Federal Risk and Authorization Management Program (FedRAMP) Advisory and Assessment Services

FedRAMP Advisory

Consulting and Documentation Assistance

Before a CSP can begin the FedRAMP certification process, they must first develop and implement FedRAMP-compliant documentation and controls. WCG provides consulting services throughout the FedRAMP process and assists you with Security Artifact Creation such as Security Assessment Plan (SAP), System Security Plan (SSP), Security Assessment Report (SAR), and Plan of Action and Milestone (POA&M) to get you prepared for your upcoming FedRAMP assessment and authorization.

We also provide the following as part of our consulting services:

• Assist you to determine your cloud solution’s proper Federal Information Processing Standards (FIPS)-199 categorization of the risk level.
• Conduct Vulnerability Assessment and Penetration Testing.
• Conduct gap analysis to evaluating the sufficiency of security controls to determine organizations’ compliance level with FedRAMP requirements.
• Evaluate, review and revise your Incident Response Plan, Process, and Procedures to ensure it sufficiently addresses FedRAMP requirements.

FedRAMP Preparation

FedRAMP Readiness Assessment

We review your environment and conduct a technical capability assessment to determine if it meets FedRAMP security requirements which results in a FedRAMP Readiness Assessment Report (RAR). In order to kick off the authorization process with the Joint Authorization Board (JAB), CSPs must achieve the FedRAMP Ready JAB designation for their Cloud Service Offering (CSO).

FedRAMP Authorization

Full Security Assessment

We perform an independent assessment of the system to evaluate critical control implementation and verify your compliance level to FedRAMP. A 3PAO-required Security Authorization Package will be developed that contains a Security Assessment Plan (SAP), Security Assessment Report (SAR), and a Plan of Action and Milestones (POA&M). Vulnerability and penetration testing activities are within the scope of this assessment.

This full security assessment ensures compliance with NIST SP 800-53 Revision 4 or 5 and FedRAMP controls for low, moderate, or high-impact cloud organizations’ products and/or services.

FedRAMP Continuous Monitoring

We provide ongoing support with risk evaluation to maintain your organization's FedRAMP ATO by monitoring the following:

• Operational Visibility – CSPs must provide evidentiary information to Authorizing Officials (AOs) at least monthly, annually, every three years, and on an as-needed basis after authorization is granted.
• As a certified FedRAMP 3PAO, we perform an assessment on an annual basis for a subset of the overall controls implemented on the system to ensure your organization’s operational visibility.
• Change Control – The change control processes help maintain a secure baseline configuration of the CSP’s architecture.