Government & Defense

The Federal Risk and Authorization Management Program (FedRAMP) is the mandatory gatekeeping framework for any cloud service provider (CSP) that wants to sell to the US federal government. It is not optional, it is not aspirational, and it is not fast. FedRAMP authorization typically takes 12-18 months for a Moderate baseline and costs between $500K and $2M+ depending on system complexity. Understanding FedRAMP is essential for any CISO whose organization either provides cloud services to the government or consumes them.

Authorization Paths After M-24-15

M-24-15 replaced the old two-path model with three: agency authorizations (a sponsoring agency's authorizing official grants the ATO — still the dominant route in practice), program authorizations (granted through FedRAMP itself, the structural successor to the JAB path and aimed at CSPs that cannot secure an agency sponsor), and any additional path the FedRAMP PMO designs in consultation with OMB and NIST. That third category is not filler — it is the legal basis on which the 20x pilots below were run.

FedRAMP 20x and the Class A–D Transition

FedRAMP 20x is the programme's rebuild of the assessment model itself: instead of narrating compliance against ~325 controls in documents, CSPs demonstrate Key Security Indicators (KSIs) through machine-readable submissions validated by a 3PAO. The pilots have run and the public rollout is underway.

Impact Levels and Control Baselines

The historical baselines remain the best way to understand the scale of effort, and still govern every system certified before the transition. Low impact covers publicly available data (approximately 125 controls). Moderate covers data where loss of confidentiality, integrity, or availability could have serious adverse effects — historically the most common baseline, covering roughly 80% of federal systems at approximately 325 controls. High covers data where loss could be severe or catastrophic, including law enforcement, emergency services, financial systems, and health data — approximately 421 controls. Rev5 aligned FedRAMP baselines with NIST SP 800-53 Rev5, adding supply chain risk management (SR family), privacy (PT family), and PII processing controls.

What changes under 20x: the control counts stop being the unit of work. KSI-based assessment asks you to demonstrate security properties through machine-readable evidence rather than narrate control implementation in a System Security Plan. For CISOs, that shifts the cost centre from compliance writing toward security engineering and automated evidence generation — budget accordingly, because the skill sets are not interchangeable.

Continuous Monitoring (ConMon)

Authorization is not the finish line — it is the starting gate. FedRAMP requires ongoing continuous monitoring that includes monthly vulnerability scanning with results submitted to the FedRAMP PMO, annual penetration testing, significant change requests (SCRs) for any architectural modifications, monthly POA&M updates, and annual security assessment of a subset of controls. The ConMon dashboard requirements are specific: you must provide near-real-time visibility into vulnerability status, inventory changes, and incident metrics. Tools like Devo, Splunk GovCloud, or the CISA-provided dashboards are common choices. Failure to maintain ConMon can result in revocation of your ATO — and GSA publishes revocations publicly.

The Cybersecurity Maturity Model Certification (CMMC) 2.0 is the DoD's mechanism for verifying that defense contractors actually implement the cybersecurity requirements they have been self-attesting to for years under DFARS 252.204-7012. The catalyst was straightforward: self-attestation was not working. Audit after audit revealed that contractors claiming compliance with NIST SP 800-171 had implemented a fraction of the required controls. CMMC 2.0 replaces trust with verification.

The Three Maturity Levels

CUI vs FCI: The Classification That Drives Everything

Federal Contract Information (FCI) is information provided by or generated for the government under contract that is not intended for public release. Controlled Unclassified Information (CUI) is a broader category established by Executive Order 13556 that includes information requiring safeguarding — technical data, export-controlled information, critical infrastructure data, and more. The distinction matters because it determines your CMMC level. A contractor who only handles FCI needs Level 1. A contractor handling CUI needs Level 2 or 3. The challenge is that many contractors do not accurately know what CUI they hold because the DoD's CUI marking program has been inconsistently implemented. If you are unsure, assume CUI and plan for Level 2.

POA&M and Enclave Strategies

CMMC 2.0 allows limited use of Plans of Action and Milestones (POA&Ms) for Level 2 assessments — you can have open POA&Ms for controls that are not fully implemented, but they must be closed within 180 days, and certain critical controls (like MFA, FIPS-validated encryption, and security awareness training) cannot be on a POA&M at all. The practical implication: if you fail a "non-POA&M-able" control during assessment, you fail the entire assessment.

For small and mid-size defense contractors, the most pragmatic approach is an enclave strategy: rather than securing your entire enterprise to CMMC Level 2, create a hardened enclave — a separate network segment, set of workstations, and storage — dedicated exclusively to CUI processing. This dramatically reduces your assessment scope. A 500-person company might have only 15 people who actually touch CUI; securing 15 workstations in a dedicated enclave is vastly more achievable than remediating an entire enterprise network. Cloud-based enclaves using Microsoft GCC High or AWS GovCloud are increasingly common and shift much of the infrastructure compliance burden to the CSP.

Classified information security operates in a fundamentally different paradigm from commercial cybersecurity. The controls are not risk-based trade-offs — they are absolute requirements backed by federal law (18 U.S.C. 793-798), executive orders, and intelligence community directives. Mishandling classified information is not a compliance finding; it is a federal crime. A CISO or Facility Security Officer (FSO) operating in classified environments must understand the legal framework, physical requirements, and operational constraints that define this space.

Classification Levels and Access

Access to classified information requires two conditions: an appropriate clearance level and a demonstrated need-to-know for the specific information. Having a TS clearance does not grant access to all TS information — it grants eligibility. The program manager or information owner must separately approve access to specific compartments or programs. This dual-gate model is foundational and frequently misunderstood by people coming from commercial IT backgrounds.

SCIF Requirements (ICD 705)

A Sensitive Compartmented Information Facility (SCIF) is a physically secured room or area accredited for processing, storing, and discussing SCI. Intelligence Community Directive (ICD) 705 defines the construction and accreditation standards. Requirements include: sound attenuation sufficient to prevent intelligible eavesdropping (STC rating of 45+ for walls, floors, ceilings), RF shielding or TEMPEST countermeasures to prevent electromagnetic emanations, intrusion detection systems (IDS) on all entry points, no windows or windows with opaque covering and RF shielding, access control via cipher locks or badge readers with two-person entry logs, and continuous visual inspection capability (CCTV). SCIF construction costs range from $150-$500 per square foot above standard construction costs. Accreditation involves inspection by the cognizant security authority (typically the agency's Special Security Officer).

Spillage and Insider Threat Controls

A spillage (or "spill") occurs when classified information is placed onto a system not accredited to handle that classification level — for example, a Secret document emailed over an unclassified network. Spillage response is immediate and prescribed: isolate the affected system, notify the security officer, preserve all evidence, and do not attempt to delete the classified material (deletion on an unclassified system does not meet sanitization standards). The affected system typically must be sanitized to NSA/CSS EPL standards or destroyed, depending on the classification level and media type. SSDs are particularly problematic because standard overwrite methods do not reliably sanitize flash storage — physical destruction is often required.

The National Industrial Security Program Operating Manual (NISPOM, 32 CFR Part 117) governs how cleared contractor facilities protect classified information. It mandates insider threat programs, security education, visitor control procedures, and the role of the Facility Security Officer (FSO). The FSO is the CISO-equivalent for classified environments — responsible for personnel security, physical security, information security, and security education. Two-person integrity (TPI) rules apply to certain activities: opening a SCIF, accessing certain cryptographic materials, and handling specific weapons-related information all require two cleared individuals present. No exceptions.

The National Insider Threat Task Force (NITTF), established by Executive Order 13587 following the WikiLeaks disclosures, mandates that all federal agencies and cleared contractor facilities operate formal insider threat programs. This is not a recommendation — it is a legal requirement codified in the NISPOM (32 CFR Part 117) and enforced by the Defense Counterintelligence and Security Agency (DCSA). An insider threat program that exists only on paper will fail its next DCSA assessment, and that failure can result in loss of your facility clearance — which means loss of every classified contract.

The Whole-Person Concept

Effective insider threat detection is built on the whole-person concept: no single indicator in isolation constitutes a threat. The program must aggregate and correlate information across multiple domains — cybersecurity indicators (unusual data access patterns, after-hours downloads, use of unauthorized storage devices), human resources data (performance issues, disciplinary actions, financial stress indicators), counterintelligence information (unreported foreign contacts, foreign travel anomalies), and security data (badge access patterns, SCIF access logs, security incident history). The correlation of these disparate data sources is what transforms noise into actionable intelligence.

User Activity Monitoring (UAM)

UAM is the technical backbone of insider threat detection. On classified networks, UAM is mandatory per Committee on National Security Systems (CNSS) Directive 504. At minimum, UAM must capture: keystrokes on classified systems, full-screen capture at regular intervals, all file operations (copy, move, delete, rename, print), all removable media insertions, all network file transfers, and application usage. Commercial UAM tools include Dtex (now part of Proofpoint), Securonix, ObserveIT (now Proofpoint ITM), and Everfox (formerly Forcepoint). The data volume is enormous — a 500-user classified network generating full UAM telemetry produces 2-5 TB per month. Storage, retention (typically 12 months minimum), and review workflows must be planned before deployment.

Legal and Privacy Constraints

UAM on government systems is legally grounded in the "authorized use" banner that all users must acknowledge at login — it explicitly states that activity is subject to monitoring. However, insider threat programs must still navigate legal constraints: attorney-client privileged communications may not be monitored (DoD policy), union-protected activities have specific exclusions, whistleblower protections under PPD-19 prohibit retaliation against employees reporting through authorized channels, and medical/mental health information obtained through monitoring has strict handling requirements under the Privacy Act. Your insider threat program must have legal counsel review before deployment, and the program's operating procedures must be reviewed annually.

Continuous Evaluation vs Periodic Reinvestigation

The legacy model of periodic reinvestigation (every 5 years for TS, every 10 for Secret) is being replaced by Continuous Evaluation (CE) and its successor, Trusted Workforce 2.0. CE performs automated checks against government databases (criminal records, financial records, foreign travel, public records) on an ongoing basis rather than waiting for the reinvestigation cycle. Trusted Workforce 2.0 consolidates the vetting process across the federal government, replacing the five-tier investigation system with three tiers and implementing ongoing vetting as the standard. The practical impact: derogatory information that previously would not surface until the next reinvestigation now triggers an alert within days. CISOs must ensure their insider threat programs can ingest and act on CE alerts in near-real-time.

The FBI's Criminal Justice Information Services (CJIS) Security Policy governs the security of criminal justice information (CJI) — a category that includes biometric data, identity history records, case/incident data, and anything derived from the National Crime Information Center (NCIC), the Interstate Identification Index (III), or the National Instant Criminal Background Check System (NICS). Every law enforcement agency, every prosecutor's office, every state motor vehicle department, and every private contractor with access to CJI must comply. The policy is not optional, and non-compliance results in disconnection from CJIS systems — which operationally shuts down a law enforcement agency.

Core Security Requirements

The CJIS Security Policy (currently version 5.9.4) is organized into 13 policy areas. The most technically demanding requirements are in encryption, authentication, and personnel security. Encryption must be FIPS 140-3 validated (not just "FIPS-compliant" — the module must appear on the NIST Cryptographic Module Validation Program list). Data in transit must be encrypted with a minimum of 128-bit AES or equivalent. Data at rest containing CJI must be encrypted with FIPS 140-3 validated modules or be physically secured to compensate. This creates real operational challenges: many legacy law enforcement systems predate these requirements and require upgrades or compensating controls.

Advanced Authentication for Law Enforcement

CJIS defines "advanced authentication" as authentication that requires at least two of three factors: something you know, something you have, something you are. The policy specifically requires advanced authentication for any access to CJI that occurs outside the physically secure perimeter — meaning an officer querying NCIC from a patrol vehicle's MDT must use MFA. This has been one of the most operationally challenging requirements to implement. Officers wearing tactical gloves cannot easily use fingerprint readers. Smartcards require readers in every vehicle. The practical solutions that have gained traction include: certificate-based authentication using CAC/PIV cards with vehicle-mounted readers, proximity-based authentication using paired devices (officer's phone + MDT), and biometric authentication using iris or facial recognition where conditions permit.

Mobile and Field Access Challenges

Law enforcement is inherently mobile, and the CJIS Security Policy must be applied to officers accessing CJI from patrol vehicles, body-worn cameras uploading footage containing CJI, mobile phones used for field identification, and temporary command posts during major incidents. Each scenario presents unique encryption and authentication challenges. Body-worn camera footage that captures a suspect's identity history or a license plate run result contains CJI — the entire chain from camera to cloud storage must be encrypted and access-controlled. Vendors like Axon (formerly TASER) and Motorola Solutions have built CJIS-compliant evidence management platforms, but the agency is still responsible for ensuring proper configuration, access controls, and personnel screening for everyone in the data chain.

In January 2017, the Department of Homeland Security designated election infrastructure as critical infrastructure under Presidential Policy Directive 21. This was a watershed moment: it formally recognized that election systems — voter registration databases, electronic poll books, vote casting and tabulation equipment, and election night reporting systems — are national security assets. For the CISOs and IT directors at the state and county level who actually operate these systems, this designation brought access to federal resources but also a spotlight on decades of underinvestment.

The Voting System Lifecycle

Voting systems in the United States are certified by the Election Assistance Commission (EAC) through Voting System Test Laboratories (VSTLs). The EAC's Voluntary Voting System Guidelines (VVSG) define security and reliability requirements. The 2.0 VVSG standards, adopted in 2021, added software independence requirements (the ability to detect errors without relying on the software being audited) and significantly enhanced cybersecurity testing. However, certification is voluntary at the federal level — states set their own certification requirements, and many still use systems certified under older VVSG 1.0 standards.

The practical reality: voting equipment has a 10-20 year lifecycle. Counties purchased systems after the Help America Vote Act (HAVA) of 2002 and many are still running them. These systems often run end-of-life operating systems (Windows 7, Windows XP Embedded), cannot be patched without decertification, and were designed before modern cyber threats were contemplated. Replacing them requires county or state appropriation — a political process that competes with roads, schools, and public safety for funding.

The County Resource Problem

There are over 3,000 counties in the United States, and elections are administered locally. Most county election offices have zero dedicated cybersecurity staff. The county IT department — often a team of 2-5 people supporting all county functions — is expected to secure election infrastructure alongside everything else. CISA has attempted to bridge this gap through programs including Albert sensors (IDS/IPS sensors deployed at no cost to election networks in all 50 states), free vulnerability scanning and penetration testing, election security tabletop exercises (conducted in every state since 2018), and the Elections Infrastructure Information Sharing and Analysis Center (EI-ISAC).

Zero Trust is not new as a concept — the term was coined by Forrester's John Kindervag in 2010. What is new is the federal government mandating its adoption. OMB Memorandum M-22-09, issued in January 2022, requires all federal agencies to meet specific Zero Trust security goals by the end of FY2024. This is not aspirational guidance — it is a directive from the Office of Management and Budget with measurable milestones and reporting requirements. For CISOs at federal agencies, this transformed Zero Trust from a conference buzzword into a program of record with budget implications and accountability.

CISA Zero Trust Maturity Model

CISA's Zero Trust Maturity Model defines five pillars — Identity, Devices, Networks, Applications and Workloads, and Data — each with four maturity levels: Traditional, Initial, Advanced, and Optimal. OMB M-22-09 sets specific targets within each pillar that agencies must achieve. The most impactful requirements include: enterprise-wide phishing-resistant MFA (FIDO2/WebAuthn or PIV-based), enterprise-wide EDR deployment on all agency endpoints, DNS traffic encryption (DoH or DoT), HTTP traffic encryption for all internal applications (not just external-facing), and data categorization and tagging for all high-value assets.

DoD Zero Trust Strategy

The Department of Defense released its Zero Trust Strategy in November 2022 with a target of achieving "Target Level" Zero Trust by FY2027. The DoD strategy defines 152 specific activities across seven pillars (the CISA five plus Visibility/Analytics and Automation/Orchestration). The DoD approach is more prescriptive than the civilian OMB mandate and includes specific technology requirements: Software Defined Networking (SDN) for microsegmentation, Security Orchestration and Automated Response (SOAR) for incident handling, and User and Entity Behavior Analytics (UEBA) for anomaly detection. The Thunderdome project, managed by DISA, is the DoD's enterprise-level Zero Trust implementation using Secure Access Service Edge (SASE) architecture from Zscaler.

Practical Implementation Roadmap

For agencies starting their Zero Trust journey, the recommended sequencing is: Phase 1 (0-6 months) — deploy phishing-resistant MFA for all privileged users, implement centralized identity governance, and deploy EDR enterprise-wide. These deliver the highest risk reduction per dollar. Phase 2 (6-18 months) — encrypt all DNS and internal HTTP traffic, begin data categorization for high-value assets, implement microsegmentation for the most sensitive enclaves. Phase 3 (18-36 months) — achieve continuous device health assessment, deploy automated DLP policies, implement SOAR for security operations, and expand microsegmentation enterprise-wide.

The budget reality is that most agencies are funding Zero Trust through existing cybersecurity budgets plus Technology Modernization Fund (TMF) grants and CISA-provided services. The TMF has allocated over $500M since 2021, with significant portions directed toward Zero Trust implementations. CISOs should align their Zero Trust roadmap with the agency's IT modernization strategy — many Zero Trust requirements (cloud migration, application modernization, identity consolidation) overlap with broader modernization objectives, enabling shared funding justifications through the Capital Planning and Investment Control (CPIC) process.

The US government's role in critical infrastructure protection is uniquely dual: it is simultaneously the largest operator of critical infrastructure (defense installations, federal buildings, power grids on military bases, government data centers) and the principal regulator and coordinator of critical infrastructure security across 16 designated sectors. This dual role creates inherent tensions — the government must lead by example while also setting requirements for private sector operators who control approximately 85% of the nation's critical infrastructure.

The Regulatory Framework

Presidential Policy Directive 21 (PPD-21), issued in 2013, designates 16 critical infrastructure sectors and assigns a Sector Risk Management Agency (SRMA, formerly Sector-Specific Agency) to each. CISA serves as the national coordinator and is the SRMA for eight sectors. The framework is deliberately collaborative rather than purely regulatory — the government recognizes that it cannot secure critical infrastructure through mandates alone because it does not own or operate most of it. This collaborative model operates through Information Sharing and Analysis Centers (ISACs) and Information Sharing and Analysis Organizations (ISAOs).

NIST CSF 2.0 for Government

NIST released the Cybersecurity Framework (CSF) 2.0 in February 2024, adding a sixth function — Govern — to the existing Identify, Protect, Detect, Respond, Recover structure. The Govern function addresses cybersecurity risk management strategy, expectations, and policy at the organizational level. For government agencies, CSF 2.0 is not directly mandatory (FISMA and NIST SP 800-53 remain the compliance baseline), but it serves as the communication framework between government and private sector operators. When CISA issues guidance to critical infrastructure operators, it is mapped to CSF. When agencies assess sector-wide risk, they use CSF tiers. CISOs at government agencies that also serve as SRMAs must be fluent in both CSF 2.0 (for sector coordination) and SP 800-53 (for internal compliance).

Federal, State, Local Coordination

Critical infrastructure incidents rarely respect jurisdictional boundaries. A cyberattack on a water utility affects the county, the state environmental agency, the EPA, CISA, and potentially the FBI if it involves a nation-state actor. The coordination model works through several mechanisms: the National Cyber Incident Response Plan (NCIRP) defines roles for federal agencies during significant cyber incidents, Multi-State Information Sharing and Analysis Center (MS-ISAC) serves as the primary interface between CISA and state/local/tribal/territorial governments, Joint Cyber Defense Collaborative (JCDC) brings together government and private sector for operational coordination, and Cyber Unified Coordination Groups (UCGs) are activated for significant incidents (as was done for SolarWinds and Log4Shell).

The practical challenge is that state and local government cybersecurity capabilities vary enormously. Some states (Virginia, Texas, California) have mature cybersecurity operations with dedicated CISOs and SOCs. Others have minimal staffing and rely almost entirely on CISA-provided services. The SLCGP (State and Local Cybersecurity Grant Program), funded at $1 billion over four years through the Infrastructure Investment and Jobs Act, is the first dedicated federal funding for state and local cybersecurity. Eligible uses include governance planning, risk assessments, cybersecurity workforce development, and implementation of the NIST CSF. However, $1 billion divided across 56 states and territories over four years averages $4.5M per state per year — a start, but far below the level of investment needed to close the capability gap.