OSCAL automates FedRAMP assessments
Connecting state and local government leaders
Open Security Controls Assessment Language allows the Federal Risk and Authorization Management Program to automate the review of cloud service providers’ security authorization packages for completeness and consistency.
Recognized for its thoroughness, but not necessarily its speed, the Federal Risk and Authorization Management Program (FedRAMP) is applying automation to facilitate approval processes.
Incorporating Automation into the FedRAMP Authorization Life Cycle
General Services Administration
Click here for all the 2021 Public Sector Innovation winners
FedRAMP is a governmentwide program that supports agencies’ adoption of secure cloud environments and tools. It partnered with the National Institute of Standards and Technology and the General Services Administration’s 10x innovation-funding program to develop the Open Security Controls Assessment Language -- a standard machine-readable language based on XML and JSON. FedRAMP applies OSCAL to its security baselines and the security packages that cloud service providers (CSPs) submit.
FedRAMP developed validation rules that analyze OSCAL-formatted data to enable automated package reviews for completeness, consistency, adherence to formatting and other low-level checks that CSPs can perform before submitting their plans. It also allows for automated markups to facilitate review teams’ assessments. The result is a faster – and less costly – review and remediation process.
“Security authorizations are just very time-consuming for all people involved to create, review, remediate and authorize a package – both for the CSPs creating the packages and for my review teams at FedRAMP,” said Zachary Baldwin, FedRAMP program manager for strategy, innovation and technology at GSA. OSCAL “is the foundation to make automation possible.”
OSCAL could speed and improve accuracy in all three of the FedRAMP authorization steps. First, CSPs can create System Security Plans faster, reuse control language and submit everything in a standardized format, validating much of their content before submitting it to the government for review.
Second, third-party assessment organizations can automate the planning, execution and reporting of cloud assessment activities, and third, agencies will be able to accelerate their reviews of the FedRAMP security authorization packages.
For FedRAMP review teams, the standardization “allows us to do validations and automated checks on the data very easily that you can’t do if it’s in a PDF or Word,” Baldwin said. “We collected all checks that our review teams do, and we think we can automate about 60% of those checks. Even something as simple as just checking if the documentation is complete, that takes a decent amount of time and [with OSCAL] that can be done without my review team doing it. It lets them focus on more important, more strategic reviews that are of higher value.”
OSCAL Version 1.0 was released in the spring, but pilot tests of the language have been underway using mock package data. This allowed developers to upgrade and shift their approach to validation presentation and results as needed. FedRAMP is running a pilot now with Cloud.gov to create a security package in OSCAL and run the validations against it.
With the first release, Baldwin said he’s also issued the first set of validation rules.
“I am releasing all of the validations publicly,” he said. “I will give you what I’m checking for initially so you can self-test and make sure your package is at least going to pass that level before I even have my review team look at it.”
The two main metrics he’s monitoring are the amount of time it takes to get a cloud service offering into the FedRAMP Marketplace and how significantly OSCAL can reduce the amount of back-and-forth between CSPs and review teams. It’s hard to estimate how much time the teams could save because each package is different, Baldwin said.
“We’re hoping this creates a whole ecosystem of security packages based on this machine-readable format – the validations and sharing information, inherited controls, ingestion into [governance, risk and compliance] tools and things like that,” he said. “What we’re hoping is that the GRC tools – and we have been working on piloting some of them – will be able to ingest a package … for the agencies to help them manage their risk and security compliance.”
Additionally, FedRAMP released Version 2.0 of its agency authorization playbook on Oct. 20 – the first update since 2017 – also with the goal of facilitating CSP and agency efforts to move to the cloud.