Secure Configuration Guide

March 9, 2026

The following is a policy outline for secure configuration management tailored to a FedRAMP Moderate Authorized Continuum GRC SaaS (Governance, Risk, and Compliance Software-as-a-Service) offering. This outline aligns with the FedRAMP Rev 5 Secure Configuration Guide requirements (effective March 1, 2026, for all Rev 5 cloud services, including Moderate baseline authorizations). It incorporates mandatory responsibilities and recommended enhanced capabilities, with particular attention to the Versioning and Release History section (SCG-ENH-VRH), which recommends providing versioning and a release history for recommended secure default settings related to top-level administrative and privileged accounts.

This policy supports compliance by ensuring the creation, maintenance, and availability of a Secure Configuration Guide (formerly “Recommended Secure Configuration”) that explains security implications of configuration settings, especially those controlled by top-level administrative accounts (which manage enterprise-wide access to the entire SaaS platform).

1. Purpose and Scope

• Define the organization’s commitment to secure configuration management for the FedRAMP Moderate Authorized GRC SaaS.
• Ensure secure defaults, clear guidance, and transparency for federal agency customers configuring the service.
• Scope: Applies to all top-level administrative accounts (enterprise control over the full service) and privileged accounts; covers configuration settings with security implications.
• Authority: FedRAMP Rev 5 Secure Configuration Guide, Executive Order 14144 (as amended), NIST SP 800-53r5 alignment (e.g., CM, AC families), and internal security policies.

2. Policy Statements (Mandatory Requirements – SCG-CSO-RSC and Related)

• The organization shall create, maintain, and make publicly available (or readily accessible to authorized customers) a Secure Configuration Guide for the GRC SaaS.
• The Guide shall include:
  • Detailed instructions for securely accessing, configuring, operating, and decommissioning top-level administrative accounts.
  • Comprehensive explanations of all security-related settings operable only by top-level administrative accounts, including explicit descriptions of their security implications (e.g., impact on confidentiality, integrity, availability, or risk to federal data).
• The organization shall incorporate instructions on how customers obtain and use the Secure Configuration Guide into the FedRAMP authorization package (e.g., SSP, Customer Responsibilities Matrix).
• Secure defaults should be enforced for top-level administrative and privileged accounts upon initial provisioning (SCG-CSO-SDF).

3. Versioning and Release History (Recommended – SCG-ENH-VRH)

• The organization should maintain and publish a versioning scheme and release history specifically for recommended secure default settings applicable to top-level administrative accounts and privileged accounts.
• The release history should document:
  • Version numbers of the Secure Configuration Guide and associated default settings.
  • Dates of changes or releases.
  • Descriptions of adjustments made to recommended secure defaults over time (e.g., due to new features, vulnerability remediation, threat intelligence, or FedRAMP guidance updates).
  • Rationale for each change and its security impact.
  • Backward compatibility notes or migration guidance for customers.
• This history should be integrated into the Secure Configuration Guide (e.g., as a dedicated section, appendix, changelog, or linked repository) and updated in sync with service releases or configuration baseline modifications.

4. Enhanced Capabilities (Recommended – SCG-ENH Series)

• Comparison Capability (SCG-ENH-CMP): Provide tools or features allowing customers to compare current account/service settings against recommended secure defaults.
• Export Capability (SCG-ENH-EXP): Enable export of security-related configuration settings in machine-readable formats (e.g., JSON, YAML) for auditing or integration with agency GRC tools.
• API Capability (SCG-ENH-API): Support viewing and adjusting security settings via APIs (where feasible in the GRC SaaS architecture).
• Machine-Readable Guidance (SCG-ENH-MRG): Offer the Secure Configuration Guide (including versioning history) in machine-readable formats to facilitate automated compliance checks or tooling.
• Public availability of the Guide should be prioritized (SCG-CSO-PUB) to promote transparency.

5. Roles and Responsibilities

• Security/Compliance Team: Own creation, review, and updates to the Secure Configuration Guide, including versioning/release history.
• Product/Engineering Team: Implement and enforce secure defaults; provide technical details on settings and implications.
• FedRAMP Program Manager: Ensure inclusion in authorization package; monitor compliance with Rev 5 requirements.
• Customer Support: Assist agencies with Guide usage and questions on configuration.

6. Procedures and Implementation

• Annual review (at minimum) or upon major release/change to the GRC SaaS.
• Change management process tied to configuration updates, with documentation in the release history.
• Training for administrators on secure configuration practices.
• Monitoring for emerging threats or FedRAMP updates that may require Guide revisions.

7. Compliance and Enforcement

• Non-compliance with mandatory elements post-March 1, 2026, may result in FedRAMP corrective actions (e.g., notifications, potential Marketplace removal).
• Internal audits to verify Guide completeness, accuracy, and availability.
• Continuous improvement based on customer feedback and FedRAMP guidance.

This outline provides a structured foundation for your Secure Configuration Guide and related policies. It focuses on the core mandatory requirements while incorporating the requested emphasis on versioning/release history as a recommended enhancement. Customize further with specific GRC SaaS details (e.g., exact account types, settings lists) during implementation. If needed, reference the full FedRAMP Rev 5 Secure Configuration Guide for the latest changelog and definitions (e.g., “top-level administrative account,” “privileged account”).