FedRAMP Compliance

Note: FedRAMP policy framework requires Enterprise Edition.

The Federal Risk and Authorization Management Program (FedRAMP) policy framework helps cloud service providers (CSPs) protect federal data and achieve FedRAMP authorization.

Overview

FedRAMP provides a standardized approach to security assessment for cloud products and services used by federal agencies. Aquilon DLP’s FedRAMP policy implements NIST SP 800-53 control families:

AC - Access Control: System access and authorization
AU - Audit and Accountability: Audit logging and review
IA - Identification and Authentication: User/device identification
MP - Media Protection: Digital and physical media safeguards
SC - System and Communications Protection: Communication security
SI - System and Information Integrity: Integrity protection

FedRAMP Baselines

Baseline	Impact Level	Controls	Use Cases
Low	Low impact	~125	Public-facing sites, low-sensitivity data
Moderate	Moderate impact	~325	Most federal applications, PII
High	High impact	~421	Law enforcement, emergency services, financial

Detection Methods

Cloud-Specific Scanners

Scanner	Detects	Severity
`cui_marking`	CUI in cloud storage	Critical
`api_key`	Cloud service credentials	Critical
`database_connection`	Database connection strings	Critical
`crypto`	Encryption keys	Critical

Federal Data in Cloud Context

Scanner	Cloud Context Required	Severity
`ssn`	Multi-tenant cloud environment	Critical
`email`	.gov domain or federal agency	Medium
`ip_address`	Federal network ranges	High
`gov_identifier`	DoD EDI-PI in cloud systems	High

Configuration

Basic Configuration (Moderate Baseline)

[policies]
enabled_policies = ["fedramp"]

Baseline-Specific Configuration

[policies.policy_configs.fedramp]
settings = { baseline = "moderate", confidence_threshold = "0.7" }

Configuration Options

Option	Description	Default
`baseline`	FedRAMP baseline (low, moderate, high)	`moderate`
`detect_cui`	Detect CUI in cloud storage	`true`
`detect_credentials`	Detect API keys, connection strings	`true`
`detect_pii`	Detect PII in multi-tenant environments	`true`
`confidence_threshold`	Minimum scanner confidence (0.0-1.0)	`0.7`

Context Detection

Cloud Context Keywords

Cloud terms: cloud, SaaS, IaaS, PaaS, tenant, multi-tenant, serverless
Provider terms: AWS, Azure, GCP, FedRAMP authorized, GovCloud, Azure Government
Service terms: API, endpoint, webhook, microservice, Lambda, Functions
Storage: S3, Blob, object storage, bucket, container registry

Federal Agency Context

Agency terms: federal, agency, government, GSA, FedRAMP PMO
Authorization terms: ATO, authorization, JAB, P-ATO, agency ATO
Compliance terms: continuous monitoring, ConMon, POA&M, 3PAO, SSP

Cloud Infrastructure Context

Multi-tenant and infrastructure indicators:

Tenant isolation: tenant ID, account ID, subscription, organization
Network: VPC, VNET, security group, NSG, firewall rules
Identity: IAM, RBAC, service principal, managed identity
Secrets: Key Vault, Secrets Manager, Parameter Store

Authorization Boundary Context

FedRAMP authorization boundaries require clear data classification:

Boundary terms: authorization boundary, system boundary, enclave
Data flow: ingress, egress, data flow diagram, DFD
Interconnection: ISA, MOU, interconnection security agreement
External: external system, third-party, SaaS integration

Example Context Flow

Finding: API key "AKIA..." in configuration file
Context: "AWS GovCloud deployment for agency.gov"

Result: Critical violation (cloud credentials in federal context)

Finding: SSN in database export
Context: "Multi-tenant SaaS platform, FedRAMP Moderate ATO"

Result: Critical violation (PII in shared cloud environment)

Violation Metadata

Each FedRAMP violation includes:

{
  "policy": "FedRAMP",
  "severity": "critical",
  "baseline": "moderate",
  "nist_control": "SC-28",
  "control_family": "System and Communications Protection"
}

Compliance Reporting

Authorization Boundary Monitoring

-- All FedRAMP findings
SELECT severity, scanner, COUNT(*) as count
FROM aquilon_dlp_alerts
WHERE policy = 'FedRAMP'
GROUP BY severity, scanner
ORDER BY count DESC;

Continuous Monitoring Support

FedRAMP requires continuous monitoring (ConMon). Query for recent issues:

-- Last 30 days of FedRAMP findings
SELECT path, scanner, severity, timestamp
FROM aquilon_dlp_alerts
WHERE policy = 'FedRAMP'
  AND timestamp > datetime('now', '-30 days')
ORDER BY timestamp DESC;