Evaluating Cloud Hosting Providers with the FedRAMP

While the FedRAMP (Federal Risk and Authorization Management Program) is intended for government entities and their criteria and processes for assessing and monitoring cloud products/services, it’s still a good security standard model that many organizations could follow to minimize security risks in the cloud.

Contents

Security Assessment
Ongoing Assessment and Authorization

The most applicable standards used for evaluating cloud hosting providers includes:

Security Assessment

Documenting security controls is the first step that any organization should require of their cloud provider – this includes:

Document the controls implemented in the cloud and the cloud environment.
Policies around user behavior – with details around use and access.
An IT contingency plan – a disaster recovery plan that defines how the organization intends to recover information system services and manage disruptions.
Configuration management plan – a plan describing how changes to the system are managed and tracked.
Incident response plan – similar to breach notification clauses that should be included in any business associate agreement, for healthcare organizations concerned with HIPAA, an incident response plan outlines how incidents are detected, reported, escalated, handled and remediated.
Any authentication that will be used in the cloud, including a required authentication level – two-factor authentication is one method that may be easily employed to create an additional layer of security.
Privacy impact assessment – this should document what kind of personally identifiable information (PII), or protected health information (PHI), is collected and if it’s properly safeguarded.

In addition to documentation, this step includes performing security testing, which requires the cloud provider to contract with an accredited third party auditor to test the security of the cloud provider’s system and environment, produce a report of results, and document a plan of action to remediate or change their system to meet security requirements.

As a cloud provider that needs to balance both security and compliance for our clients, Online Tech has contracted a third party auditor to test its controls against a variety of compliance standards, including HIPAA compliance, PCI DSS Compliance, SOX compliance and more on a continuous basis. Read about what each standard means in our Data Center Standards Cheat Sheet.

Ongoing Assessment and Authorization

This refers to the continuous monitoring of cloud providers to ensure their security controls remain effective over time.

Operational visibility refers to the transparency of security control implementations – annual self-attestation reports can help in this area.
Change control process – establishing a process to track any changes that could impact the ability of a cloud provider to meet security requirements. This also includes changes in a cloud provider’s management.
Incident response – keeping track of any new risks or vulnerabilities that might affect authorized system and response/mitigation activities.

Following a similar plan can help your organization avoid a data breach and stay safe in the cloud.

References:
FedRAMP Processes from the U.S. General Services Administration
FedRAMP Security Assessment
Performing Security Testing
Document Security Controls