Public Sectore | RISCPoint

July 16, 2024

I’m FedRAMP Authorized, Now What?! | FedRAMP Blog Series

Achieving FedRAMP authorization is just the beginning for Cloud Service Providers (CSPs). Maintaining this authorization requires continuous compliance with stringent security standards and regular assessments to ensure cloud environments remain secure. Key tasks include monitoring security incidents, conducting vulnerability scans, effective patch management, maintaining secure configurations, performing regular security control assessments, and managing Plans of Action and Milestones (POA&M). Notably, CSPs must transition their hardening standards to DISA STIGs or CIS Level 2 as per Revision 5 requirements to avoid losing authorization. Continuous diligence in these areas ensures ongoing authorization and the ability to serve federal agencies securely.

April 2, 2024

Navigating the New Frontier: Understanding FedRAMP's Red Team Requirement

New red team requirement introduced in FedRAMP Revision 5 and NIST SP 800-53 Rev 5 emphasize proactive defense mechanisms in cybersecurity. It explores the concept of red teaming, the challenges of implementing these exercises without explicit guidance, and suggests approaches for internal execution and partnering with external experts like RISCPoint. The post also speculates on future guidance from the FedRAMP Program Management Office, emphasizing the importance of integrating red team findings into continuous improvement processes for enhanced cybersecurity resilience.

October 16, 2023

Three Pain Points of a FedRAMP Assessment

Exploring the challenges of achieving FedRAMP authorization: Unveiling the critical pain points faced by Cloud Service Providers (CSPs) in navigating the complex assessment process to unlock federal marketplace opportunities.

September 19, 2023

RISCPoint Awarded Prestigious FedRAMP® and StateRAMP 3PAO Status

RISCPoint proudly achieves FedRAMP® and StateRAMP 3PAO accreditation, reinforcing its commitment to cybersecurity excellence and serving as a trusted extension of FedRAMP's mission to secure the cloud. With this recognition, RISCPoint continues to elevate its advisory services, offering unparalleled expertise in compliance across various industries.

August 21, 2023

NIST 800-171 Revision 3 Draft and What It Means for Federal Contractors

The draft of NIST SP 800-171 Revision 3 introduces crucial updates for federal contractors, aiming to enhance protection of Controlled Unclassified Information (CUI) in nonfederal systems. RISCPoint emphasizes the importance of understanding these changes, including new control families and refined security requirements, to ensure compliance and secure federal contracts effectively.

August 14, 2023

Penetration Testing vs. Red Teaming: Understanding the Differences

RISCPoint demystifies the differences between penetration testing and red teaming, crucial methodologies for assessing an organization's security posture. While penetration testing focuses on identifying technical vulnerabilities within a controlled environment, red teaming provides a comprehensive, real-world attack simulation, assessing both technical defenses and human factors. This article elucidates the importance of both approaches in forming a robust cybersecurity strategy, especially with new FedRAMP requirements emphasizing red teaming's role in security assessments.

July 24, 2023

Getting Started with Your FedRAMP Rev. 4 to Rev. 5 Transition

RISCPoint offers essential guidance for Cloud Service Providers navigating the FedRAMP Rev. 4 to Rev. 5 transition, emphasizing the importance of identifying gaps by September 1, 2023, and outlining a clear, strategic approach to compliance with the new baselines. This move ensures CSPs maintain their FedRAMP authorization efficiently, reinforcing RISCPoint's commitment to supporting clients through complex cybersecurity and compliance challenges.

June 20, 2023

FedRAMP Rev 5: What You Need to Know

RISCPoint breaks down the critical updates and transition plan for FedRAMP Revision 5 Baselines, highlighting the key considerations for Cloud Solution Providers. With a focus on alignment with NIST SP 800-53, Rev. 5, this guide outlines the phases of Planning, Initiation, and Continuous Monitoring to ensure compliance and enhance cybersecurity frameworks for federal government cloud services.

October 20, 2022

An Introduction to FISMA

RISCPoint demystifies the Federal Information Security Management Act (FISMA) for organizations involved with the federal government. Learn the key provisions, requirements, and benefits of FISMA compliance, and discover how partnering with a virtual CISO like RISCPoint can ensure your security and compliance needs are met, safeguarding sensitive federal information and enhancing your chances of securing federal contracts.

September 13, 2022

4 Key Benefits of Complying with the NIST CSF

RISCPoint explores the advantages of adopting the National Institute of Standards and Technology's Cybersecurity Framework (NIST CSF) for organizations of all sizes and sectors. Discover how this voluntary framework provides a structured approach to cybersecurity, offering benefits such as a common organizing structure, flexibility, privacy considerations, and workforce development, ultimately enhancing your organization's cybersecurity maturity and posture.

August 20, 2022

4 Things to Consider When Choosing Your FedRAMP Consultant

RISCPoint outlines key factors to consider when selecting a FedRAMP consultant for your organization's authorization journey. From assessing the depth of expertise and communication skills to evaluating cost and experience with the Program Management Office, these considerations are crucial in ensuring a smooth and successful path to FedRAMP compliance.

July 14, 2022

FedRAMP Adds Three New Control Families to Catalog

RISCPoint sheds light on the significant updates in FedRAMP Revision 5, including the addition of three new control families: Supply Chain Risk Management, Personally Identifiable Information Processing and Transparency, and Program Management. Understand the implications of these changes for your organization's cybersecurity and compliance needs and learn how to prepare for the upcoming shift in requirements.

June 2, 2022

FedRAMP Revision 5 Introduces Threat-Based Methodology - Here's What to Expect

RISCPoint outlines the significant changes in FedRAMP Revision 5, highlighting the shift to a Threat-Based Methodology aligned with MITRE ATT&CK Framework version 8.2. Understand how this update strengthens security, reduces the number of additional controls, and what it means for your organization's compliance programs as you prepare for the new standards.

February 22, 2022

So, What's StateRAMP?

RISCPoint introduces StateRAMP, a consortium aimed at enhancing cybersecurity for state and local governments by vetting third-party vendors' security postures. Modeled after the federal FedRAMP framework, StateRAMP aims to protect citizen data, save taxpayer dollars, and promote cybersecurity best practices, addressing the unique needs of state and local governments not covered by FedRAMP.

November 29, 2021

Key Considerations for StateRAMP Authorization

RISCPoint outlines essential factors for vendors aiming to achieve StateRAMP authorization, highlighting the inaugural class of approved vendors like BlackBerry, Cisco, and Microsoft. Understand the rigorous requirements, including compliance with NIST SP 800-53 Rev. 5, the need for a trusted advisor, a thorough security controls assessment, ongoing monitoring, and the determination of impact level categories, to successfully navigate the StateRAMP authorization process for state and local government contracts.

November 15, 2021

CMMC 2.0 What to Know, What to Do, and How to Prepare

RISCPoint breaks down the key changes and preparations needed for CMMC 2.0, the streamlined standard set to impact government contractors and the Defense Industrial Base. Learn about the reduction in levels, expanded self-assessment eligibility, and the importance of aligning with NIST 800-171 to ensure your organization is ready for the immediate implementation of CMMC 2.0 upon approval.

June 8, 2021

RISCPoint Achieves RPO Status

RISCPoint Advisory Group proudly announces its new status as a Registered Provider Organization (RPO) within the CMMC ecosystem, further enhancing its commitment to serving the Defense Industrial Base. This accreditation enables RISCPoint to guide clients through the complexities of CMMC certification, adding to its comprehensive range of security and compliance services.

June 1, 2021

The Growing Importance Of A CMMC For Government Contractors

RISCPoint emphasizes the increasing significance of the Cybersecurity Maturity Model Certification (CMMC) for government contractors within the Defense Industrial Base. With the integration of CMMC into the Defense Federal Acquisition Regulation Supplement (DFARS), it's crucial for suppliers and contractors to comply with the new provisions to protect sensitive information and maintain eligibility for DoD contracts. Learn about the requirements for obtaining a CMMC and how it impacts your business in the defense sector.

February 26, 2021

FedRAMP vs. StateRAMP: A Guide

RISCPoint breaks down the differences between FedRAMP and StateRAMP, two frameworks designed to standardize security assessments for cloud services. While both are modeled after NIST standards, FedRAMP applies to federal government vendors, whereas StateRAMP caters to state and local government entities. Learn about the paths to authorization for each and how existing FedRAMP authorizations can benefit from reciprocity agreements with StateRAMP.

December 15, 2020

Navigating The Paths To FedRAMP Authorization

RISCPoint guides organizations through the complex journey to FedRAMP authorization, offering strategic advice on choosing the right path, whether it's through Joint Authorization Board (JAB) or Agency Sponsorship. Learn about the importance of FedRAMP for Cloud Service Providers working with the federal government, the key steps to prepare for authorization, and the ongoing responsibilities of maintaining FedRAMP compliance with RISCPoint's expert advisory services.