citr-024_fedramp_applicability.pdf

Department of Commerce

Commerce Information Technolo

FedRAMP Applicability

1. PURPOSE

CITR-024

March 29 2016

This policy establishes criteria and guidelines to assist Departme t of Commerce (DOC) bureaus in identifying DOC cloud services requiring Federal Risk and Author zation Management Program

(Fed RAMP} Compliance. The policy also outlines DOC-specific re uirements that are to be met in addition to FedRAMP requirements and waiver requirements fo those DOC cloud services unable to meet FedRAMP compliance.

2. BACKGROUND

Cloud services provide scalable information technology (IT) capa ilities that are offered as a service over a network or the internet to many users at one time. The u e of cloud services introduces additional challenges for information owners/stewards in maint ining security standards, protocols, and continuous monitoring required by the Federal government. FedRAMP is a unified, government wide risk management program focused on security for cloud-ba ed systems. The program provides a standard approach for conducting security assessments, autho ization, and continuous monitoring of Cloud services based on an accepted set of baseline security c ntrols and consistent processes that have been vetted and agreed upon by agencies across the feder I government. In accordance with the Office of Management and Budget (0MB} memo published ecember 81 \ 2011, Security

Authorization of Information Systems in Cloud Computing Enviro ments, all LOW and MODERATE impact cloud services1 leveraged for production purposes by the epartment or department offices must comply with FedRAMP requirements.

3. SCOPE

These requirements apply to all unclassified low and moderate i formation systems, Trusted Internet

Connection (TIC) and layer 2 services owned by or operated on b half of DOC where the Department has legal and/or contractual authority to dictate requirements.

In this context, a "cloud service" meets the Cloud Deployment Models and C oud Service Models defined in NIST Special

Publication (SP) 800-145, The NIST Definition of Cloud Computing.

4. AUTHORITY

The DOC Chief Information Officer (CIO) has the authority to dev lop, implement, and manage IT security processes and procedures to protect the availability, co fidentiality, and integrity of the

Department's IT resources. The DOC Chief Information Security fficer (CISO)/Senior Agency

Information Security Officer (SAISO) shall ensure that IT security olicy and requirements are developed consistent with applicable statutory authority, includi g the Clinger-Cohen Act, Federal

Information Security Management Act (FISMA) of 2002 and Fed ral Information Security

Modernization Act (FISMA) of 2014; with regulatory requiremen s and external guidance, including

0MB policy and Federal Information Processing Standards (FIPS) publications promulgated by the

National Institute of Standards and Technology (NIST); and w ith he DOC Information Technology

Security Program Policy (ITSPP).

5. CANCELLATION/AUGMENTATION OF EXISTING POLICY

This policy supplements the DOC ITSPP and the Cloud Computin Policy.

6. POLICY

6.1 A cloud service is required to be Fed RAMP compliant when i meets all of the following criteria:

A. It has all five of the essential cloud criteria described in N ST SP 800-145.

B. It employs at least one of the cloud service models and o e of the cloud deployment models described in NIST SP 800-145.

C. It is hosted:

i. Internally by a bureau as part of its infrastructure OR

ii. External to the internal bureau infrastructure (i.e, by a non-Federal government organization) OR

iii. By another Federal organization but provides se ices to non-Federal organizations;

and

D. It is managed in such a way as to provide a capability tot e bureau (e.g., email, network storage), which the bureau can then use to provide a ser ice to its users.

Assessment and Authorization activities for cloud systems owned by DOC bu eaus for internal bureau use only should be performed and documented in accordance with CITR-019.

Executive departments or agencies that: (i) select a private cloud deployment model (i.e., the cloud environment is operated solely for the use of their organization); (ii) implement the private cl ud on premise (i.e., within a Federal facility); and (iii) are not providing cloud services from the cloud-based inform tion system to any external entities

(including bureaus, components, or subordinate organizations within their ag ncies), are exempted from the Fed RAMP requirements. (htt s: cio. ov w -content u loads 2012 09 fedram memo. df)

6.2 A cloud service is considered to be FedRAMP compliant by D C when the following DOC-specific requirements are met:

A. The Cloud Service Provider (CSP) providing the service is resent on the list of FedRAMP Compliant CSPs located at: http://www.fedramp.gov/.

B. A DOC bureau has documented and entered into the Cyb r Security Assessment and Management System (CSAM),3 the following DOC-specifi artifacts for the cloud service within a pre-existing FISMA-reportable system or the creation o a FISMA-reportable system:

i. Any security controls needed for the use of the se vice which are not sufficiently provided by the CSP and how they are to be impl mented and monitored, such as: 1.

Agency responsible; 2. Hybrid; and 3. Optional co trols selected by the bureau.

ii. A Continuous Monitoring plan which al igns with D C CITR-019 and describes plans for DOC oversight of the Agency-responsible controls periodic review of the status of the CSP-responsible controls, and requires a periodic eauthorization, on at least an annual basis.

C. A DOC bureau has conducted and documented an assess ent of the cloud service which reviews the existing Fed RAMP package to determine sec rity control implementation and associated risk(s) relevant to the bureau's use of and inte aces to the cloud service.

D. After reviewing the results of the assessment described i 6.2C, a DOC bureau Authorizing Official (AO) (and co-AO if one is designated for the syste ) has approved of, documented, and entered into CSAM4 the following:

i. The use of the cloud service.

ii. The residual risks which are documented in a Sec rity Assessment Report (SAR) and, if required, a Plan of Actions and Milestones (POA& ).

E. The ATO issued by the DOC bureau has been provided to he Fed RAMP Program Management

Office (PMO) (info@fedramp.gov)5

7. WAIVERS

In addition to the waiver requirements described in section 2.2.2 of the ITSPP, the following requirements must be met and documented in order for a burea to utilize a non-FedRAMP compliant cloud service:

A. Evidence that the cloud service has an Authorization Operate (ATO) issued by a DOC bureau's AO (and co-AO if one exists).

B. If the DOC ATO leveraged another Department or Ag ncy-issued (D/A) ATO, then evidence of that D/ A ATO must be documented.

Either the documents themselves or the location of the documents must be ntered into CSAM.

Either the documents themselves or the location of the documents must be ntered into CSAM.

Questions regarding Fed RAMP requirements and processes should be sent t the DOC OCIO OCS IT Security Policy team at DOCITSecurity@doc.gov. The OCIO team will collaborate with the GSA Fed AMP PMO on responses.

f',,<steven I. Cooper Approval Date

Chief Information Officer

REFERENCES

0MB Security Authorization of Information Systems in Cloud C puting (FedRAMP Memo)

(December 8, 2011):

htt : www.whitehouse. ov sites default files omb assets e o

NIST SP 800-145 The NIST Definition of Cloud Computing (Septe ubs 800-145 SP800-145.

FedRAMP Homepage:

http://www.fedramp.gov/

DOC IT Security Program Policy (ITSPP) (September 16, 2014):

htt s: connection.commerce. ov sites connection.commerce. v files 2014 doc its . df

DOC Cloud Computing Policy (December 8, 2010):

Standards PROD0l 009505