FedRAMP Implications for Data Centers

Data centers and compliance go hand in hand, and whenever there is any change in the compliance front, data centers invariably have to make the necessary changes.

Companies who provide cloud services to the U.S. government now have to comply with the Federal Risk and Authorization Management Program (FedRAMP), a new set of uniform security requirements. FedRAMP makes it easy for federal agencies, who can now pick from a list of pre-screened cloud providers, to deploy their apps in the cloud. These ones lie in these pre-screened providers, and, by extension, data centers who offer service to these providers, to meet the mandated security requirements.

FedRAMP compliance mandates:

• The system inventory, boundaries and controls satisfy 298 control requirements derived from the National Institute of Standards and Technology’s (NIST) Special Publication 800-53 Revision 3.
• Laying down policies and procedures governing the employees who perform IT security responsibilities and processes in place for performing risk and security assessments.
• Mapping the system inventory and boundaries to describe network, hardware and software inventory and system boundaries.
• Documenting the System Security Plans (SSPs) as per the guidelines and templates specified in FedRAMP.gov. The FIPS 199 categorization template allows certified service providers to categorize itself as low or moderate security category, and this determines the set of applicable FedRAMP security controls.

Before FedRAMP became mandatory, each federal agency conducted its own risk assessment for the cloud service they procured. This resulted in multiple and redundant security assessments for identical services, and lack of clarity on what constituted acceptable standards. FEDRamp standardized the risk assessment process for every federal agency, and, as such, would make things easier in the long run, even if data centers and providers would have to spend considerable time upfront mapping the new security requirements.

FedRAMP standards are the result of a close collaboration with all major cybersecurity stakeholders, including NIST, General Services Administration, Department of Defense, Department of Homeland Security, National Security Agency, Office of Management and Budget, the Federal CIO Council and its working groups and the private industry.

Let the compliance experts at Lifeline Data Centers help you solve your SSAE 16, TIA-942, NFPA, HIPAA, FISMA, FDA, PCI/DSS, FedRAMP and Sarbanes Oxley audit problems. Lifeline delivers multi-level compliance solutions in audit-ready data centers with in-house expertise. We are dedicated to staying on top of compliance to make sure you don’t have to worry about it. Learn more about our data center compliance today.

Alex Carroll

Managing Member at Lifeline Data Centers

Alex, co-owner, is responsible for all real estate, construction and mission critical facilities: hardened buildings, power systems, cooling systems, fire suppression, and environmentals. Alex also manages relationships with the telecommunications providers and has an extensive background in IT infrastructure support, database administration and software design and development. Alex architected Lifeline’s proprietary GRCA system and is hands-on every day in the data center.