X-RAMP Professional Services

What is X-RAMP?

X-RAMP is not another compliance framework that NicheITS just made up. Its a term that brings together the various “RAMP” type compliance models. Building a compliance program for each Cloud Service Provider (CSP) is more than just checking off boxes. NicheITS takes a holistic approach that engages all organizational team members, agency POC’s, and 3rd party entities to develop a comprehensive organizational compliance program meeting various compliance models.

NicheITS empowers CSP’s to optimize their security posture by providing an experienced and independent position when assessing and validating Management, Operational ,and Technical control requirements. Engagement though hands-on workshops, gap assessments, ATO documentation support, and policy development, NicheITS will drive organizational stakeholders to prioritize the risks and establish a plan of action supporting your goals to comply with frameworks such as CMMC, FedRAMP, ISO27001, SOC2 and now StateRAMP.

FedRAMP and StateRAMP

WHAT IS FEDRAMP?

NicheITS Niche information technology solutions nicheits fedramp cmmc iso27001 soc1 soc2 cyber security compliance cloud engineering afwerx hosting cybersecurity maturity model gap analysis aws azure google onprem architecture federal agency agencies Risk management Framework RMF NIST 800-53 ATO documentation Office365 migration advisory services SAAS IAAS SecAAS Microsoft redhat platform1 plateformone DISA STIG CIS baseline configuration hardening cm-2 DOD Department of Defense Army Navy Marine 8500.2 8500.1 Impact Level IL4 IL5 IL6 governance risk jab conmon Steelcloud configos exchange sharepoint dynamics365 adfs active directoryFedRAMP stands for the “Federal Risk and Authorization Management Program.” It standardizes security assessment and authorization for cloud products and services used by U.S. federal agencies. The goal is to make sure federal data is consistently protected at a high level in the cloud. The Federal Risk and Management Program (FedRAMP) is a cyber security
risk management program for the purchase and use of cloud products and services used by U.S. federal agencies. Only Cloud Service Providers (CSP) with an authorized Authority-To-Operate (ATO) approval may work with government agencies. The program was initiated by the Office of Management and Budget (OMB) in response the to the U.S. government’s 2011 Cloud First Policy.

Before a commercial cloud service offering (CSO) can be leveraged by a federal agency, it must demonstrate that it meets all FedRAMP compliance requirements. These requirements are outlined in the NIST 800-53 control framework and supplemented by the FedRAMP Program Management Office (PMO). Authorization is granted to the cloud service provider (CSP) through the provision of what is known as the FedRAMP Authority to Operate (ATO).

WHAT IS STATERAMP?

NicheITS Niche information technology solutions nicheits fedramp cmmc iso27001 soc1 soc2 cyber security compliance cloud engineering afwerx hosting cybersecurity maturity model gap analysis aws azure google onprem architecture federal agency agencies Risk management Framework RMF NIST 800-53 ATO documentation Office365 migration advisory services SAAS IAAS SecAAS Microsoft redhat platform1 plateformone DISA STIG CIS baseline configuration hardening cm-2 DOD Department of Defense Army Navy Marine 8500.2 8500.1 Impact Level IL4 IL5 IL6 governance risk jab conmon Steelcloud configos exchange sharepoint dynamics365 adfs active directoryDue to the success of the federal FedRAMP program for both Federal agencies and Cloud Service Providers (CSP), the requirement for a universal, FedRAMP-style framework for state and local governments has became increasingly apparent. In 2020, a collaborative group of state executives created StateRAMP so the “verify once, use many” approach to verifying minimum cybersecurity requirements through control implementation could enhance on state and local government security frameworks.

StateRAMP strives towards development and implementation of a comprehensive security framework designed to improve cloud security for state and local governments. NicheITS aims towards working with our partners to educate and guide them through the requirements of the StateRAMP compliance framework and its relationship with parallel programs such as FedRAMP. 

NicheITS works with our partners and customers to assist in guiding Cloud Service Providers (CSP’s) effortlessly through the requirements, pitfalls, and show stoppers of the the StateRAMP Authorization process.  With a well establish track record on advising clients through the FedRAMP process. NicheITS builds on those same processes and in-house developed solutions to drive CSP’s through the ATO process.

WHAT ARE THE REQUIREMENTS FOR FEDRAMP?

NicheITS Niche information technology solutions nicheits fedramp cmmc iso27001 soc1 soc2 cyber security compliance cloud engineering afwerx hosting cybersecurity maturity model gap analysis aws azure google onprem architecture federal agency agencies Risk management Framework RMF NIST 800-53 ATO documentation Office365 migration advisory services SAAS IAAS SecAAS Microsoft redhat platform1 plateformone DISA STIG CIS baseline configuration hardening cm-2 DOD Department of Defense Army Navy Marine 8500.2 8500.1 Impact Level IL4 IL5 IL6 governance risk jab conmon Steelcloud configos exchange sharepoint dynamics365 adfs active directoryFedRAMP stands for the “Federal Risk and Authorization Management Program.” It standardizes security assessment and authorization for cloud products and services used by U.S. federal agencies. The goal is to make sure federal data is consistently protected at a high level in the cloud. The Federal Risk and Management Program (FedRAMP) is a cyber security
risk management program for the purchase and use of cloud products and services used by U.S. federal agencies. Only Cloud Service Providers (CSP) with an authorized Authority-To-Operate (ATO) approval may work with government agencies. The program was initiated by the Office of Management and Budget (OMB) in response the to the U.S. government’s 2011 Cloud First Policy.

Before a commercial cloud service offering (CSO) can be leveraged by a federal agency, it must demonstrate that it meets all FedRAMP
compliance requirements. These requirements are outlined in the NIST 800-53 control framework and supplemented by the FedRAMP Program Management Office (PMO). Authorization is granted to the cloud service provider (CSP) through the provision of what is known as the FedRAMP Authority to Operate (ATO).

NicheITS brings an exceptional level of in-depth background knowledge to our StateRAMP/FedRAMP advisory practice. Executive leadership and staff members have experience in development of over 100+ NIST 800-53 agency (GSS/Application) ATO packages with another significant number of CSP FedRAMP ATO packages. NicheITS executive leadership also brings unique skillset in our practice having been the managing director to several Cloud Service Providers, therefore bring background experience from the CSP and Advisory perspective.

WHAT ARE THE REQUIREMENTS FOR STATERAMP?

NicheITS Niche information technology solutions nicheits fedramp cmmc iso27001 soc1 soc2 cyber security compliance cloud engineering afwerx hosting cybersecurity maturity model gap analysis aws azure google onprem architecture federal agency agencies Risk management Framework RMF NIST 800-53 ATO documentation Office365 migration advisory services SAAS IAAS SecAAS Microsoft redhat platform1 plateformone DISA STIG CIS baseline configuration hardening cm-2 DOD Department of Defense Army Navy Marine 8500.2 8500.1 Impact Level IL4 IL5 IL6 governance risk jab conmon Steelcloud configos exchange sharepoint dynamics365 adfs active directory staterampDue to the success of the federal FedRAMP program for both Federal agencies and Cloud Service Providers (CSP), the requirement for a universal, FedRAMP-style framework for state and local governments has became increasingly apparent. In 2020, a collaborative group of state executives created StateRAMP so the “verify once, use many” approach to verifying minimum cybersecurity requirements through control implementation could enhance on state and local government security frameworks.

StateRAMP strives towards development and implementation of a comprehensive security framework designed to improve cloud security for state and local governments. NicheITS aims towards working with our partners to educate and guide them through the requirements of the StateRAMP compliance framework and its relationship with parallel programs such as FedRAMP. 

NicheITS works with our partners and customers to assist in guiding Cloud Service Providers (CSP’s) effortlessly through the requirements, pitfalls, and show stoppers of the the StateRAMP Authorization process.  With a well establish track record on advising clients through the FedRAMP process. NicheITS builds on those same processes and in-house developed solutions to drive CSP’s through the ATO process.

AUTHORITY TO OPERATE DEVELOPMENT AND SUPPORT SERVICES

FedRAMP requires, for all federal agencies and their respective Cloud Providers, to submit documentation outlining their cloud computing capability and associated security measures that are implemented. This Assessment and Authorization (A&A) process will include a Security Plan which will provide a description of the system including, but not limited to, its purpose, location, and technical capabilities.
Additionally, the Security Plan will also contain implementation statements addressing how the system is compliant with the controls listed within the 800-53. Alongside the Security Plan, the A&A package will also include an organizational Contingency Plan/Disaster Recovery Plan, Configuration Management Plan, Risk Assessment, and Security Assessment Report.

Continuous Monitoring Services

NicheITS provides Continuous Monitoring services for organizations which have FedRAMP and/or Cybersecurity Maturity Model Certification (CMMC) requirements. For organizations engaged with FedRAMP the process for developing, maintaining and submitting ConMon requirements does not stop with a successful assessment and authorization.

NicheITS employs staff with extensive background in solutions such as Qualys, Tenable and Rapid7 to lead and maintain organization vulnerability scanning requirements.

NicheITS facilitates the following expertise in Continuous Monitoring:

  • Development and Training on the process for maintaining the authorization once the authorization has been granted by a federal agency and/or the JAB.
  • Development and maintenance of weekly, monthly, quarterly, and annual reporting checkpoints.
  • Control assessments and penetration testing to be performed annually or more frequently if introducing a significant change request by the CSP.
  • Vulnerability scans to be performed monthly, with reporting provided to the FedRAMP PMO each month based on the results of those scans

ONPREM AND CLOUD ENGINEERING SERVICES

NicheITS staff are selected not only for their significant background in compliance understanding, but for having significant past performance with strong, hands-on, engineering background.
NicheITS engineering staff come from enterprise environments where AWS, Azure, and Google GCP, and on-Prem. Vmware, and OpenStack solutions are common. NicheITS engineering services empower clients to tackle the most challenging architecture, implementation and operations requirements for cloud-based applications, products and platforms on public, private and hybrid environments.

FEDRAMP Experience

NicheITS provides expert advisory services that empower Cloud Service Providers (CSP) everything that is needed to pass assessments and obtain/renew their Authority-To-Operate (ATO). By leveraging NicheITS advisory services, CSP’s receive the guidance required to enhance and/or refine organizational security documentation and procedures to meet requirements.
NicheITS advisory services can involve various CSP Information Systems (IS) and service models to ensure that timelines are defined and executed on, organizational deficiencies in system architecture and policies are mended, understanding of FedRAMP controls and procedures is achieved, annual audits and ATO renewal process is smooth with dedicated continuous monitoring, all while following NicheITS’ methodology proven to reduce time and cost.
NicheITS conducts readiness or gap analysis to determine completion of deliverables and project timelines for FedRAMP ATO package submissions.

GAP ANALYSIS SERVICES

NicheITS facilitates pre-assessments in order to provide organization’s an enhanced level of understanding of what is required to obtain FedRAMP Authorization. Prior to the assessment, the pre-assessment is engaged on by trained FedRAMP professionals that customize their expertise to your organization’s needs.
The NicheITS Pre-Assessment follows FedRAMP assessment requirements, while focusing on a subset of controls selected specifically for the Cloud Service Provider (CSP) system. The selected 800-53 controls are based on the FedRAMP critical controls with agreement from the CSP.
This approach provides a cost effective, value added approach for assessing the readiness of a CSP for FedRAMP Authority-To-Operate (ATO). NicheITS offers pre-assessment services to evaluate assessment readiness and provide a timeline of FedRAMP Authorization.

STATERAMP ADVISORY SERVICES

 

Interested in Compliance Professional Services? Talk with our Team and Start Preparing for FedRAMP, StateRamp, or Any Other “RAMP” Type Services​

Fill out the contact form below to get an assessment of your organization’s readiness for these compliance requirements.

Talk with our Compliance Advisory team! Fill out the form on this page or email us at [email protected]

Request X-RAMP Professional Services