Tag: fedramp

Federal Information Processing Standard (FIPS) 140-2 specifies the security requirements for cryptographic modules that protect sensitive information. It is the current United States and Canadian government standard, and is applicable to systems that are required to be compliant with Federal Information Security Management Act (FISMA) or Federal Risk and Authorization Management Program (FedRAMP). In this blog, we demonstrate how to enable FIPS mode in Amazon Linux 2 and verify that unauthorized cryptographic functions are not being used in OpenSSL or the OpenSSH server.

Did you know AWS can help deliver an automated solution for creating the FedRAMP Integrated Inventory Workbook? This workbook needs to be updated and submitted to the FedRAMP Project Management Office (PMO) monthly for continuous monitoring. Automating this workbook saves manual work hours. Any customer going through the FedRAMP authorization process can leverage this workbook. Understand how to gather an inventory of AWS resources from AWS Config data to create the FedRAMP Integrated Inventory Workbook.

From November 4-8, Amazon Web Services (AWS) will host its first annual “AWS Compliance Week: Achieving Cloud Compliance and Security in the AWS Cloud” to help customers navigate and accelerate their cloud adoption plans for regulated workloads and sensitive data. The five-part, week-long webinar series will highlight how AWS GovCloud (US) Regions are purpose-built to help customers realize cloud benefits when working with Controlled Unclassified Information (CUI), defense data, export-controlled data, and criminal justice information (CJI).

Smartsheet, a cloud-based platform for work execution, recently announced Smartsheet Gov achieved a Federal Risk and Authorization Management Program (FedRAMP) Provisional Authority to Operate (P-ATO). Smartsheet Gov is a secure solution that enables federal agencies to organize and scale processes, streamline workflows, and automate repetitive yet critical tasks, built on Amazon Web Services (AWS) GovCloud (US). The Joint Authorization Board (JAB)-issued authorization enables U.S. federal government customers to increase their use of the Smartsheet Gov platform to help them modernize their IT missions. “By building on AWS GovCloud, Smartsheet and their government customers may host sensitive data and regulated workloads, while meeting stringent US government security and compliance requirements,” said Dave Levy, Vice President of U.S. Federal Government at AWS.

We announced the Authority to Operate (ATO) on AWS program, which provides resources to Independent Software Vendors (ISVs) who aspire to achieve a compliance authorization, such as FedRAMP, Defense Federal Acquisition Regulation Supplement (DFARS), Payment Card Industry (PCI), Criminal Justice Information Services (CJIS), and many other compliance programs.

The new AWS GovCloud (US-East) Region is now available. The AWS GovCloud (US-East) Region joins GovCloud (US-West) as the second AWS GovCloud Region in the US, and the 19th AWS Region worldwide. The second AWS GovCloud (US) Region gives US government customers a consistent compliance framework across their IT environment including FedRAMP, DoD IL 5, Criminal Justice Information Services (CJIS), and International Traffic and Arms Regulations (ITAR).

In May 2015, the CIO’s office at the U.S. Department of Interior embarked on a mission to provide a secure, scalable platform for the 32 agencies that make up the Federal Geographic Data Committee. The platform provides a managed services environment for agencies to host and share geospatial data, geospatial services and geospatial applications for the public, and with other government agencies and their partners. DOI names GTRI, now Zivaro, the mission partner. GTRI, an AWS Advanced Technology Partner, specializes in the selection, implementation, deployment, and maintenance of AWS environments.

In November, with the launch of the AWS Secret Region, we achieved a Provisional Authorization (PA) for Impact Level 6 (IL6) workloads from the U.S. Defense Information Systems Agency (DISA), the IT combat support organization of the U.S. Department of Defense (DoD). The PA was recently updated to add 11 new AWS services. A service catalog for the Region is available through your AWS Account Executive.

Cloud technology continues to be a major catalyst in how the federal government can achieve operational efficiencies and innovate on demand to advance their mission. Many government agencies, including the Department of Defense (DoD) and other agencies with mission-critical workloads, are using AWS’s utility-based cloud offerings to process, store, and transmit federal government data. As evidenced by the full range of our Authorizations-To-Operate, third-party attestations, and certifications, the AWS Cloud provides government customers with the only one-stop shop to handle Public, For Official Use Only (FOUO), Sensitive, Secret, and Top Secret workloads.

Competition for bringing new mobile and cloud capabilities to market continues to grow. This, along with the pace of innovation, has posed a challenge for regulatory bodies as they struggle to keep up with the evolving IT risk landscape. Establishing standards often requires analyzing sensitive, and in some cases, classified data systems, applications, and networks. […]