StateRAMP, System Security Plans, and the Operational Control Matrix

StateRAMP System Security Plan Featured

StateRAMP is based on the FedRAMP standard, which means that it uses a similar set of documents and requirements to assess and authorize cloud service providers. One of the key documents of both StateRAMP and FedRAMP is the System Security Plan (SSP), which represents the provider’s security controls, compliance perimeter, and capabilities. 

In Revision 5, StateRAMP has seemingly moved from the traditional SSP toward an “operational control matrix,” or systematized document outlining the same information. Here, we’ll cover the SSP/control matrix and what it represents for the provider during StateRAMP authorization. 

 

Read More

What Are Core Documents for StateRAMP Authorization?

StateRAMP Documentation Featured

StateRAMP, much like FedRAMP, includes a series of documents that the cloud provider and their 3PAO must complete before they are fully authorized. These documents align with several stages of the assessment process and provide regulating authorities with the proof they need to see that the cloud offering meets requirements. 

Here, we summarize the documents you must complete as part of your StateRAMP assessment process.

 

Read More

What Is the Open Security Controls Assessment Language (OSCAL)?

Image of XML - OSCAL featured

There’s recently been a push within FedRAMP towards modernizing the framework to meet modern security challenges and better align federal security standards across agencies and technologies. 

Part of this push is standardizing how security controls are measured and assessed, and the most recent blog from FedRAMP mentions a new standard–OSCAL. 

Here, we will discuss OSCAL, why the National Institute of Standards and Technology (NIST) is creating it to address assessments, and how we streamline them. 

 

Read More