Understanding FedRAMP in Microsoft: What You Need to Know

For many businesses, cybersecurity has become a rising concern over the past several years. Not only do cyberattacks continue to increase across industries, hackers are often able to access higher quantities of data or cause greater damages to their targets. Choosing the right platforms, including cloud services, is essential. The Cloud First Policy, instituted in 2011, requires government agencies to focus on cloud storage and services for many of their services, which means that government agencies and contractors alike had to make a fast shift to the cloud to meet those requirements. Even today, government agencies must follow those requirements while still maintaining a high level of security.

That’s where FedRAMP comes in. The US Federal Risk and Authorization Management Program, also known as FedRAMP, is a government-mandated standard that assesses cloud products and services. It sets clear standards for handling government data to ensure a higher overall level of security and compliance. Many Microsoft products, including Office 365 and Azure, can be utilized in these FedRAMP environments.

FedRAMP Standards: The Essentials

Before the creation of FedRAMP in 2011, federal agencies had to independently evaluate which cloud service providers (CSP) to use on their own based on Federal Information Security Management Act of 2002 (FISMA) standards. This approach often resulted in duplicate efforts and inconsistent security requirements. That is where the Cloud First Policy came in and required government agencies to move to the cloud quickly and effectively—and led to the creation of FedRAMP, which helps agencies more effectively choose secure cloud environments. This policy created a surge in demand for secure, compliant cloud services and opened the door for commercial CSPs like Microsoft, AWS, and Google to serve government clients.

However, because federal agencies handle sensitive, controlled, and sometimes classified data, simply using a commercial cloud wasn’t enough and those CSPs had to meet federal security standards.

To show FedRAMP compliance, Cloud Service Providers must either earn a Provisional Authority to Operate (P-ATO) from the Joint Authorization Board or receive an Authority to Operate from a sponsoring federal agency. Each path to compliance requires a detailed technical review and assessment from a third party who can fully evaluate the security controls of those cloud solutions and ensure that they will meet compliance requirements.

Microsoft’s FedRAMP-Compliant Solutions

Microsoft offers three FedRAMP-compliant options, each of which is designed specifically for government use. Government organizations should make sure that they are using the government versions of those platforms, since the standard versions may not meet FedRAMP compliance standards.

Azure Government

Azure Government is FedRAMP, NIST SP 800-171 (DIB), ITAR, IRS 1075, DoD L5, and CJIS compliant, with physical servers located in the United States for a greater overall degree of security. Azure Government is a tailored cloud environment specifically for the United States government and its contractors. It is used by federal agencies, DoD contractors, the intelligence community, and even state and local governments. Azure offers:

• Advanced analytics capabilities for data analysis such as Power BI and Azure Synapse Analytics
• Cloud services, including Infrastructure as a Service (IaaS), Platform as a Service (PaaS), and Software as a Service (SaaS)
• A marketplace of cloud-based tools tailored for government use

Take a look at What is Azure Government? for more information about Azure Government and its available solutions.

Microsoft 365 Government

Microsoft 365, previously Office 365, delivers familiar productivity tools that millions rely on daily, including word processing (Word), spreadsheets (Excel), presentations (PowerPoint), secure collaboration (Teams), and email (Outlook).

For government agencies and contractors Microsoft 365 Government provides the same tools in FedRAMP-authorized standards. This means that users can easily access the same tools and platforms they’re used to using in other environments, with the added security standards they need to use them effectively for government communications and data. Depending on the tenant, GCC (Moderate) GCC High (High), or DoD (IL 5), Microsoft 365 Government ensures compliance with the standards required to handle sensitive government information.

Microsoft 365 GCC High

For DoD contractors and agencies, Microsoft 365 Government may not be adequate to meet essential security standards. That’s where Microsoft 365 GCC High comes in. In addition to meeting the same standards required for FedRAMP, it meets:

• ITAR standards
• Cybersecurity Maturity Model Certification (CMMC) compliance standards
• DFARS 7012 requirements

In addition, all customer data is stored in the United States, and only US personnel can access it. DoD subscribers are given DOD SRG L5 environments, while non-DoD subscribers, including contractors who use those services, will receive a DoD SRG L5 environment segmented in DoD SRG L4. These increased security standards do mean that Microsoft 365 GCC High subscribers may not have access to all Microsoft apps and features, including Yammer Enterprise and PSTN calling and conferencing via Skype.

GCC High is typically offered to individuals with over 500 seats in Microsoft 365. However, Agile IT is one of the original 6 providers authorized to sell this platform to organizations with fewer seats, so start your Microsoft Government Validation as soon as possible if you need this level of security.

Choosing FedRAMP Solutions

Utilizing cloud services as a government agency or contractor means adhering to FedRAMP standards. FedRAMP compliance, while complicated, lets agencies and providers know that they can use a specific cloud environment or solution for their government assets—and that their cloud solution will provide the high level of security they need. Fortunately, Microsoft offers a variety of tools that are FedRAMP compliant, allowing users to easily select a solution that fits their needs.

Whether you are looking for a basic government solution, including Azure Government, Microsoft 365 Government, or you need a DoD-compliant solution like Microsoft 365 GCC High, Agile IT is here to help. As one of the original six Microsoft AOS-G partners around the world, we have the experience to help contractors make the GCC High migration or provide the managed services needed to use that solution effectively.

Request a quote today for a partnership that can help you manage your government cloud needs.