fedramp-compliance

Name: fedramp-compliance
Author: BagelHole

42stars4forks

How to install fedramp-compliance?

bagelhole/devops-security-agent-skills/fedramp-compliance

$npx -y skills add BagelHole/DevOps-Security-Agent-Skills --skill fedramp-compliance

Installs into the current project.

Summary

Implement FedRAMP requirements for federal cloud services. Configure NIST 800-53 controls and continuous monitoring. Use when providing cloud services to US federal agencies.

Files · 1

View on GitHub

SKILL.md

1	# FedRAMP Compliance
2
3	Implement FedRAMP (Federal Risk and Authorization Management Program) requirements for cloud service providers serving US federal agencies.
4
5	## When to Use
6
7	- Pursuing FedRAMP authorization for a cloud service offering
8	- Implementing NIST 800-53 security controls for federal workloads
9	- Establishing continuous monitoring (ConMon) processes
10	- Managing Plan of Action and Milestones (POA&M) tracking
11	- Preparing for a Third-Party Assessment Organization (3PAO) audit
12	- Operating a FedRAMP-authorized system and maintaining authorization
13
14	## Impact Levels
15
16	```yaml
17	impact_levels:
18	low:
19	control_count: ~125
20	use_case: "Publicly available federal information"
21	examples:
22	- Public-facing websites with no sensitive data
23	- Open data portals
24	- Marketing and informational systems
25	data_types: "No PII, no CUI, publicly releasable only"
26	authorization_path: "FedRAMP Tailored (Li-SaaS) or standard Low"
27
28	moderate:
29	control_count: ~325
30	use_case: "Most federal systems, including CUI"
31	examples:
32	- Email and collaboration platforms
33	- Case management systems
34	- Financial management systems
35	- HR and personnel systems
36	data_types: "CUI, PII, law enforcement sensitive (LES)"
37	authorization_path: "Agency or JAB P-ATO"
38	note: "~80% of FedRAMP authorizations are at Moderate"
39
40	high:
41	control_count: ~425
42	use_case: "High-impact federal systems"
43	examples:
44	- Law enforcement and criminal justice systems
45	- Emergency services and public safety
46	- Financial systems with significant impact
47	- Healthcare systems with PHI
48	data_types: "Classified-adjacent, life-safety, critical infrastructure"
49	authorization_path: "JAB P-ATO required"
50	```
51
52	## NIST 800-53 Control Families
53
54	```yaml
55	control_families:
56	AC:
57	name: "Access Control"
58	key_controls:
59	AC-2: "Account Management - manage system accounts lifecycle"
60	AC-3: "Access Enforcement - enforce approved authorizations"
61	AC-6: "Least Privilege - employ principle of least privilege"
62	AC-17: "Remote Access - establish usage restrictions for remote access"
63	implementation_notes: "Map to IAM policies, RBAC, MFA enforcement"
64
65	AU:
66	name: "Audit and Accountability"
67	key_controls:
68	AU-2: "Audit Events - define auditable events"
69	AU-3: "Content of Audit Records - ensure records contain required info"
70	AU-6: "Audit Review, Analysis, and Reporting"
71	AU-12: "Audit Generation - generate audit records"
72	implementation_notes: "Map to CloudTrail, CloudWatch Logs, SIEM"
73
74	AT:
75	name: "Awareness and Training"
76	key_controls:
77	AT-2: "Security Awareness Training - provide training to users"
78	AT-3: "Role-Based Security Training - for personnel with security roles"
79	implementation_notes: "Annual security training, role-specific training"
80
81	CM:
82	name: "Configuration Management"
83	key_controls:
84	CM-2: "Baseline Configuration - develop and maintain baseline"
85	CM-6: "Configuration Settings - establish mandatory settings"
86	CM-7: "Least Functionality - restrict to essential capabilities"
87	CM-8: "Information System Component Inventory"
88	implementation_notes: "Map to AWS Config, SSM, hardened AMIs"
89
90	CP:
91	name: "Contingency Planning"
92	key_controls:
93	CP-2: "Contingency Plan - develop and maintain plan"
94	CP-4: "Contingency Plan Testing - test plan annually"
95	CP-9: "Information System Backup"
96	CP-10: "Information System Recovery and Reconstitution"
97	implementation_notes: "Map to DR plan, backup strategy, failover testing"
98
99	IA:
100	name: "Identification and Authentication"
101	key_controls:
102	IA-2: "Identification and Authentication (Org Users)"
103	IA-5: "Authenticator Management"
104	IA-8: "Identification and Authentication (Non-Org Users)"
105	implementation_notes: "Map to SSO, MFA, certificate-based auth, PIV/CAC"
106
107	IR:
108	name: "Incident Response"
109	key_controls:
110	IR-2: "Incident Response Training"
111	IR-4: "Incident Handling - implement incident handling capability"
112	IR-6: "Incident Reporting - report incidents to US-CERT"
113	IR-8: "Incident Response Plan"
114	implementation_notes: "US-CERT reporting within 1 hour for federal incidents"
115
116	MA:
117	name: "Maintenance"
118	key_controls:
119	MA-2: "Controlled Maintenance"
120	MA-4: "Nonlocal Maintenance - authorize nonlocal maintenance"
121	implementation_notes: "Patching procedures, remote maintenance controls"
122
123	MP:
124	name: "Media Protection"
125	key_controls:
126	MP-2: "Media Access - restrict access to media"
127	MP-6: "Media Sanitization - sanitize media prior to disposal"
128	implementa

People who liked this also viewed

6 picks

Type

fedramp-compliance

42stars4forks

View on GitHub

How to install fedramp-compliance?

bagelhole/devops-security-agent-skills/fedramp-compliance

$npx -y skills add BagelHole/DevOps-Security-Agent-Skills --skill fedramp-compliance

Installs into the current project.

Summary

Implement FedRAMP requirements for federal cloud services. Configure NIST 800-53 controls and continuous monitoring. Use when providing cloud services to US federal agencies.

Files · 1

View on GitHub

SKILL.md

1	# FedRAMP Compliance
2
3	Implement FedRAMP (Federal Risk and Authorization Management Program) requirements for cloud service providers serving US federal agencies.
4
5	## When to Use
6
7	- Pursuing FedRAMP authorization for a cloud service offering
8	- Implementing NIST 800-53 security controls for federal workloads
9	- Establishing continuous monitoring (ConMon) processes
10	- Managing Plan of Action and Milestones (POA&M) tracking
11	- Preparing for a Third-Party Assessment Organization (3PAO) audit
12	- Operating a FedRAMP-authorized system and maintaining authorization
13
14	## Impact Levels
15
16	```yaml
17	impact_levels:
18	low:
19	control_count: ~125
20	use_case: "Publicly available federal information"
21	examples:
22	- Public-facing websites with no sensitive data
23	- Open data portals
24	- Marketing and informational systems
25	data_types: "No PII, no CUI, publicly releasable only"
26	authorization_path: "FedRAMP Tailored (Li-SaaS) or standard Low"
27
28	moderate:
29	control_count: ~325
30	use_case: "Most federal systems, including CUI"
31	examples:
32	- Email and collaboration platforms
33	- Case management systems
34	- Financial management systems
35	- HR and personnel systems
36	data_types: "CUI, PII, law enforcement sensitive (LES)"
37	authorization_path: "Agency or JAB P-ATO"
38	note: "~80% of FedRAMP authorizations are at Moderate"
39
40	high:
41	control_count: ~425
42	use_case: "High-impact federal systems"
43	examples:
44	- Law enforcement and criminal justice systems
45	- Emergency services and public safety
46	- Financial systems with significant impact
47	- Healthcare systems with PHI
48	data_types: "Classified-adjacent, life-safety, critical infrastructure"
49	authorization_path: "JAB P-ATO required"
50	```
51
52	## NIST 800-53 Control Families
53
54	```yaml
55	control_families:
56	AC:
57	name: "Access Control"
58	key_controls:
59	AC-2: "Account Management - manage system accounts lifecycle"
60	AC-3: "Access Enforcement - enforce approved authorizations"
61	AC-6: "Least Privilege - employ principle of least privilege"
62	AC-17: "Remote Access - establish usage restrictions for remote access"
63	implementation_notes: "Map to IAM policies, RBAC, MFA enforcement"
64
65	AU:
66	name: "Audit and Accountability"
67	key_controls:
68	AU-2: "Audit Events - define auditable events"
69	AU-3: "Content of Audit Records - ensure records contain required info"
70	AU-6: "Audit Review, Analysis, and Reporting"
71	AU-12: "Audit Generation - generate audit records"
72	implementation_notes: "Map to CloudTrail, CloudWatch Logs, SIEM"
73
74	AT:
75	name: "Awareness and Training"
76	key_controls:
77	AT-2: "Security Awareness Training - provide training to users"
78	AT-3: "Role-Based Security Training - for personnel with security roles"
79	implementation_notes: "Annual security training, role-specific training"
80
81	CM:
82	name: "Configuration Management"
83	key_controls:
84	CM-2: "Baseline Configuration - develop and maintain baseline"
85	CM-6: "Configuration Settings - establish mandatory settings"
86	CM-7: "Least Functionality - restrict to essential capabilities"
87	CM-8: "Information System Component Inventory"
88	implementation_notes: "Map to AWS Config, SSM, hardened AMIs"
89
90	CP:
91	name: "Contingency Planning"
92	key_controls:
93	CP-2: "Contingency Plan - develop and maintain plan"
94	CP-4: "Contingency Plan Testing - test plan annually"
95	CP-9: "Information System Backup"
96	CP-10: "Information System Recovery and Reconstitution"
97	implementation_notes: "Map to DR plan, backup strategy, failover testing"
98
99	IA:
100	name: "Identification and Authentication"
101	key_controls:
102	IA-2: "Identification and Authentication (Org Users)"
103	IA-5: "Authenticator Management"
104	IA-8: "Identification and Authentication (Non-Org Users)"
105	implementation_notes: "Map to SSO, MFA, certificate-based auth, PIV/CAC"
106
107	IR:
108	name: "Incident Response"
109	key_controls:
110	IR-2: "Incident Response Training"
111	IR-4: "Incident Handling - implement incident handling capability"
112	IR-6: "Incident Reporting - report incidents to US-CERT"
113	IR-8: "Incident Response Plan"
114	implementation_notes: "US-CERT reporting within 1 hour for federal incidents"
115
116	MA:
117	name: "Maintenance"
118	key_controls:
119	MA-2: "Controlled Maintenance"
120	MA-4: "Nonlocal Maintenance - authorize nonlocal maintenance"
121	implementation_notes: "Patching procedures, remote maintenance controls"
122
123	MP:
124	name: "Media Protection"
125	key_controls:
126	MP-2: "Media Access - restrict access to media"
127	MP-6: "Media Sanitization - sanitize media prior to disposal"
128	implementa

People who liked this also viewed

6 picks

Type