Cloud providers and Managed Service Providers are increasingly looking to expand their potential client base and instill trust with their existing partners. One way they do this is through meeting compliance audits and standards in areas like healthcare and government (like FedRAMP or HIPAA), and the more stringent and comprehensive the better. That’s why many cloud providers look to federal compliance and contract work.

FedRAMP compliance, required for cloud providers in the federal space, isn’t an easy standard to meet. It requires working closely with an authorized security partner and meeting the exacting security IT control standards outlined in NIST Special Publication 800-53. 

Here, we discuss NIST 800-53 and its relationship to FedRAMP, particularly through the newest Revision 5. Following that, we’ll show why these compliance standards are important for cloud providers and how they can meet them to support federal clients and demonstrate security and control even to potential customers in other industries. 

What is NIST SP 800-53? It is a set of regulatory guidelines that govern security, reporting, and management requirements for information systems used in federal government applications. These guidelines impact several compliance frameworks associated with federal contracting and IT infrastructure, including FedRAMP requirements for cloud service providers. 

What is NIST 800-53 and How Does it Impact Federal Compliance?

In a previous article, we discussed the latest version of NIST Special Publication 800-53 (“Revision 5). While we will cover some of the specifics here, it’s also important to highlight that the NIST 800 series of publications are responsible for outlining best practices and guidelines for IT and cloud systems used in federal government contexts. 

NIST 800-53 informs FedRAMP regulations by defining security requirements for federal agencies based on the Federal Information Security Management Act of 2002 (FISMA) and the Federal Information Security Modernization Act of 2014 (a modernization and clarification of FISMA guidelines). These acts outline the standards for IT security controls used by agencies and contractors in the federal space. 

According to law, federal agencies and contractors must meet minimum security, reporting, and compliance standards. These requirements need to report compliance with the Office of Management and Budget OMB. This reporting, which details compliance, compares compliance against the NIST 800-53 specification. 

These specifications apply to several types of federal compliance frameworks, including FedRAMP.

How Does NIST 800-53 Impact FedRAMP Certification?

The FedRAMP framework applies specifically to cloud vendors working in the federal space. If federal agencies are using cloud technology, then they, and their cloud provider, need to stick to FedRAMP standards. 

At the core of compliance is NIST 800-53 Revision 5, which has several requirements in place that speak directly to cloud platforms including SaaS, IaaS, and PaaS applications. These requirements include:

• New updates to controls regarding risk and supply chain security with third-party vendors
• New “state of practice” areas for cyber resiliency, design, and governance. 
• Updates to security for large-scale cloud infrastructures to maintain privacy.
• Updated regulations for cloud-connected mobile devices and IoT technologies.

With these updates, the new revision includes new control families like Supply Chain Risk Management. With all that said, this NIST publication essentially shapes what FedRAMP compliance means. 

How Does this Impact Your Work with Third-Party Security Vendors?

Ideally, you are working with a third-party vendor. That’s not just an opinion: if you want to work as a cloud provider in the federal space, then you are required by law to work with a Third-Party Assessment Organization (3PAO) for Authorization to Operate (ATO).

Because of this, many companies need to work with 3PAOs that know FedRAMP and NIST 800-53:

• Managed Service Providers will want FedRAMP certification. Many MSPs will provide dedicated cloud services or, barring that, select IaaS, SaaS, or PaaS services. If these MSPs want to offer these services to federal agencies or federal contractors, they must have certification.
• Companies that work in the federal space and use cloud services need certification. Moreover, their providers will also need certification, which means that they will at some point need to work with a 3PAO.
• FedRAMP certification has benefits beyond federal ATO. Companies with FedRAMP ATO can prove that they have met relatively high-security standards, which can instill trust with many potential clients. 

Now, as we’ve said, 3PAOs are central to this process. FedRAMP compliance requires cloud vendors to work with 3PAOs on their path to certification as well as throughout their continuing maintenance processes. 

With that in mind, complying with FedRAMP standards isn’t as simple as filling out a form. Showing that your company meets standards in NIST 800-53 involves potentially hundreds or thousands of documents, many of which aren’t readily available if you aren’t prepared. 

That’s why 3PAOs aren’t just providing FedRAMP certification, but also often include automation to support compliance, governance, and risk assessment. For example, 3PAOs are deeply involved in not only preparing you for FedRAMP compliance but even help you determine where you are at in terms of compliance. During your audit, the 3PAO (in conjunction with other relevant organizations like the PMO and JAB) will determine your security risk exposure. The results of this exposure assessment will determine whether you are ready for an ATO or Provisional ATO, depending on your authorization path. 

What Should I Look For in a FedRAMP 3PAO?

First and foremost, your 3PAO should be able to demonstrate extensive knowledge of NIST 800-53 and its revisions. This means that they know how it works, not only for FedRAMP compliance, for other federal compliance requirements tied to NIST standards. Their demonstration of this expertise involves both their certification as a 3PAO (required by the federal government) and their history with other federal clients.

Secondarily, your 3PAO should be able to automate your auditing processes. The reality is that FedRAMP audits can take weeks or even months if you aren’t prepared or if you are doing the audit manually. With an automated solution, these weeks or months can become days or even hours. 

More importantly, these audits, when automated, are more accurate. NIST 800-53 requirements are rather specific, and the consequences for not meeting them and claiming that you do can be disastrous for you and for the 3PAO you work with. Automation takes out the guesswork and gives you an accurate mechanism to determine compliance.

Conclusion

Don’t attempt to understand NIST 800-53 forward and backward. These standards are designed to be thorough and complete, meaning that they cover many of the cloud services and devices that a federal agency could potentially use… not necessarily the ones you offer. 

Working with an authorized and automated 3PAO takes the burden of understanding NIST standards and FedRAMP compliance in-depth off of your shoulders. That’s why it is important to work with security partners that understand the standards and that can automate it in solutions that you can trust. 

Learn more about how you can pursue the best security, reporting, logging, and risk management practices suited to your business. Call us at 1-888-896-7580 or through the form below. And tap into your CyberVisor Services to work with some of the top security experts in the industry.