Deliverables

Sets expectations for ethical conduct, workplace standards, reporting concerns without retaliation, and protecting information, and defines the progressive sanctions process for violations.

Defines how secure configuration baselines are established, enforced, and verified for the certification boundary, covering change control, infrastructure-as-code governance, drift response, patching, and least functionality.

Describes how the security posture of the certified system is continuously monitored, covering scanning, configuration and log monitoring, inventory, residual-risk tracking, and recurring reporting to FedRAMP and agency customers.

Defines the four data classification levels, including Controlled Unclassified Information, and the labeling, storage, access, transmission, sharing, and disposal rules each level requires within the certification boundary.

Sets retention periods and secure disposal methods for data in the certification boundary, including customer offboarding, backup retention, legal holds, and vendor data obligations.

Sets requirements for encrypting data at rest and in transit, managing keys, certificates, and secrets, and maintaining an inventory of validated cryptographic modules across the certification boundary.

Establishes executive commitment, authority, and governance for the security program, including risk tolerance, risk-acceptance authority, governance meetings, resource commitments, and accountability metrics.

Describes how the dedicated FedRAMP security inbox is maintained, monitored, and routed, and how emergency and important FedRAMP messages are acknowledged and acted on within required timeframes.

Defines who is notified of security incidents, on what timeline, and in what format, covering FedRAMP, agency customer, and CISA notifications, ongoing updates, and final incident reports.

Establishes procedures for detecting, containing, eradicating, and recovering from security incidents affecting the platform and federal data, including severity levels, team roles, evidence preservation, exercises, and training.

Sets the overarching structure, objectives, roles, training expectations, review process, exceptions, and enforcement for the information security program and the policy series that implements it.

Governs audit logging across the certification boundary, defining required event types, collection, centralized analysis, retention, integrity protection, access restrictions, alerting, and log review.

Governs maintenance of company-managed endpoints, their software, and in-boundary managed services, including authorized personnel and tools, remote maintenance, and timely updates. Data-center hardware maintenance is inherited from the cloud provider.

Defines how network communications in the certification boundary are secured, segmented, and monitored, covering network architecture, traffic controls, container networking, remote administrative access, external connections, and encryption in transit.

Sets physical protection rules for endpoint devices and remote, co-working, and office workspaces, including travel and asset security. Data-center physical and environmental controls are inherited from the cloud provider.

Defines how requests to access, correct, delete, or transfer personal information are handled, and how stakeholders are notified when personal information is disclosed to third parties.

Defines the methodology for identifying, rating, and treating information security risks, and sets the organization’s risk appetite, tolerance, and review cadence.

Describes how software bills of materials are generated and retained, and how third-party components are monitored for vulnerabilities, checked for license compliance, and restricted to approved sources.

Significant Change Notification register, machine-readable (FedRAMP SCN schema). Every notice sent, newest first.

Significant Change Notification register, human-readable. Every notice sent, newest first.

Sets requirements for building security into each phase of software development, including secure coding, code review, environment separation, and security testing before release.

Establishes general awareness, role-specific, and secure development training requirements for personnel affecting production or boundary systems, plus phishing simulations, exercises, knowledge assessments, and training records.

Documents the budget, personnel, tooling, assessment, training, and incident response resources allocated to the security program, and how security investments are prioritized, approved, tracked, and reviewed.

Describes how changes to the cloud service offering are classified as routine, adaptive, transformative, or impact-level, and what notifications, records, and timelines each classification requires.

Sets the approach for identifying, assessing, and mitigating risks from cloud providers, vendors, open-source software, hardware, and contracted services, including software integrity, provenance tracking, and supply chain incident response.

Defines how third-party vendors and services are tiered, evaluated, contracted, monitored, and offboarded, with emphasis on those that handle federal data or provide security functions for the certification boundary.

Defines how vulnerabilities in the certification boundary are detected, evaluated for exploitability, reachability, and impact, remediated within required timeframes, reported monthly, and recorded when accepted.

Establishes the public process for reporting security vulnerabilities, including reporting channels, response timelines, safe harbor for good-faith researchers, coordinated disclosure, and integration with internal vulnerability management.

How to access and follow Silkline’s secure configuration guidance.

Sets rules of behavior for using company devices, technology, and data, covering personnel security, prohibited activities, malware protection, remote use, asset return, and clean-desk practices.

Governs the lifecycle of human and non-human accounts in the certification boundary, covering provisioning, deprovisioning, multi-factor authentication, least privilege, just-in-time elevation, and response to suspicious activity.

Defines how assets in the certification boundary are identified, inventoried, classified, and managed from provisioning to decommissioning, across infrastructure, software, data, personnel, network, and endpoint categories.

Sets recovery objectives, backup strategy, disaster recovery procedures, testing, and communications for maintaining or restoring critical services and keeping federal customer data available and intact after a disruption.