengthen their agencies’ environments. 

AWS re:Invent 

November 30-December 4, 2026 | Las Vegas, NV | In-Person Event 

Join AWS for a week of innovation, collaboration and global representation at AWS re:Invent, the company’s flagship annual conference that brings together tens of thousands of cloud professionals from around the world, including developers, architects, security leaders and business decision makers. This event serves as the stage for major AWS announcements, offering attendees early insight into the latest advancements across cloud infrastructure, AI and ML, security, compliance, data and application modernization. A series of in-depth technical sessions allows participants to explore through strategic, hands-on learning. AWS re:Invent features high-impact keynotes, targeted breakout sessions and an expansive expo floor, where attendees can engage directly with AWS partners and solution providers. 

Carahsoft partner AWS returns with re:Invent, the most impactful cloud computing event of the year. Carahsoft will be hosting a Public Sector networking reception at re:Invent 2026, providing an exclusive opportunity for Government cloud leaders to connect with peers, AWS experts and our network of FedRAMP authorized CSPs. Our team will be present, offering best practices, expert guidance and more! 

RAMPCon: Coalfire 

Date TBD | Location TBD | In-Person Event 

RAMPCon: Coalfire is a two-day, forward-thinking event filled with keynotes, expert panels and candid conversations. Bringing together leaders from Government and industry, the event will examine the evolution of FedRAMP alongside other frameworks such as CMMC and GovRAMP. Attendees will explore the growing role of automation, continuous monitoring and AI-driven security, gaining practical insight into what the next chapter Federal cloud adoption holds, from policy and authorization strategy to operational scale and resilience. 

Coalfire, a Carahsoft partner, returns in 2026 with their impactful FedRAMP event RAMPCon. With our FedRAMP expertise, Carahsoft is here to back this essential gathering of the cloud compliance community. Our team will be at the event, connecting Government agencies with the resources and solutions needed for successful FedRAMP authorization. 

As cloud technology reshapes Government operations, staying informed on FedRAMP requirements, best practices and authorized solutions is essential to secure, compliant modernization. These events offer valuable opportunities to engage with FedRAMP experts, connect with peers and discover cutting-edge cloud security solutions from authorized providers. Whether you are beginning your FedRAMP authorization, optimizing existing compliance processes or exploring new cloud capabilities, Carahsoft and our portfolio of FedRAMP-authorized CSPs stand ready to support your mission. Join us at these premier 2026 events to gain actionable insights, explore proven compliance strategies and see how Carahsoft can help you achieve secure, efficient cloud adoption that meets the highest Federal security standards. 

To learn more or get involved in any of the above events please contact us at FedRAMPMarketing@carahsoft.com. 

For more information on Carahsoft and our industry leading partners’ technology, visit our FedRAMP solutions portfolio and FedRAMP events page. 

Healthcare Cybersecurity in the Federal Government: Protecting Patient Data at Scale

Posted on by
Reply

Federal healthcare programs process millions of patient records every day. One small gap in protection could put sensitive healthcare data at risk. As a GRC or infosec leader, you understand that modern cyber threats target these systems with a dual purpose: to steal vital patient data and to lock down critical files for ransom.

These healthcare programs manage patients’ medical histories, prescriptions and payment information. Although the COVID-19 pandemic accelerated digital health initiatives to improve data protection, it also made data more attractive targets for cybercriminals.

Explore the healthcare cybersecurity challenges that Federal agencies face, along with practical ways to strengthen defenses. You’ll also discover how automation can help your team achieve cybersecurity compliance without unnecessary complications.

The Scale of Patient Data in Federal Healthcare

Federal healthcare systems, such as the Center for Medicare and Medicaid Services (CMS)  or the Veterans Affairs (VA) programs, deal with vast amounts of patient data. This could be electronic health records (EHRs), billing details or research databases that connect hospitals, clinics and vendors across the country.

A breach of this data affects not only the institution but the patients as well. It can delay timely care, disrupt healthcare services and leave patients vulnerable to the exploitation of their sensitive information.

For example, a ransomware attack on a large health system makes electronic records temporarily inaccessible. The staff has no option but to revert to paper-based processes to keep services up and running. This can result in inaccuracies and slowed care. When Federal healthcare programs are targeted, the impact can ripple across states and agencies.

Federal healthcare programs operate under strict regulations designed to protect patient data. The Health Insurance Portability and Accountability Act (HIPAA) Security Rule sets national standards for healthcare covered entities, including specific government agencies, and business associates regarding the protection of electronic health information.

For Federal use of cloud services, FedRAMP ensures that cloud providers meet rigorous security standards. Compliance lays the foundation for a structured approach to managing risks and maintaining accountability across systems.

Common Cyber Threats Federal Healthcare Organizations Face

Healthcare organizations at the Federal level face a range of cyber threats. These risks come from various sources, including employees, medical devices and external parties such as contractors and agencies. The most common include:

  • Phishing attacks targeting employees for credential theft
  • Ransomware locking down entire databases
  • Medical devices, such as imaging machines and connected monitors, introducing entry points due to inconsistent software updates or monitoring
  • Simple human mistakes, such as misconfigured access permissions or password sharing, exposing critical systems

This is why security awareness training is as important as technical defenses. If your staff is educated to proactively identify these cybersecurity threats, you can strengthen your institution’s first line of defense against them.

Implementing an automated cybersecurity platform can further help. With an efficient security tool, you can create policies that protect patient data at every step of its lifecycle.

How To Protect Patient Data at the Federal Level

When your agency maintains strong compliance practices, you are better positioned to detect and respond to threats and recover quickly from incidents. Here are ways to meet and go beyond HIPAA and protect health data at the Federal level.

Stay Prepared for Effective Incident Responses

Even with strong controls, incidents still occur. That’s why clear incident response plans are essential. These plans define roles, responsibilities and communication protocols for teams during a cyber event.

For instance, if a breach occurs in your agency’s health system, your IT, risk, compliance and leadership teams can minimize its impact with timely coordination. To make this happen, they need to regularly test their response plans to identify gaps before a real incident occurs.

You can also implement tabletop exercises in your agency. These practices allow teams to simulate ransomware attacks or data breaches to refine their decision-making skills and strategies.

Post-incident reviews are equally important. Agencies can learn from events without assigning blame.

Ensure Data Governance

Data governance is a practical approach to managing the storage, accessibility and sharing of healthcare data. It enables Federal agencies to clearly define ownership and access rights over critical patient data while establishing retention policies. This reduces confusion and improves accountability within teams.

Strong governance also supports cybersecurity compliance by ensuring that controls are applied consistently across systems. For example, your Federal agency can use a centralized platform to track who can access patient records and log any changes. This way, you can meet HIPAA and FedRAMP requirements and maintain a clear audit or incident investigation record.

Reduce Risk With Visibility and Automation

Many emerging technologies are helping Federal healthcare organizations manage cybersecurity more effectively. Centralized platforms provide visibility across multiple systems, helping security teams spot unusual activity quickly.

Moreover, automation reduces manual work and lowers the chance of human error, such as misconfigured permissions or missed updates. For instance, automated alerts can notify administrators if an unusual login occurs outside regular hours. These small interventions can prevent a minor vulnerability from escalating into a full-scale breach.

Establish Secure Digital Health Systems

Connected medical devices are essential for modern healthcare, but they require human monitoring to operate efficiently. You need processes that make sure that your digital healthcare devices are patched and configured securely. They should also support quick and smooth monitoring of any unusual behavior.

If your agency works with any third-party system, it must also meet Federal cybersecurity standards. This adds another layer of oversight to protect patient data from unexpected threats.

For example, a Federal hospital network implemented continuous monitoring of imaging devices and connected patient monitors. Its IT team uses these technologies to quickly identify and isolate potential intrusions. This enables them to protect patient data before things go south while maintaining clinical operations.

Increase Security Awareness Across the Organization

Technology alone isn’t enough. It needs the same level of collaboration from humans to efficiently protect healthcare data. For that, you need to launch security awareness programs to educate your employees on identifying phishing attempts, handling sensitive data and following proper protocols.

This step shows visible improvements in employee vigilance. Staff who understand the “why” behind security policies are more likely to follow them consistently, reducing risk for the entire organization.

Align People, Process and Technology

In cyber-resilient organizations, strong processes, capable people and reliable technology all work together to protect critical data at scale. While leadership support encourages accountability and consistency, clear procedures guide teams in responding to threats confidently.

When people, processes and technology collaborate, agencies are better prepared to handle cyberattacks. This approach also establishes an environment where patient data is protected at every step of care delivery.

How GRC Platforms Support Federal Healthcare Teams

Many Federal agencies today rely on flexible, no-code platforms that simplify risks, compliance and incident management. Healthcare teams usually include professionals who aren’t that tech-savvy. These tools allow them to track controls, document incidents and manage workflows without heavy IT involvement.

With an AI-powered GRC platform like Onspring, you can take advantage of an AI framework in healthcare to automate your agency’s repetitive tasks and centralize its information. Free up your staff from administrative work and allow them to focus on proactive security measures.

The platform scales with your agency’s needs. As healthcare programs grow or regulations evolve, your workflows can be updated without overhauling the whole system. Onspring also offers GovCloud support for Government environments for cybersecurity teams to manage and automate security-related functions.

Discover How Technology Reduces Cybersecurity Risks at the Federal Level

Removing Complexity from Compliance: Buoyant and TestifySec

Posted on by
Reply

Traditionally, achieving an Authorization to Operate (ATO) has been a grueling marathon. It often demands expensive consulting fees, lengthy manual documentation and no clear visibility into where your architecture actually stands against NIST 800-53 requirements. For organizations running cloud-native architectures on Kubernetes, this complexity is magnified. You aren’t just securing a perimeter; you’re securing hundreds of microservices communicating in real-time.

Buoyant and TestifySec are changing that narrative. By combining FIPS-validated service mesh technology with pipeline-native compliance automation, we are helping organizations and agencies shrink compliance timelines with cryptographic proof at every step.

How to meet NIST 800-53 requirements?

To sell to Government agencies or to operate within them, you need a secure product and proof of that security. Compliance frameworks like FedRAMP and FISMA both rely on the NIST 800-53 control catalog. They require both the technical implementation of security controls and verifiable evidence that validates them.

The partnership between Buoyant and TestifySec helps alleviate the resources needed to implement these controls through:

  • The Technical Foundation (Buoyant): Buoyant Enterprise for Linkerd provides automatic mutual TLS (mTLS) encryption for all service-to-service communication. Additionally, it uses FIPS 140-2/140-3 validated cryptographic modules, satisfying strict Federal requirements for data in transit, and provides a FIPS dashboard to simplify the auditing process.
  • The Compliance Automation Layer (TestifySec): Even with encryption in place, proving it to auditors can take months. TestifySec automates this by capturing cryptographically-signed attestations directly from CI/CD pipelines—including evidence of Linkerd’s encryption configurations. These attestations map to NIST 800-53 controls and generate System Security Plans (SSPs) in OSCAL format, replacing manual screenshots and developer surveys with tamper-evident proof.

Why are Buoyant and TestifySec better together?

Whether you are a software vendor seeking FedRAMP authorization or a Federal agency modernizing under FISMA guidelines, this partnership offers three distinct advantages:

  1. Velocity Without Friction: Linkerd provides automatic mTLS for all in-cluster traffic, covering both the control plane and data plane without requiring changes to application code. TestifySec captures attestations for these configurations automatically—no screenshots or developer surveys required.
  2. Continuous Compliance: Compliance isn’t a “one and done” event. TestifySec provides ongoing validation and automated reporting alongside Linkerd’s FIPS dashboard that offers real-time proof of encryption and readily available CMVP numbers for auditors.
  3. Simplified Procurement: Both Buoyant and TestifySec are available through Carahsoft, making it easier to leverage existing contract vehicles to acquire the full solution and removing red tape from the purchasing process.

 

The shift to Kubernetes shouldn’t be a compliance hurdle. By combining the world’s fastest, lightest FIPS-validated service mesh with pipeline-native compliance automation, Buoyant and TestifySec are making the Federal market accessible to the next generation of innovators and helping agencies secure their missions faster.

Learn more about FIPS-validated encryption with Buoyant and the partnership with TestifySec.

Carahsoft Technology Corp. is The Trusted Government IT Solutions Provider, supporting Public Sector organizations across Federal, State and Local Government agencies and Education and Healthcare markets. As the Master Government Aggregator for our vendor partners, including Buoyant, we deliver solutions for Geospatial, Cybersecurity, MultiCloud, DevSecOps, Artificial Intelligence, Customer Experience and Engagement, Open Source and more. Working with resellers, systems integrators and consultants, our sales and marketing teams provide industry leading IT products, services and training through hundreds of contract vehicles. Explore the Carahsoft Blog to learn more about the latest trends in Government technology markets and solutions, as well as Carahsoft’s ecosystem of partner thought-leaders.

FedRAMP 20x: Modernizing Cloud Security Authorization Through Automation and Continuous Assurance

Posted on by
Reply

FedRAMP authorization has long required extensive documentation, static point-in-time assessments and timelines of 18–24 months. This approach has slowed innovation for Federal agencies seeking secure cloud solutions and for vendors pursuing Government contracts.

FedRAMP 20x reimagines authorization through automation, machine-readable evidence and continuous monitoring, shifting compliance from document-driven processes to data-driven assurance. It also reshapes how Federal agencies, Cloud Service Providers (CSPs) and Third-Party Assessment Organizations (3PAOs) collaborate to secure Government environments.

The Shift from REV 5 to 20x

Traditional FedRAMP authorization follows a linear, document-heavy process where CSPs write extensive System Security Plans (SSPs), undergo annual assessments and exchange static artifacts with 3PAOs. FedRAMP 20x maintains the same security requirements from National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53 Revision 5 (REV 5) but transforms how evidence is validated. Instead of screenshots or single-moment spreadsheets, 20x uses logs, configuration files and automated integrations that reflect real-time security posture. This enables continuous assurance, with systems remaining audit-ready and controls validated through actual telemetry and configuration baselines.

The result is a more dynamic, risk-focused model that moves beyond top-down waterfall processes that often obscure security conditions.

Modernized Compliance

FedRAMP 20x requires robust compliance automation built on five pillars:

  1. Control normalization
  2. Engineering
  3. Infrastructure
  4. Evidence generation
  5. Reporting

Controls must be technically engineered into Continuous Integration/Continuous Deployment (CI/CD) pipelines, an approach often described as “compliance-as-code.” Supporting infrastructure must generate evidence in a reliable, machine-readable format such as NIST Open Security Controls Assessment Language (OSCAL) or JavaScript Object Notation (JSON) so CSPs, agencies and 3PAOs can share data rather than documents. This approach transforms compliance work from writing narratives and taking screenshots to building monitoring systems that continuously validate control effectiveness.

While artificial intelligence (AI) tools are emerging as assistants, the foundation remains consistent instrumentation and automated evidence collection. Organizations must invest in platforms capable of real-time logging, automated vulnerability scanning, Application Programming Interface (API)-driven evidence collection and continuous control monitoring, moving beyond spreadsheets or basic ticketing systems to true automated Governance, Risk and Compliance (GRC).

Maintaining Security Standards

FedRAMP 20x reduces the barriers to entry for small CSPs. Under the traditional REV 5 model, many providers faced prohibitive costs and timelines, often waiting indefinitely for Joint Authorization Board (JAB) review without agency sponsorship. The 20x pilot eliminates this sponsor requirement and accelerates review: organizations using automation have achieved authorization in six months.

RegScale, FedRAMP 20x blog, embedded image, 2025

RegScale, leveraging its own platform with features like automated evidence collection and AI-assisted control validation, completed its SSP and evidence in approximately three weeks and achieved full authorization within six months of audit start. This acceleration does not weaken security; rather, continuous monitoring and real-time evidence provide greater assurance than annual snapshots.

Another benefit of the 20x approach is that the machine-readable evidence can be reused for other frameworks, enabling a “certify once and comply many” approach across:

  • System and Organization Controls 2 (SOC 2)
  • International Organization for Standardization (ISO) 27001
  • Cloud Security Alliance (CSA) Security, Trust, Assurance and Risk (STAR)

For cloud-native organizations already operating with infrastructure as code (IaC) and automated pipelines, 20x aligns Federal compliance with modern DevSecOps practices.

Cultural and Organizational Change Management

The greatest challenge with FedRAMP 20x is cultural, not technological. Many organizations already possess the necessary tools but continue to rely on manual processes built over 15–20 years. Shifting to automation requires replacing “no hope” environments, where compliance is viewed as endless documentation, with the recognition that more efficient, sustainable operations are both possible and necessary.

Teams must actively retrain themselves to think operationally rather than as checklist validators. The transition also requires breaking down silos between security and compliance teams, agencies and 3PAOs, ensuring all stakeholders rely on the same real-time telemetry instead of debating the meaning of outdated screenshots. Federal agencies must also educate risk owners and embrace new evidence formats and methodologies. Ultimately, this is as much an organizational transformation as a technical one.

Continuous Monitoring and Real-Time Risk Management

FedRAMP 20x redefines relationships between CSPs, agencies and 3PAOs by replacing periodic reviews with continuous monitoring and near real-time risk visibility. Instead of exchanging PDFs, stakeholders share dashboards, datasets and evidence repositories that all parties can access. Auditors can review assessments based on evidence collected minutes or hours ago rather than relying on outdated artifacts.

Continuous monitoring supports 20x by allowing agencies to track configuration drift, Plan of Action and Milestone (POA&M) status and control effectiveness in regular cadences. The definition of “continuous” varies by control type; some require minute-by-minute validation, while policy controls may be quarterly or semi-annual.

For agencies, continuous assurance delivers better risk management capabilities, but only if they invest time in understanding how to interpret machine-readable formats such as OSCAL. Adoption varies, with some agencies already capable while others continue developing this capacity.

Moving Forward with Confidence

FedRAMP 20x is a strategic shift that aligns Federal authorization with modern DevSecOps, delivering faster innovation without reducing security standards. Since launching in March 2025, the pilot has processed 27 submissions and granted 13 authorizations, demonstrating scalability and viability.

With 20x, agencies gain improved risk visibility, reduced vendor timelines and access to innovative cloud solutions previously delayed by lengthy authorizations. However, success is not guaranteed. It requires adopting continuous assurance, investing in platforms that support machine-readable evidence and educating risk owners to interpret dynamic data. CSPs must centralize systems of record, instrument environments for continuous evidence collection and adopt standardized mappings that facilitate automation.  

The organizations that thrive will be those that use FedRAMP 20x as a motivator to replace outdated habits, engineer controls properly and embrace automation as an enhancement, not a replacement, of human expertise.

Discover how FedRAMP 20x is transforming Federal cloud authorization by watching the webinar, “FedRAMP 20x in Motion: What Early Results Mean for Federal Agencies,” featuring insights from RegScale and the CSA.

Carahsoft Technology Corp. is The Trusted Government IT Solutions Provider, supporting Public Sector organizations across Federal, State and Local Government agencies and Education and Healthcare markets. As the Master Government Aggregator for our vendor partners, including RegScale, we deliver solutions for Geospatial, Cybersecurity, MultiCloud, DevSecOps, Artificial Intelligence, Customer Experience and Engagement, Open Source and more. Working with resellers, systems integrators and consultants, our sales and marketing teams provide industry leading IT products, services and training through hundreds of contract vehicles. Explore the Carahsoft Blog to learn more about the latest trends in Government technology markets and solutions, as well as Carahsoft’s ecosystem of partner thought-leaders.

Maximize Federal Data Protection with Commvault’s End-of-Fiscal-Year Bundle 

Posted on by
Reply

As Federal agencies approach the final stretch of fiscal year 2025, the challenge of securing comprehensive data security coverage while maximizing remaining budget dollars has become increasingly critical. Commvault has partnered with Carahsoft to deliver a strategic end-of-fiscal-year opportunity that combines substantial cost savings with the highest level of Federal security authorization available in the data protection market. 

Consolidating Data Protection Under a Single Platform 

Federal agencies often work with a range of vendors to meet their diverse data protection needs, which can introduce added complexity, training considerations and operational demands. Commvault’s Data Protection Bundle addresses this challenge by unifying data protection, Active Directory protection and air-gapped data security capabilities under one comprehensive platform. 

This consolidation approach delivers measurable operational benefits that extend beyond cost reduction. Agencies can significantly minimize the time required for deployment and training, reduce management costs and improve their response capabilities during critical events such as ransomware attacks or data loss incidents. When every minute counts in a recovery scenario, having a unified platform can mean the difference between rapid restoration and extended downtime. 

Setting the Security Standard with FedRAMP High Authorization 

Federal agencies operate under stringent security requirements that often limit their technology choices, particularly when handling sensitive or classified information. Commvault distinguishes itself as the only data protection provider to achieve FedRAMP High authorization while maintaining availability across all major cloud platforms. 

This security credential represents the highest level of authorization available for cloud services serving Government customers, demonstrating Commvault’s ability to meet the most demanding Federal security standards. For agencies required to maintain strict compliance protocols, this authorization eliminates the complexity of lengthy security evaluations while ensuring their data protection solution meets or exceeds all regulatory requirements. 

Simplifying Deployment Across Diverse Government Environments 

Government agencies face unique infrastructure challenges, from legacy on-premises systems to modern cloud deployments, often with varying levels of technical resources and expertise. Commvault’s unified platform architecture addresses these challenges by maintaining consistency across all deployment scenarios—whether on-premises, cloud, virtual or physical environments. 

Since the underlying code remains consistent across all implementations, agencies experience significantly reduced deployment times compared to managing multiple vendor solutions. This consistency also translates to streamlined training processes and lower administrative overhead, particularly valuable for agencies with limited technical staff or those supporting geographically distributed operations. 

Leveraging Strategic Procurement Advantages 

The Data Protection Bundle is readily available through General Services Administration (GSA) Schedule contracting, providing Federal buyers with the streamlined procurement process they understand and trust. This availability is enhanced by Carahsoft’s partnership with Commvault to offer additional savings of up to 60% off manufacturer’s suggested retail price (MSRP)—savings that stack on top of existing GSA Schedule discounts that agencies have historically leveraged. 

While the focus remains on end-of-fiscal-year procurement opportunities, Commvault has committed to honoring this pricing structure through the end of the calendar year, providing agencies with flexibility in their planning and implementation timelines. 

Supporting Widespread Federal Adoption 

Commvault’s platform is already deployed across numerous Federal agencies, spanning both Department of Defense (DoD) and civilian organizations. Many of these agencies utilize Commvault to protect shared environments through a single unified platform, demonstrating the solution’s ability to scale across diverse Government requirements while maintaining the security boundaries and operational control that Federal organizations require. 

This existing Federal footprint provides new adopters with confidence in the platform’s proven ability to meet government-specific mandates while offering opportunities for knowledge sharing and best practice development across agency lines. 

Federal agencies looking to strengthen their data protection capabilities while maximizing end-of-fiscal-year budget efficiency should evaluate how Commvault’s comprehensive bundle addresses their mission-critical requirements. With proven FedRAMP High authorization, substantial cost savings and streamlined GSA procurement, this solution offers a strategic pathway to enhanced data security and operational efficiency. 

Visit Commvault’s FedRAMP page to discover how this end-of-fiscal-year opportunity can strengthen your agency’s data protection strategy and deliver significant cost savings. 

Carahsoft Technology Corp. is The Trusted Government IT Solutions Provider, supporting Public Sector organizations across Federal, State and Local Government agencies and Education and Healthcare markets. As the Master Government Aggregator for our vendor partners, including Commvault we deliver solutions for Geospatial, Cybersecurity, MultiCloud, DevSecOps, Artificial Intelligence, Customer Experience and Engagement, Open Source and more. Working with resellers, systems integrators and consultants, our sales and marketing teams provide industry leading IT products, services and training through hundreds of contract vehicles. Explore the Carahsoft Blog to learn more about the latest trends in Government technology markets and solutions, as well as Carahsoft’s ecosystem of partner thought-leaders.

Palo Alto Networks Cortex Cloud™ — Unified Efficiency, Now with Dual FedRAMP Authority

Posted on by
Reply

In a testament to its commitment to secured and streamlined cloud security, Palo Alto Networks Cortex Cloud™ has already achieved FedRAMP High and Moderate authorizations since launching in February 2025. This significant milestone positions Cortex Cloud as the only CNAPP in the FedRAMP Marketplace holding both High and Moderate designations, underscoring its unique ability to cater to the diverse security needs of the U.S. Government.

The Federal Risk and Authorization Management Program (FedRAMP) is the Government’s rigorous standard for assessing, authorizing and continuously monitoring cloud services. By achieving both High and Moderate authorizations, Cortex Cloud demonstrates its adherence to stringent security controls, paving the way for Federal agencies to confidently adopt its innovative platform.

Unlocking Efficiency Through a Unified Security Platform

At a time when Government agencies are prioritizing modernization and efficiency, Cortex Cloud offers a powerful, unified solution. As the next generation of Prisma® Cloud, it transcends traditional, siloed security tools by integrating best-in-class cloud detection and response (CDR) with industry-leading, cloud-native application protection platform (CNAPP) capabilities.

This platform-centric approach delivers measurable benefits:

  • Streamlined Procurement – By choosing Cortex Cloud with FedRAMP High authorization to secure your environment, agencies can bypass the complexities and delays of redundant security assessments.
  • Reduced Complexity and Risk – By integrating security across the entire cloud lifecycle (from code to cloud to SOC) Cortex Cloud eliminates the operational overhead and potential vulnerabilities associated with managing disparate security tools.
  • Enhanced Operational Efficiency – The unified platform provides comprehensive visibility and context, enabling security teams to prioritize risks effectively, automate responses and reduce the mean time to respond (MTTR) to threats.
  • Intelligent Risk Reduction – Cortex Cloud’s cloud posture security capabilities offer agentless visibility and intelligently group-related issues, empowering security teams to focus on the most critical risks with minimal effort.
  • Proactive Threat Prevention – Stop attacks in real time with cloud detection and response (CDR), maintaining the integrity and availability of Government systems, as breaches are prevented before impacting mission-critical operations.
  • Securing the Application Lifecycle – Cortex Cloud’s application security features enable agencies to identify and remediate vulnerabilities in the software supply chain, preventing risks from ever reaching production.

Meeting Diverse Government Needs with a Single, Powerful Platform

The dual FedRAMP High and Moderate authorizations empower Cortex Cloud to address a wide spectrum of Government requirements:

  • FedRAMP High – For the most sensitive, unclassified data where compromise could severely impact national security, economic stability or public safety. Cortex Cloud meets over 400 rigorous security controls for mission-critical applications.
  • FedRAMP Moderate – For Federal information where loss of confidentiality, integrity or availability would have serious adverse effects. Cortex Cloud adheres to over 300 security controls, suitable for a broad range of data, including PII.

Furthermore, Cortex Cloud’s GovRAMP High and Moderate certifications highlight its commitment to serving State and Local Governments with equally robust and efficient cloud security solutions.

Driving Productivity and Cost Savings

The U.S. Government’s focus on maximizing efficiency and productivity aligns perfectly with the benefits offered by Cortex Cloud’s unified platform.

By consolidating security functions and providing intelligent insights, Cortex Cloud helps agencies:

  • Optimize Resources – Security teams can operate more efficiently, focusing on strategic initiatives rather than managing a complex web of point solutions.
  • Improve Security Outcomes – Comprehensive visibility and integrated threat intelligence lead to a stronger security posture and reduced risk of costly breaches.
  • Accelerate Cloud Adoption – Agencies can confidently embrace the scalability and flexibility of the cloud while maintaining the highest security standards.

Cortex Cloud’s FedRAMP High and Moderate authorizations are more than just certifications; they represent a commitment to providing Government agencies with an efficient, unified and highly secure cloud security platform. By streamlining operations, reducing complexity and delivering comprehensive protection, Cortex Cloud empowers the U.S. Government to achieve its modernization goals while safeguarding its most critical assets.

Secured in America. Built for Government.

Headquartered in California, Palo Alto Networks proudly celebrates two decades of cybersecurity innovation and leadership. Across the United States, we employ more than 8,800 people in 49 states with physical offices in California, New York, Texas and Virginia. Championing American production excellence, we assemble all of our hardware firewalls in the United States, with our primary assembly and fulfillment center located in Texas. With over $1.8 billion in annual R&D, Palo Alto Networks is driving continuous innovation to maintain American technological leadership and excellence.

Learn more about our commitment to serve Federal organizations as the Government’s cybersecurity partner of choice.

Carahsoft Technology Corp. is The Trusted Government IT Solutions Provider, supporting Public Sector organizations across Federal, State and Local Government agencies and Education and Healthcare markets. As the Master Government Aggregator for our vendor partners, including Palo Alto Networks, we deliver solutions for Geospatial, Cybersecurity, MultiCloud, DevSecOps, Artificial Intelligence, Customer Experience and Engagement, Open Source and more. Working with resellers, systems integrators and consultants, our sales and marketing teams provide industry leading IT products, services and training through hundreds of contract vehicles. Explore the Carahsoft Blog to learn more about the latest trends in Government technology markets and solutions, as well as Carahsoft’s ecosystem of partner thought-leaders.

Meeting the AI Mandates with Confidence: Why Federal Teams Trust Snyk

Posted on by
Reply

Federal agencies are moving fast to unlock the potential of AI—from improving citizen services to driving mission outcomes. But with all that innovation comes a new wave of complexity and risk.  Security, trust, and transparency can’t be afterthoughts. They need to be part of the build process from day one.  That’s where Snyk for Government comes in—now FedRAMP authorized, we’ve taken it even further with the launch of the Snyk AI Trust Platform May 2025. 

AI isn’t magic. It’s built on code, containers, infrastructure templates, and APIs—and increasingly, it’s generating code on its own, generating 40% more vulnerabilities than human developers. Agencies need to track, fix, and manage continuously.  With Snyk, you can shift left and Secure-by-Design:

  • Spot and fix risks early—automatically and at scale
  • Keep developers moving fast while staying compliant
  • Build AI systems that are secure from the ground up

Meet the Snyk AI Trust Platform

Launched in May 2025, the Snyk AI Trust Platform is the first of its kind: an AI-native, agentic security platform designed for how modern teams build today. It gives agencies the tools to move quickly without compromising trust.

This isn’t just DevSecOps—it’s security built for the era of AI-driven, autonomous software development.

How Snyk is supporting new federal AI mandates

Trusted, Transparent AI Development

As agencies embrace AI, expectations around objectivity and transparency are front and center. Snyk helps teams meet those expectations with tools that focus on real technical risks—not subjective filters.

  • Credible vulnerability intelligence: Sourced from standards-based orgs like CVE, CWE, and NIST
  • Customizable policy enforcement: Agencies stay in full control with Snyk Guard’s real-time, no-bias policy engine
  • Integrated into your pipeline: From GitHub to Terraform to container registries—Snyk fits your workflow, not the other way around

 Scaling Secure AI Infrastructure

New funding and fast-tracked initiatives mean federal developers need security tools that keep up.

  • FedRAMP authorized: Snyk is cleared for use across federal cloud environments
  • Automation where it counts: Agentic tools like Snyk Assist and Snyk Agent surface issues and fix them before they ship

 Building Export-Ready, Trusted AI Systems

As global collaboration increases, secure supply chains are more important than ever. Snyk helps you ship software that’s secure, auditable, and globally trusted.

  • Standards-aligned: Support for SBOMs, AIBOMS, international compliance, and NIST-aligned policies
  • Agentic AI security: Governance that scales to GenAI assistants and LLMs—wherever and however they run
  • Broad ecosystem support: Integrates with the open tools your dev teams already use

Whether you’re modernizing legacy systems, launching new GenAI services, or strengthening cross-agency pipelines, Snyk helps federal teams move fast, stay secure, and build trust into every line of code.

? Ready for a tailored AI readiness assessment?
 Let’s talk: federal@snyk.io

Carahsoft Technology Corp. is The Trusted Government IT Solutions Provider, supporting Public Sector organizations across Federal, State and Local Government agencies and Education and Healthcare markets. As the Master Government Aggregator for our vendor partners, including Snyk, we deliver solutions for Geospatial, Cybersecurity, MultiCloud, DevSecOps, Artificial Intelligence, Customer Experience and Engagement, Open Source and more. Working with resellers, systems integrators and consultants, our sales and marketing teams provide industry leading IT products, services and training through hundreds of contract vehicles. Explore the Carahsoft Blog to learn more about the latest trends in Government technology markets and solutions, as well as Carahsoft’s ecosystem of partner thought-leaders.

Breaking Down Barriers: How SAS and Carahsoft Are Making Trustworthy AI More Accessible to Government Agencies

Posted on by
Reply

Government agencies face a unique challenge when it comes to adopting new technologies: they need cutting-edge capabilities, but they also need absolute certainty that those tools meet the highest security and compliance standards. For AI and analytics, this balance has historically been difficult to achieve—until now.

A Major Milestone for Government AI Access

Data and AI leader SAS has achieved FedRAMP® and GovRAMP (formerly StateRAMP®) authorization for SAS® AI and Analytics for Government. Alongside its partner Carahsoft, SAS empowers Government agencies to improve efficiency, reduce risk and enhance data security with SAS® Viya®, its cloud-native data and AI platform.

Enhanced Access to Dependable AI in the Cloud

FedRAMP is a Government-wide program that establishes a standardized approach to security assessment, authorization and continuous monitoring for cloud products and services to ensure the protection of Federal information. GovRAMP, a nationally recognized risk authorization management program, provides a standardized approach to assessing cloud products. With these authorizations, even more Government agencies can use SAS Viya in the cloud operationalize predictive analytics and AI regardless of whether code is developed in SAS or open source. SAS has served as a trusted Government technology provider for nearly five decades and is used in all 15 executive departments of the US Federal Government and all 50 states.

Trust and Transparency at the Core

SAS Viya incorporates trustworthy AI capabilities such as bias detection, explainability, decision auditability and model monitoring, governance and accountability, boosting confidence in Government agencies’ responsible AI initiatives.

This accomplishment demonstrates SAS’ steadfast commitment to providing a secure and reliable solution that Government agencies can rely on to safeguard their data and operations.

“SAS understands that security is table stakes for being a government partner. Security and trust always come first, followed closely by value, innovation and the ability to solve the most pressing problems. That’s what SAS has helped governments with for nearly 50 years” said Ben Stuart, Vice President, US Public Sector at SAS. “These certifications are further evidence of this commitment, and we’re looking forward to bringing SAS Viya to even more Government customers to help them reach their goals and make an impact.”

SAS and Carahsoft’s Partnership Delivers Advanced Software to Government Agencies

The strategic agreement between the two technology leaders designates Carahsoft as a SAS Public Sector distributor, making SAS’ data and AI solutions accessible to US Government agencies through Carahsoft’s reseller partners and various contract vehicles and Government schedules. Through this partnership, Government customers can efficiently acquire SAS products and solutions, including cutting-edge, AI-optimized analytics tools for proactive response to evolving Public Sector challenges. 

With a legacy in Government dating back to the company’s founding in 1976, SAS software is used in more than 1,600 Public Sector departments, ministries and agencies in more than 130 countries worldwide. Recognized as a leading software distributor in the market, Carahsoft provides expanded scale and reach to SAS’s products and solutions, including SAS Viya, across the Public Sector.

Looking Ahead: Empowering Data-Driven Government

SAS, in partnership with Carahsoft, is dedicated to empowering Government agencies with data and AI solutions. SAS and Carahsoft help Government agencies to make informed decisions, optimize operations and enhance public services. SAS and Carahsoft are committed to driving positive change and delivering measurable results for the Public Sector.

Ready to explore how SAS can support your agency’s data and AI initiatives? Learn more about SAS public sector analytics, including FedRAMP and GovRAMP certifications.

Carahsoft Technology Corp. is The Trusted Government IT Solutions Provider, supporting Public Sector organizations across Federal, State and Local Government agencies and Education and Healthcare markets. As the Master Government Aggregator for our vendor partners, including SAS we deliver solutions for Geospatial, Cybersecurity, MultiCloud, DevSecOps, Artificial Intelligence, Customer Experience and Engagement, Open Source and more. Working with resellers, systems integrators and consultants, our sales and marketing teams provide industry leading IT products, services and training through hundreds of contract vehicles. Explore the Carahsoft Blog to learn more about the latest trends in Government technology markets and solutions, as well as Carahsoft’s ecosystem of partner thought-leaders.

Powering the OneGov Mission with a New GSA Offer for Slack

Posted on by
Reply

The U.S. General Services Administration (GSA) has set a bold new direction for Federal procurement with its OneGov Strategy—a transformative mission to modernize how the Government buys and uses technology. The goal is clear: act as one unified enterprise to reduce costs, improve security, enhance productivity and eliminate the fragmented, agency-by-agency purchasing of the past.


Achieving this vision requires powerful, secure and commercially available tools that can be acquired and deployed with minimal friction. Salesforce is supporting the OneGov mission by making Slack’s FedRAMP-authorized collaboration platform more accessible and affordable for every Federal agency.

Unifying Agencies to Operate as a Shared Enterprise


A core tenet of the OneGov strategy is breaking down silos to help the Government function as a single, coordinated enterprise. Slack is purpose-built for this reality. By moving communication from isolated inboxes into organized, searchable channels, Slack creates a transparent environment for collaboration. More importantly, Slack Connect extends this capability across agency lines, allowing for secure, real-time collaboration with other Government entities and external partners. This directly addresses the OneGov goal of unifying the Federal workforce, ensuring that inter-agency teams can operate with the same speed and alignment as internal ones, all within a controlled and auditable platform.

Enhancing Productivity and Accelerating AI Adoption


The OneGov initiative calls for agencies to leverage modern technology to enhance efficiency. Slack delivers on this with powerful, user-friendly features, such as:

  • Workflow Builder, which empowers teams to automate routine processes like approvals and status updates without writing a single line of code, freeing up personnel for mission-critical work.
  • Slack AI, which provides a secure pathway to accelerate artificial intelligence (AI) adoption. Agencies can instantly leverage AI to summarize complex discussions, get immediate answers from internal knowledge bases and draft communications more efficiently.

These tools provide the tangible productivity gains and advanced capabilities needed to build a smarter, more effective Government.

Reducing Costs Through Centralized, Streamlined Procurement


The Salesforce and GSA agreement for Slack is a prime example of the OneGov strategy in action. By establishing a single, Government-wide agreement with transparent, pre-negotiated pricing, we are helping the GSA eliminate duplicative contracts and leverage the full buying power of the Federal Government.


Through November 30, 2025, your agency can access this strategic offer via the GSA Schedule (Contract: 47QSWA18D008F). With no minimum quantities and pricing structured to be Government Purchase Card (GPC) friendly, this offer dramatically reduces procurement friction and empowers teams to quickly acquire the tools they need to support their mission.

This GSA promotion is more than a discount; it is an opportunity to align your agency’s collaboration strategy with the forward-thinking vision of OneGov. It’s a chance to equip your teams with a best-in-class platform that is secure, efficient and cost-effective.


Carahsoft and our partners are committed to helping you navigate this streamlined procurement process. We are ready to provide a quote, schedule a personalized demo and help you realize the full potential of Slack in achieving your agency’s modernization goals.


Ready to join the OneGov movement and transform how your agency collaborates?
Contact our Salesforce team at Carahsoft today or call us at (877) SFDC-007 to learn more and take advantage of this limited-time offer.

Carahsoft Technology Corp. is The Trusted Government IT Solutions Provider, supporting Public Sector organizations across Federal, State and Local Government agencies and Education and Healthcare markets. As the Master Government Aggregator for our vendor partners, including Salesforce we deliver solutions for Geospatial, Cybersecurity, MultiCloud, DevSecOps, Artificial Intelligence, Customer Experience and Engagement, Open Source and more. Working with resellers, systems integrators and consultants, our sales and marketing teams provide industry leading IT products, services and training through hundreds of contract vehicles. Explore the Carahsoft Blog to learn more about the latest trends in Government technology markets and solutions, as well as Carahsoft’s ecosystem of partner thought-leaders.

Comprehensive Identity Security: 1Kosmos Achieves FedRAMP High Authorization and Kantara Certification

Posted on by
Reply

As cybersecurity demands increase across all levels of Government, 1Kosmos’s credential service provider (CSP) platform represents a shift in how agencies approach identity verification and authentication. Rather than forcing agencies into rigid, one-size-fits-all solutions, the platform offers unprecedented flexibility through its modular architecture. Organizations can deploy everything from simple document capture for in-person verification to comprehensive digital identity wallets that put end-users in complete control of their personal information.

This adaptability proves crucial for Government agencies with diverse operational requirements. Some organizations need only Identity Assurance Level 2 (IL2) workflow integration with existing identity providers like Okta or Microsoft, while others require the full spectrum of identity verification, digital wallet creation and Authenticator Assurance Level 2 (AL2) authentication capabilities. The platform’s ability to scale from basic document verification to complete identity lifecycle management ensures agencies can start with their immediate needs and expand functionality as requirements evolve.

The Power of Dual Certification

As the only CSP to achieve both FedRAMP High authorization and Kantara certification, 1Kosmos has established itself as the definitive solution for Government agencies seeking uncompromising identity security. This dual certification creates a security foundation unmatched in the identity verification space and works in concert to address both the “what” and “how” of secure digital identity management. Kantara certification, based on National Institute of Standards and Technology (NIST) 800-63-3 digital identity guidelines, validates that the platform operates according to the gold standard for identity verification processes and procedures.

FedRAMP High authorization takes security to the next level, implementing over 400 security controls based on NIST 800-53 standards. This represents the most stringent civilian agency security requirements available, with only 20 additional controls separating High from IL4 defense-level certification. The comprehensive nature of these controls means agencies receive verified, not just claimed, security hardening that has undergone rigorous third-party assessment.

This dual certification approach provides Government buyers with unprecedented assurance. While other solutions may meet basic compliance requirements, 1Kosmos offers the most verified hardening available in the market. For agencies navigating complex procurement requirements across Federal, State and Local levels, this certification combination simplifies vendor evaluation and reduces compliance risk. The FedRAMP High baseline ensures smooth flow-down compliance for State and Local implementations, eliminating the complexity of multiple security assessments.

Security and Privacy by Design

True security extends far beyond meeting regulatory checkboxes, and 1Kosmos has embedded privacy and security principles into every aspect of the platform’s architecture. The decision to pursue FedRAMP High from the outset reflects a commitment to protecting what 1Kosmos considers the highest-value data in existence: end-user personally identifiable information (PII).

1Kosmos, 1Kosmos Achieves FedRAMP High Authorization and Kantara Certification, blog, embedded image, 2025

Every piece of data within the 1Kosmos environment undergoes Federal Information Processing Standards (FIPS) 140-3 encryption both in transit and at rest. This is not merely a compliance requirement—it is a recognition that Government agencies entrust identity platforms with irreplaceable citizen information. The platform employs a unique double-encryption approach for digital wallets, where identity evidence receives initial encryption before being secured again within the user’s wallet, with encryption keys remaining under end-user control exclusively.

The platform operates on a privacy-first data retention philosophy. By default, the system processes identity data, stores only what is necessary for wallet creation and immediately deletes excess information. This approach ensures that data remains in the system only as long as operationally required, with automatic deletion on specified retention dates. The platform’s architecture makes it impossible for 1Kosmos or their customers to access end-user wallet data without explicit user consent, creating true user sovereignty over personal information.

What is More Valuable Than Identity?

The question of data value reveals why identity security demands such rigorous protection. In commercial contexts, student records command higher dark web prices than credit card or healthcare information due to the extended window before detection—students typically do not monitor credit for years after graduation. This extended vulnerability period makes educational identity data particularly attractive to cybercriminals and highlights why robust identity verification is essential across all Government sectors.

Government agencies face even higher stakes. Beyond financial fraud, identity compromise can affect national security, citizen services and public trust. The 1Kosmos platform addresses these concerns through continuous security monitoring and automated threat detection capabilities that immediately alert administrators to potential security issues. This proactive approach, combined with comprehensive logging and audit capabilities, ensures agencies maintain complete visibility into their identity security posture.

The platform’s global deployment success stories demonstrate scalability and reliability under real-world conditions. One global business process outsourcing company successfully transitioned half their worldwide user base to 1Kosmos authentication within just two months, showcasing the platform’s ability to handle massive-scale implementations without compromising security or performance.

Building the Future of Government Identity Security

As Government agencies accelerate digital transformation initiatives, the need for trustworthy, scalable identity solutions becomes increasingly critical. The 1Kosmos platform provides the security foundation necessary for agencies to confidently expand digital services while maintaining the highest protection standards for citizen data. With plans to extend certification to IL4 levels for defense customers, 1Kosmos continues pushing the boundaries of what is possible in Government identity security.

Learn more about how 1Kosmos can transform your agency’s identity security posture by exploring their comprehensive platform capabilities and certification achievements.

Carahsoft Technology Corp. is The Trusted Government IT Solutions Provider, supporting Public Sector organizations across Federal, State and Local Government agencies and Education and Healthcare markets. As the Master Government Aggregator for our vendor partners, including 1Kosmos we deliver solutions for Geospatial, Cybersecurity, MultiCloud, DevSecOps, Artificial Intelligence, Customer Experience and Engagement, Open Source and more. Working with resellers, systems integrators and consultants, our sales and marketing teams provide industry leading IT products, services and training through hundreds of contract vehicles. Explore the Carahsoft Blog to learn more about the latest trends in Government technology markets and solutions, as well as Carahsoft’s ecosystem of partner thought-leaders.