Cloud authorization ecosystem to expand, StateRAMP predicts

State Risk and Authorization Management Program (StateRAMP) experts said they expect that the security requirements of state, local and tribal governments and higher education (SLED) institutions will evolve in ways that support membership in the nonprofit cloud security organization.

“What we foresee happening is states will start to release policies and guidance that say, ‘Here are our security controls. In order to meet them, you can independently work through our system,’ which is probably going to be a lengthy process for you as a service provider. ‘Or if you’ve already done StateRAMP, you automatically satisfy these requirements. And also we’ll accept FedRAMP because we understand the value of the work you’ve done there,’” Ellen Polk, StateRAMP account manager, said April 26 during a webinar titled “Getting Started with StateRAMP.”

What’s more, she said that states should recognize StateRAMP ready and authorized accreditations even if they aren’t formally part of their cloud authorization programs. In fact, that’s already happening in some states with their own “RAMP” programs. For example, the Texas Risk and Authorization Management Program offers provisional certifications to cloud service providers already certified by StateRAMP and the Federal Risk and Authorization Management Program (FedRAMP).

“We at StateRAMP are working at standardization across the board, so if you come through the StateRAMP process and let’s say you receive a StateRAMP authorization for your product, you should be able to take that authorized product and your security package to all of your state and local government clients regardless even if they’ve not formally announced they’re doing StateRAMP,” Polk said. “Most state government security policies are built on [National Institute of Standards and Technology Special Publication] 800-53, which is the same baseline controls that we use here at StateRAMP and that FedRAMP also requires.”

Another effort to ease the review and verification process for cloud service providers looking to do  business with SLED organizations would incorporate a bidirectional relationship between StateRAMP and other security frameworks such as the Criminal Justice Information Services Security Policy, IRS Publication 1075, and the Centers for Medicare and Medicaid Services’ Minimum Acceptable Risk Standards for Exchanges. This means that providers that have met those requirements can “crosswalk” them into their StateRAMP requirements and vice versa, Polk said, adding that guidance documents on this are likely to be published this year.

Last month, StateRAMP announced the formation of the Approvals Committee to facilitate cloud service providers’ path to validation. Because CSPs must have a SLED sponsor to work toward Ready or Authorized status, a FedRAMP authorization doesn’t carry over. Recognizing that not all companies seeking StateRAMP authorization have relationships with SLED agencies, the organization established the committee to act “as authorizing officials on behalf of government if a provider is unable to secure a government sponsor.”

StateRAMP gives companies three “pathways to success” to achieving ready or authorized status. The Launch path provides the most handholding by the Knowledge Services consulting team. Knowledge Services serves as the program management office (PMO) for StateRAMP. Through Launch, the team helps providers map StateRAMP-required controls to those the company already has and translates documents such as SOC 2 into StateRAMP templates to see what holes need to be filled.

Guided is a second path to accreditation through audits, gap analysis and other consulting services. Both Launch and Guided also require third-party assessment organization reviews.

The third path is called Fast Track and it’s for products, services or offerings that already have federal authorization, such as an authority to operate, provisional authority to operate or ready status. The process, which includes sharing FedRAMP documentation that’s redacted to protect information as needed, takes weeks rather than months.

“The value-add for this is independent verification and validation,” Shea Simpson, senior information security analyst at the PMO, said during the webinar. “We have enough CSPs that already have not just FedRAMP, but they’re [Joint Authorization Board]-authorized. But they want to show that at a state level, higher education level, tribal government, regional institution level that they have also gone through the StateRAMP process.”

StateRAMP launched in January 2021 and now has more than 800 government and service provider members, Polk said. As of March 14, 10 states have announced that they are adopting StateRAMP.

“The goal and part of the mission of StateRAMP is how do we provide state governments with enough information about the cloud products that they’re using to process, store and transmit cloud data,” she said. “How do we get them enough information so that they can make informed risk-based decisions, and how do we help as many providers as possible, regardless of size, get into this ecosystem?”

Stephanie Kanowitz is a freelance writer based in northern Virginia.