LoginFedRAMP is getting faster, new automation and pilots promise approvals in months, not years
Interview transcript
Terry Gerton Weโre going to talk about one of everybodyโs favorite topics, FedRAMP. Itโs been around for years, but agencies are still struggling to get modern tools. So from your perspective, why is the process so hard for software and service companies to get through?
Irina Denisenkoย Itโs a great question. Why is it so hard to get through FedRAMP? It is so hard to get through FedRAMP because at the end of the day, what is FedRAMP really here to do? Itโs here to secure cloud software, to secure government data sitting in cloud software. You have to remember this all came together almost 15 years ago, which if you remember 15 years ago, 20 years ago, was kind of early days of all of us interacting with the internet. And we were still even, in some cases, scared to enter our credit card details onto an online website. Fast forward to today, we pay with our face when we get on our phone. Weโve come a long way. But the reality is cloud security hasnโt always been the, of course, itโs secure. In fact, it has been the opposite. Of course, its unsecure and itโs the internet and thatโs where you go to lose all your data and all your information. And so long story short, you have to understand thatโs were the government is coming from. We need to lock everything down in order to make sure that whether itโs VA patient data, IRS data on our taxpayers, obviously anything in the DoW, any sort of information data there, all of that stays secure. And so thatโs why there are hundreds of controls that are applied to cloud environments in order make sure and double sure and triple sure that that data is secure.
Terry Gerton You lived the challenge first-hand with your own company. What most surprised you about the certification process when you tackled it yourself? What most surprise me?
Irina Denisenkoย When we tackled FedRAMP ourselves for the first time was that even if you have the resources and specifically if you $3 million to spend, you know, $3 million burning a hole in your pocket doesnโt happen often, but even if have that and you have staff on the U.S. Soil and you have the willingness to invest all of that for a three-year process to get certified, that is still not enough. What you need on top of that is an agency to say yes to sponsoring you. And when they say yes, to sponsoring you what they are saying yes to you is to take on your cyber risk. And specifically what theyโre saying yes to is to spend half a million dollars of taxpayer money of agency budget, typically using contractors, to do an initial security review of your application. And then to basically get married to you and do something called continuous monitoring, which is a monthly meeting that theyโre going to have with you forever. They, that agency is going to be your accountability partner and ultimately the risk bearer of you, the software provider, to make sure you are burning down all of the vulnerabilities, all of these CVEs, every finding in your cloud environment on the timeline that youโre supposed to do that. And that ends up costing an agency about $250,000 a year, again, in the form of contractors, tooling, etc. That was the most surprising to me, that again, even as a cloud service provider, whoโs already doing business with JP Morgan and Chase, you know, healthcare systems, you name it, even thatโs not enough, you need an agency sponsor, because at the end of the day, itโs the agencyโs data and they have to protect it. And so they have do that triple assurance of, yes, you said youโre doing the security stuff, but let us confirm that youโre doing the the security stuff. That was the most surprising to me. And why, really, ultimately, we started Knox Systems, because what we do at Knox is we enable the inheritance model. So we are doing all of that with our sponsoring agencies, of which we have 15. Knox runs the largest FedRAMP managed cloud. And what that means is we host the production environment of our customers inside of our FedRAMP environment across AWS, Azure, and GCP. And our customers inherit our sponsors. So they inherit the authorization from the treasury, from the VA, from the Marines, etc., Which means that the Marines, the Treasury, the VA, didnโt have to spend an extra half a million upfront and $250k ongoing with every new application that was authorized. They are able to get huge bang for their buck by just investing that authorization, that sponsorship into the Knox boundary. And then Knox does the work and the hard work to ensure the security and ongoing authorization and compliance of all of the applications that we bring into our environment.
Terry Gerton Iโm speaking with Irina Denisenko. Sheโs the CEO of Knox Systems. So it sounds like you found a way through the maze that was shorter, simpler, less expensive. Is FedRAMP 20X helping to normalize that kind of approach? How do you see it playing out?
Irina Denisenkoย Great question. FedRAMP 20X is a phenomenal initiative coming out of OMB-GSA. And really the crux of that is all about machine-readable and continuous authorization. Today, when I talked about continuous monitoring, thatโs a monthly meeting that happens. And I kid you not, we, as a cloud service provider, again, we secure Adobeโs environment and many others, we come with a spreadsheet, an actual spreadsheet that has all of the vulnerabilities listed from all the scans weโve done over the last month, and anything that is still open from anything prior months. And we review that spreadsheet, that actual Excel document, and then after the meet with our agencies and then, after that meeting, we upload that spreadsheet into a system called USDA on the FedCiv side, eMass, DOW side, DISA side. And then they, on their side, download that spreadsheet and they put it into other systems. And I mean, thatโs the process. I think no one is confused, or no one would argue that surely thereโs a better way. And a better would be a machine readable way, whether thatโs over an API, using a standard language like OSCAL. Thereโs lots of ways to standardize, but it doesnโt have to be basically the equivalent of a clipboard and a pencil. And thatโs what FedRAMP 20X is doing. Itโs automating that information flow so that not only is it bringing down the amount of just human labor that needs to be done to do all this tracking, but more importantly, this is cloud security. Just because youโre secure one second doesnโt mean youโre secure five seconds from now, right? You need to be actively monitoring this, actively reporting this. And if itโs taking you 30 days to let an agency know that you have a critical vulnerability, thatโs crazy. You, you got to tell them in, you know, five minutes after you find out or, you know to put a respectable buffer, a responsible buffer to allow you to mitigate remediate before you notify more parties, maybe itโs a four day buffer but itโs certainly not 30 days. Thatโs what FedRAMP20X is doing. Weโre super excited about it. We are very supportive of it and have been actively involved in phase I and all subsequent phases.
Terry Gerton Right, so phase II is scheduled to start shortly in 2026. What are you expecting to see as a result?
Irina Denisenkoย Well, phase I was all about FedRAMP low, phase II is all about FedRAMP moderate. And we expect that, you know, itโs going to really โ FedRAMP moderate is realistically where most cloud service offerings sit, FedRAMP moderate and high. And so thatโs really the one that the FedRAMP needs to get right. What we expect to see and hope to see is to have agencies actually authorized off of these new frameworks. The key is really going to be what shape does FedRAMP 20x take in terms of machine readable reporting on the security posture of any cloud environment? And then of course, the industry will standardize around that. So weโre excited to see what that looks like. And also how much AI does the agency, the GSA, OMB and ultimately FedRAMP leverage because there is a tremendous amount of productivity, but also security that AI can provide. It can also introduce a lot of risks. And so weโre all collaborating with that agency, as well as weโre excited to see what, you know, where they draw the bright red lines and where they embrace AI.
Terry Gerton So phase II is only gonna incorporate 10 companies, right? So for the rest of the world whoโs waiting on these results, what advice do you have for them in the meantime? How can companies prepare better or how can companies who want to get FedRAMP certified now best proceed?
Irina Denisenkoย I think the end of the day the inheritance model that Knox provides โ and, you know, weโre not the only ones, actually thereโs two key players.; itโs ourselves and Palantir. Thereโs a reason hat large companies like Celonis like OutSystems like BigID like Armis who was just bought by ServiceNow for almost $8 billion. Thereโs reason that all those guys choose Knox and thereโs a reason Anthropic chose Palantir and Grafana chose Palantir, because regardless, FedRAMP 20X, Rev 5, doesnโt matter, there is a massive, massive premium put on getting innovative technology in the hands of our government faster. We have a window right now with the current administration prioritizing innovative technology and commercial off-the-shelf. You know, take the best out of Silicon Valley and use it in the government or out of Europe, out of Israel, you name it, rather than build it yourself, customize it until youโre blue in the face and still get an inferior product. Just use the best and breed, right? But you need it to be secure. And we have this window as a country. We have a window as country for the next few years here to get these technologies in. It takes a while to adopt new technologies. It takes awhile to do a quantum leap, but Iโll give you a perfect example. Celonis, since becoming FedRAMPed on August 19th with Knox โ they had been trying to get FedRAMPed for five years โ since getting FedRAMPed on august 19th, has implemented three agencies. And what do they do? They do process mining and intelligence. Theyโre an $800 million company thatโs 20 years old that competes, by the way, head on with Palantirโs core product, Foundry and Gotham and so on. Theyโve implemented three agencies already to drive efficiency, to drive visibility, to drive process mining, to driving intelligence, to drive AI-powered decision-making. And thatโs during the holidays, during a government shutdown, itโs speed that weโve never seen before. If you want outcomes, you need to get these technologies into the hands of our agencies today. And so thatโs why, you know, weโre such big proponents of this model, and also why, our agencies, our federal advisory board, which includes the DHS CISO, the DOW CIO, the VA CIO are also supportive of this because ultimately itโs about serving the mission and doing it now. Rather than waiting for some time in the future.
The post FedRAMP is getting faster, new automation and pilots promise approvals in months, not years first appeared on Federal News Network.
ยฉ Getty Images/iStockphoto/Kalawin
