Questions tagged [fedramp]

The Federal Risk and Authorization Management Program (FedRAMP) is a US government program for standardized security assessment.

Filter by
Sorted by
Tagged with
1
vote
1answer
52 views

Do I need to keep production Docker/container images?

Context My company is developing a SaaS solution that needs to conform to PCI-DSS L1 for sure, and possibly FedRAMP and other frameworks later. We can do continuous deployment with feature flagged/...
1
vote
1answer
50 views

AWS Private CM and FedRamp compliance for TLS

Is the use of a private, auto-signed certificate, created and managed by AWS Private CM, and use in internal TLS communication, for endpoints that do not require external verification, and do not have ...
0
votes
0answers
57 views

FedRamp Moderate question about hashing MD5

If I use MD5 but not for cryptography purposes, and not for any authentication or authorization mechanism, Am I in violation of FedRamp Moderate? BR
2
votes
1answer
83 views

What are the FEDRAMP “complementary controls”?

Quoting the FedRAMP official FAQ: FedRAMP requirements include additional controls above the standard NIST baseline controls in NIST SP 800-53 Revision 4. These additional controls address the ...