Encryption of Federal Data

One of the biggest challenges our customers face when pursuing Federal Risk and Authorization Management Program (FedRAMP®) compliance is the federal mandate that Federal Information Processing Standards (FIPS) 140-2 validated cryptographic modules must be consistently applied where cryptography is required. Where is cryptography required, you ask? FIPS mode must be applied for all inbound connections to the cloud service, connections to management interfaces within the cloud service offering (CSO), and wherever Federal data is stored. In addition, credentials such as passwords must be protected using FIPS-validated modules. You can find the list of FIPS 140-2 validated solutions by searching the National Institute of Standards and Technology (NIST) Cryptographic Module Validation Program.

FIPS 140-2 validated solutions like those provided by SafeLogic can be implemented to help organizations successfully protect customer information. Because navigating the relationship between FIPS 140-2 validated encryption and FedRAMP certification can be confusing and complex for many enterprises, SafeLogic and Coalfire® collaborated to write “FedRAMP Requirements for Validated Cryptographic Modules,” a white paper discussing the encryption-relevant FedRAMP security controls that must be implemented.

Understanding the FIPS-140-2 encryption requirements is, of course, just one element of the comprehensive FedRAMP process. Yet, the federal government continues to migrate applications to the cloud as agencies work to modernize their IT infrastructures and garner greater efficiencies—making FedRAMP an important compliance framework for Cloud Service Providers wishing to tap into this market opportunity. If you would like to learn more about FedRAMP, feel free to contact our team.