Summary
DoD’s December 21, 2023 memo clarifies that contractors using FedRAMP Moderate “equivalent” CSPs now bear full responsibility for proving and maintaining CSP compliance. With zero POA&Ms allowed, contractors must validate extensive evidence and 3PAO assessments. Many may need to transition to authorized solutions like Microsoft GCC/GCC High.
On 12/21/23, the Department of Defense (DoD) released a memo clarifying the stringent requirements of FedRAMP moderate “equivalency”– and it’s effective immediately.
The bottom line: DoD Contractors are now on the hook for their FedRAMP moderate “equivalent” Cloud Service Provider’s (CSP) compliance.
If you are a DoD Contractor storing, processing, or transmitting defense data with a CSP, you should ask yourself:
- “Am I willing to dedicate the time and energy to gather and report all the DoD is asking for?”
- “Am I willing to risk the chance of my CSP not maintaining and reporting perfectly?
The CSP can’t miss the mark. They can’t even have a POA&M. If they miss the mark, it’s on you.
Are you willing to take the risk of your CSP sinking every free throw?
What does this mean? We’ll cover everything you need to know in this blog.
In this blog we’ll answer the questions:
- What is a CSP?
- Where did this memo come from?
- What is the difference between FedRAMP Moderate Authorized and FedRAMP Moderate Equivalent?
- What exactly are contractors using equivalent CSPs responsible for?
- What is the margin of error allowed?
- What should I do if I have an “equivalent” CSP?
What is a CSP?
A Cloud Service Provider (CSP) is a company that offers computing services and resources over the internet, allowing users to access and utilize computing resources without the need for owning or maintaining physical hardware.
Your organization is likely using a CSP – think companies like Microsoft Azure, Adobe, GitHub, and Oracle – you might be using them to run an application, host a website, or store and process your data.
According to the memo: the DoD requires a lot of contractors with defense data being stored, processed, or transmitted with a FedRAMP Equivalent CSP.
Where did this memo come from?
Since 2016 DFARS clause 252.204-7012 has stated that if a contractor puts Controlled Unclassified Information (CUI) in the cloud then the contractor needs to ensure two things happen:
- Require and ensure that the cloud service provider meets security requirements “equivalent” to the FedRAMP Moderate baseline.
- The cloud service provider complies with incident reporting, data retention, and access requirements in paragraphs (c) through (g)* of DFARS.
The DoD offered the FedRAMP moderate “equivalency” clause as an accommodation and catch-up mechanism for the Defense Industrial Base (DIB) to get on board with these new standards.
Fast forward to today and the story probably went something like this:
DIBCAC started looking around, checking to see how DFARS implementation was going in the Defense Industrial Base, and popping their head up into the cloud – they likely found CUI flowing left and right. Their reaction? This memo.
Now the time for accommodations has run out.
What is the difference between FedRAMP Moderate Authorized and FedRAMP Moderate Equivalent?
The difference between FedRAMP Moderate Authorized and FedRAMP Moderate Equivalent can likely be found in this claim – if your current CSP is saying, “You’re all good, we’ve got NIST 800-171 down pat,” you need to ask them if they are FedRAMP authorized.
You can check the authorized FedRAMP marketplace for verification.
If they say, “don’t worry, we’re FedRAMP Equivalent”, that is no longer a fuzzy alternative to FedRAMP Moderate Authorized; it has now become clear what the DoD means by “equivalent”.
This shouldn’t be too surprising; “equivalent” simply means the same as – meaning, the same as FedRAMP moderate authorized.
If you are a black belt “equivalent” you should be able to do all the tricks and pass all the tests that a black belt can, even if you don’t have the belt.
What exactly are contractors using equivalent CSPs responsible for?
The surprise is not the meaning of “equivalency” it’s the clarification that CSPs aren’t responsible for proving or maintaining their FedRAMP compliance, the contractors are.
Let me rephrase that: in the event of an incident, you are now held liable for proving and maintaining your current provider’s FedRAMP compliance.
Contractors with equivalent CSPs have a mountain of work and all the responsibility; contractors with authorized CSPs have little work and no responsibility.
If you have an equivalent CSP, it’s on you to:
- Present all the extensive evidence of your CSPs equivalency (and there’s a lot – see below)
- Ensure a 3rd party assessor (3PAO) validates the equivalency
- Take responsibility and the burden of failure if they miss the mark
As the DoD put it: the onus is on the contractor.
CMMC Pathfinder Tool - Find Your Path to CMMC in 5 Minutes
“The onus is on the contractor to validate the BoE (Body of Evidence) provided by the 3PAO meets the Moderate Equivalent standards outlined in this memo and if using a CSO that is FedRAMP Moderate equivalent, must provide the CRM to DIBCAC and 3PAO assessors to support assessments.
The contractor acts as approver for the use of the CSO by their organization and confirms that the selected CSP has an incident response plan.
The contractor, not the CSO’s CSP, will be held responsible for reporting in the event of CSO compromise.
The contractor shall ensure the CSP follows the incident response plan and can provide notifications to the contractor.
The contractor will report incidents in accordance with the applicable contract terms and conditions.”
The Body of Evidence
The memo states: “To be considered FedRAMP moderate equivalent, [Cloud Service Offerings] must achieve 100 percent compliance with the latest FedRAMP moderate security control baseline through an assessment conducted by a FedRAMP-recognized 3rd Party Assessment Organization (3PAO)”
For reference, the FedRAMP moderate baseline is larger than the NIST SP 800-53 moderate baseline. NIST SP 800-171 represents only 60% of the NIST SP 800-53 baseline. Translation? It’s pretty tough.
In addition, the contractor needs to present the following as the “Body of Evidence” (BOE):
System Security Plan (SSP):
- Policies and procedures (covering all control families)
- User guide
- Digital identity worksheet
- Rules of Behavior
- Contingency Plan
- Incident response plan
- Configuration management plan
- Control implementation summary workbook
- Separation of duties matrix
- Applicable laws, regulations, and standards
- Integrated inventory workbook
Security Assessment Plan (SAP):
- Security test case procedures
- Penetration testing plan and methodology (conducted annually and validated by a 3PAO)
- FedRAMP 3PAO-supplied deliverables
Security Assessment Report (SAR):
- Risk exposure table
- Database, infrastructure, and web scan results (conducted monthly, validated annually by a 3PAO)
- Auxiliary documents such as evidence artifacts
- Pen test reports
Plan of Action and Milestones (POA&M):
- Continuous monitoring strategy
- Continuous monitoring executive summary (validated annually by 3PAO)
That is a large Body of Evidence for your organization to be responsible for validating.
What is the margin of error allowed?
The most daunting detail of the memo says that no Plans of Action & Milestones (POA&Ms) are allowed. POA&Ms would be the CSPs “we’re working on it” option. Instead, the only “plan of action” allowed is perfection – and not self-attested perfection, but perfection proven through a mountain of evidence and then assessed by a third party (3PAO).
After perfect FedRAMP moderate “equivalency” is proven, the onus is on the contractor to both hold the CSP accountable for maintaining perfection and be responsible for the CSPs mistakes if they don’t.
If you are a DoD Contractor storing, processing or transmitting defense data with a CSP, you should ask yourself:
- “Am I willing to dedicate the time and energy to gather and report all the DoD is asking for?”
- “Am I willing to risk the chance of my CSP not maintaining and reporting perfectly?
The CSP can’t miss the mark. They can’t even have a POA&M. If they miss the mark, it’s on you.
Are you willing to take the risk of your CSP sinking every free throw?
With the CMMC rule and this FedRAMP memo published back-to-back, DIBCAC is sending a clear signal: the standard is set, get your house in order.
What should I do if I have an “Equivalent” CSP?
The short answer: Consider switching to a FedRAMP-Tailored Solution. We recommend either Microsoft GCC or GCC High.
If you are considering working with a different Cloud Service Provider who might be storing, handling, or transmitting CUI and they assure you that they are a FedRAMP environment, then you need to ask them what their plan is to meet the stringent standards of this memo.
Paragraphs C-G of DFARS 7012 constrain the use of common commercial cloud services. This is why Microsoft created GCC and GCC High (GCC-H is currently in process of re-authorization) because if you decide to put the wrong sensitive data in the commercial cloud, the cloud provider will not reciprocate the requirements of the DoD – access data retention, incident investigation, and reporting – all those things that you are obligated to do by the DoD.
Microsoft GCC and GCC High were created because of FedRAMP requirements.
If you would like to talk to someone about Microsoft GCC/GCC High options for storing your CUI we would love to help.
