CSP_A_FedRAMP_Authorization_Boundary_Guidance.pdf

KEY CONCEPTS

The concepts below provide an overview of various terms and definitions outlined in NIST SP 800-37 and OMB A-130 and provide guidance from the FedRAMP PMO.

PURPOSE: The purpose of this document is to provide Cloud Service Providers (CSPs) further guidance for developing the “authorization boundary” associated with their Cloud Service Offering (CSO) to support their FedRAMP Authorization package. An authorization boundary provides a diagrammatic illustration of a CSP’s internal services, components, and other devices along with connections to external services and systems. An authorization boundary accounts for all federal information, data, and metadata that flows through a CSO. The authorization boundary is a critical component associated with the federal National Institute of Standards and Technology (NIST) Special Publication (SP) 800-37, Guide for Applying the Risk Management Framework (RMF) to Federal Information Systems and Office of Management and Budget (OMB) circular A-130, Managing Information as a Strategic Resource.

This document will act as a “living document,” evolving with changes to cloud computing technology and federal information security policy relevant to FedRAMP.

Defining Your Authorization Boundary in the Cloud

Federal Definition: OMB A-130 defines an authorization boundary as “all components of an information system to be authorized for operation by an authorizing official.

This excludes separately authorized systems to which the information system is connected.”

FedRAMP Guidance: An authorization boundary for cloud technologies should describe a cloud system’s internal components and connections to external services and systems. The authorization boundary accounts for the flow of all federal information and metadata through the system. A cloud authorization boundary illustrates a CSP’s scope of control over the system as well as any system components or services that are leveraged from external services or controlled by the customer.

Federal Information (Data) in the Cloud

Federal Definition: OMB A-130 describes federal information as “information created, collected, processed, maintained, disseminated, disclosed, or disposed of by or for the Federal Government, in any medium or form.”

FedRAMP Guidance: CSPs should account for and include within an authorization boundary all federal data populated or generated by a federal customer within the CSO, including metadata (see Key Concept #3).

Metadata Associated with the Cloud

Federal Definition: NIST SP 800-53 describes metadata as “information describing the characteristics of data including, for example, structural metadata describing data structures (e.g., data format, syntax, and semantics) and descriptive metadata describing data contents (e.g., information security labels).”

FedRAMP Guidance: Metadata associated with cloud environments typically fall into two buckets:

1. Data that describes or gives information about data populated by a federal customer that is associated with customer tenant activity logs and xml/script files, derived from customer data inputs

2. Information that could impact the system’s confidentiality, integrity, or availability (CIA) included in logs, audit trails, and vulnerability reports

Metadata should be accounted for, adequately protected, and documented by the CSP within applicable FedRAMP deliverables.

AUTHORIZATION BOUNDARY

A FEDRAMP

Interconnections in the Cloud

Federal Definition: Per NIST SP 800-47 Rev 1, an interconnection is defined as “the direct connection of two or more IT systems for the purpose of sharing data and other information resources.”

Update: NIST is in the process of updating this definition to include information exchange. The release date is tentatively scheduled for summer 2018.

FedRAMP Guidance: Interconnections are heavily reviewed by Agency Authorizing Officials (AOs) to ensure that wherever federal data and metadata may reside in the system, it is adequately protected. Cloud technologies utilize interconnections, Application Programming Interfaces (APIs), and other synchronous/ asynchronous connections that potentially transmit federal data and metadata. It is imperative that these connections, and any potential risk to federal information, are disclosed to the AO via the FedRAMP deliverables.

External Services in the Cloud

Federal Definition: NIST SP 800-53 defines external services as “a system service that is implemented outside of the authorization boundary of the organizational system (i.e., a service that is used by, but not a part of, the organizational system) and for which the organization typically has no direct control over the application of required security and privacy controls or the assessment of security and privacy control effectiveness.”

FedRAMP Guidance: Cloud technologies can augment or support their functionality by leveraging systems, components, and services from external services that are not directly controlled by the vendor pursuing a FedRAMP authorization. The CSP must clearly communicate these external services to the AO and the extent to which federal information (data) can be impacted by the use of these services. CSPs should make sure their FedRAMP Authorization Package (System Security Plan [SSP], Security Assessment Plan [SAP], Security Assessment Report [SAR], etc.) reflects this information.

Item of Note: External services may or may not have a pre-existing FedRAMP Authorization.

Item of Note: External services that impact the CIA of federal information must be included within the CSO’s authorization boundary.

Leveraging External Services with a FedRAMP Authorization

Federal Definition: Taking the concept of external services one step further, if a CSO is utilizing an external service that has a FedRAMP Authorization, the CSP may demonstrate compliance with various FedRAMP/NIST SP 800-53 control requirements by leveraging these capabilities from another provider. CSPs must reflect this relationship within the FedRAMP Authorization Package (SSP, Control Implementation Summary [CIS], etc.).

Item of Note: Leveraged services are a subcategory of external services, see above, and have a pre-existing FedRAMP Authorization.

Corporate Services

FedRAMP Guidance: Corporate services are a subset of external services. Corporate services are services used by a CSP to support their daily business operations and exist outside of the CSO authorization boundary. These services also do not contain any information that would impact the CIA of the CSO.

A FEDRAMP AUTHORIZATION BOUNDARY

Ex am pl es o f e xt er na l s er vi ce s t ha t c ou ld im pa ct th e

CI

A of th e cl ou d sy st em se cu rit y po st ur e:

An

Ia aS th at a P aa S or S aa S re sid es u po n

An

A

PI

th at c al ls da ta fr om a n ex te rn al so ur ce

A sy st em th at p ro vi de s f un cti on ity su ch a s a ud it lo gg in g, v ul ne ra bi lit y sc an ni ng , o r ti ck eti ng sy st em s

Da ta e le m en ts su ch a s v ul ne ra bi lit y da ta in ci de nt m an ag em en t r ep or tin g, c us to m er in te lle ct ua l p ro pe rt y, or c us to m er sy de sc rip to rs a ll im pa ct th e

CI

A of a sy an d w ou ld fa ll un de r t hi s r ul e of th um b.

T he ct le ve l o f t he se d at a el em en ts m ig ht b e at th e sa m e le ve l a s t he C

SO

o ffe rin g its el f, or m ay b e lo w er d ep en di ng o n th e

FI

PS

ys is of th e da ta

As a n ot e, h ist or ic al ly, so m e

CS

Ps h av e de sc rib ed m an y se rv ic es th at p ro vi ad di tio na l f un cti on al ity fo r a sy st em

(s uc h as th os e pr ev io us ly m en tio ne

d) a s c or po ra rv ic es a nd e xt er na l t o th e au th or iza tio n bo un da ry

. T hi s i s n ot c or re ct a nd th os e se rv ic es w ou ld fa ll un de r t hi s r ul e of th um b.

D e v /O p s

(o u t o f s c o p e

C o r p o r a te

S e r v ic e s

(o u t o f s c o p e

E x te r n a l

S e r v ic e

E x te r n a l

S e r v ic e

C lo u d O ff e r in g

A u th o r iz a ti o n B o u n d a r y

A ge nc y-

Sp ec ifi c

Se cu ri ty

R eq ui re m en ts Fe dR

AM

P pr ov id es a b as el in e fr om w hi ch

C

SP

s an d Ag en ci es c an d efi ne th ei r d es ire d se cu rit y po st ur e ac co rd in g to

F

IS

M A re qu ire m en ts a nd

N

IS

T se cu rit y ca te go riz ati on s.

W hi le th e Fe dR

AM

P

PM

O c on si de rs it s ba se lin e to b e co m pr eh en si ve p er im pa ct le ve ls

, F ed er al

A ge nc ie s ca n de fin e ad di tio na l s ec ur ity re qu ire m en ts in s er vi ce o f t

Ag en cy

’s m is si on a nd d es ire d se cu rit y po st ur e.

C

SP

s sh ou ld a cc ou nt fo r r eq ui re m en ts v ar ia nc es o n a cu st om er -b y-cu st om er b as is

Th e

Fe dR

AM

P

PM

O s tr on gl y re co m m en ds C

SP

s en ga ge th ei r c us to m er s ea rly a nd o ft en to id en tif y ad di tio na l re qu ire m en ts fo r f ed er al d at a ty pe s an d un de rs ta nd th e im pa ct o n a sy st em ’s cl ou d au th or iz ati on b ou nd ar y.

W re po ss ib le

, t he

P M

O p ro vi de s su pp or t t o al ig n

CS

Ps a nd

A ge nc ie s on a dd iti on al s ec ur ity re qu ire m en ts

Ex am pl es o f A ge nc y-sp ec ifi c re qu ire m en ts th at c ou ld im pa ct th e au th or iz ati on b ou nd ar y in cl ud e pr iv ac y co nt ro ls co nt ro ls a ss oc ia te d w ith fo re ig n na tio na ls , e tc

R U

LE

O

F T

H U

M B

2:

E xt er na l s er vi ce s th at ct t he C

IA

o f fe de ra l i nf o rm at io n An y ex te rn al s er vi ce th at c on ta in s fe de ra l i nf or m ati on o r m et ad at a th at a ffe ct s th e

CI

A of fe de ra l i nf or m ati on w ith a

CS

O m us t b e de pi ct ed w ith in th e bo un da ry

. T he

C

IA

ct le ve l o f a

C

SO

is c om m en su ra te w ith a fe de ra l c us to m er ’s re qu ire d im pa ct le ve l o f t he d at a be in g pl ac ed w ith in th e

CS

O a s de fin ed b y

FI

PS

Al l e xt er na l s er vi ce s m us t b e m ad e tr an sp ar en t t o th e

AO

a s w el l a s th e po te nti al im pa ct s to fe de ra l i nf or m ati on . I f t he

C

IA

o f f ed er al in fo rm ati on is pa ct ed b y th e us e of e xt er na l s er vi ce s, th e se rv ic es m us t b e in cl ud ed w in th e

CS

O a ut ho riz ati on b ou nd ar y.

T he se e xt er na l s er vi ce s (if ey do n’ t h av e a st an da lo ne

F ed

RA

M

P

AT

O ) m us t h av e an a pp ro pr ia te s co pe o f as se ss m en t a s de te rm in ed b y th e

AO

’s ris k to le ra nc e.

An y qu es tio ns o r c om m en ts c an b e di re ct ed to in fo fe dr am p.

go v

A D

D

IT

IO

N

A L C

O N

S

ID

E R

A T

IO

N

S

R U

LE

O

F T

H U

M B

1:

F ed er al in fo rm at io n th at is p ro ce ss ed st o re d, o r tr an sm it te d by o r fo r th e

Fe de ra l G o ve rn m en t, y m ed iu m o r fo rm

CS

Ps a re e xp ec te d to c on du ct th ei r o w n du e di lig en ce w he n de fin in g th ei r Fe dR

AM

P au th or iz ati on b ou nd ar y to id en tif y an y ot he r c on te xt s w he re th ey s to re pr oc es s, o r t ra ns m it fe de ra l i nf or m ati on o n be ha lf of a fe de ra l c us to m er o ut si de o f t he c on ce pt o f

“c us to m er -p op ul at ed d at a” o r “ te na nt d at a.

Th e au th or iz ati on b ou nd ar y sh ou ld c le ar ly d el in ea te b et w ee n in te rn al a nd e xt er na l s er vi ce s w e

CS

P’ s sc op e of c on tr ol o ve r t he

C

SO

, s er vi ce s th at a re le ve ra ge d fr om a n ex te rn al p ro vi de r, an d th e sc op e of c on tr ol o f a nti ci pa te d cu st om er a ut ho riz ati on b ou nd ar ie s w ith in th e

CS

O . T he C

SP

us t m ak e th e au th or iz ati on b ou nd ar y tr an sp ar en t t o th e Th ird P ar ty

A ss es sm en t O rg an iz ati

(3

PA

O ) a nd th e

AO

. T he

F ed

RA

M

P re qu ire m en ts (d oc um en ta tio n, te sti ng , c on tin uo us m on ito rin g, et c.

) a pp ly to a ll sy st em c om po ne nt s th at a re o ut lin ed w ith in th e au th or iz ati on b ou nd ar y.

R U

LE

O

F T

H U

M B

3:

C o rp o ra te s er vi ce s th at d o n o t af fe ct t he C

IA

o f fe de ra l i nf o rm at io n A

CS

P m ay u til iz e co rp or at e se rv ic es (s ee K ey C on ce pt

7) , s uc h as om er re la tio ns hi p, ti ck eti ng

, b ill in g sy st em s, e tc

. a s pa rt o f n or m al b us in es s op er ati on s.

If d at a th at is b ei ng tr an sm itt ed to th es e co rp or at e se rv ic es d oe s no t aff ec t t he

C

IA

o f f ed er al in fo rm ati on

(s ee

K ey

C on ce pt

2)

, t he se s er vi ce s m ay b e ex cl ud ed fr om th e au th or iz ati on b ou nd ar y.

C or po ra te s er vi ce s do n ot p ro vi de a ny fu nc tio na lit y to th e

CS

O

An e xa m pl e of c or po ra te s er vi ce s ou ts id e th e au th or iz ati on b ou nd ar y is a

C us to

Re la tio ns hi p

M an ag em en t (

CR

M

) s ys te m th at in cl ud es d at a pe rt ai ni ng to c us to la tio ns hi ps o nl y

(e .g th at p ot en tia l o r c ur re nt c us to m er m ee tin gs o cc ur d, om er p re fe re nc es , e tc

CS

Ps m us t b e ca re fu l h ow th ey u se c or po ra te s er vi ce s.

F or e xa m pl e, if a

C

SP

’s em pl oy ee re la ys v ul ne ra bi lit y in fo rm ati on v ia c or po ra te e m ai l, th en th at e m ai l sy st em w ou ld th en h av e m et ad at a th at c ou ld im pa ct th e

CI

A of

C

SO

. T hi s w ou ld ea n th e

CS

P’ s co rp or at e em ai l w ou ld fa ll w ith in

R ul e of

T hu m b

#2 a nd n ee d to b e w ith in th e au th or iz ati on b ou nd ar y.

R U

LE

O

F T

H U

M B

4:

D ev el o pm en t en vi ro nm en ts t ha t do n o t pr o ce ss

, s to re , o r tr an sm it f ed er al in fo rm at io n A

CS

P m ay u til iz e

“d ev el op m en t e nv iro nm en ts th at a re u se d to d es ig n, ve lo p, te st

, a nd d el iv er s oft w ar e/ co de to e nd u se rs . D ev el op m en t en vi ro nm en ts m ay b e co ns id er ed o ut si de th e au th or iz ati on b ou nd ar y if th er e is n o fe de ra l i nf or m ati on w ith in th is e nv iro nm en t ( se e Ke y Co nc ep t # 2)

. I f i nt er co nn ec tio ns

(s ee

K ey

C on ce pt

4) e xi st b et w ee n th e de ve lo pm en t e nv iro nm en t a nd th e

CS

O

’s au th or iz ati on b ou nd ar y, th ey m us t b e tr an sp ar en t a nd p ro vi de d to th e

AO

fo r r ev ie w d ris k ac ce pt an ce . D ep en di ng o n th e fe de ra l i nf or m ati on e xc ha ng e be tw ee n th e de ve lo pm en t e nv iro nm en t a nd

C

SO

a ut ho riz ati on b ou nd ar y, a n

AO

c ou ld re qu es t t ve lo pm en t e nv iro nm en t b e in cl ud ed w ith in th e au th or iz ati on b ou nd ar y an d th e sc op e of F ed

RA

M P re qu ire m en ts w ou ld a pp ly

H O

W T

O G

E T

S T

A R

T E

D

D ef in e an d de sc ri be a ll sy st em d at a flo w s an d in te rc o nn ec ti o ns

Th

Fe dR

AM

P

PM

O h as s ee n

CS

Ps be tt er il lu st ra te th ei r s ys te m b ou nd ar y aft er d ep ic tin g th e va rio us d at a flo w s th ro ug h th e sy st em

. A s a be st p ra cti ce

CS

Ps s ho ul d co ns id er d ia gr am m in g th e fo llo w in g:

Fe de ra l C us to m er U se r A ut he nti ca tio n

Lo gi ca l D at a

Fl ow

Ad m in is tr ati ve a nd

S up po rt

P er so nn el

U r A ut he nti ca tio n Lo gi ca l D at a Fl ow

Sy st em

A pp lic ati on D at a

Fl ow w ith in th e Pr op os ed C lo ud

A ut ho riz ati on

B ou nd ar y

Sy st em

A pp lic ati on D at a

Fl ow to A ll Le ve ra ge d an d

In te rc on ne ct ed S ys te m s

IN

B

O U

N D

A

Y fo llo w in g ar e “R ul es o f T hu m b” a ss oc ia te d w ith th e sy st em c om po ne nt s th at a re in cl ud ed w ith in a n au th or iz ati on b ou nd ar y:

O U

T O

F B

O U

N D

A

Y fo llo w in g ar e “R ul es o f T hu m b” a ss oc ia te d w ith th e sy st em c om po ne nt s ar ty pi ca lly o ut si de o f a n au th or iz ati on b ou nd ar y:

G U

ID

IN

G P

R

IN

C

IP

L E S

Th e au th or iza tio n bo un da ry e of th e m os t c rit ica l co nc ep ts to gr as p an d do cu m en

t. C

SP

s s ho uld vie w th is inf or m at io n fo r ad dit io na l c lar ity

An au th or iza tio n bo un da ry int eg ra l t o a C

SP

’s

SS

P an d m us t d es cr ibe co po ne nt s o f a n inf or m at io n sy ste m th at pr oc es s, sto re , o r t ra ns m it fed er al inf or m at io n, an d it m us t b e illu str ed ac ra ly.