ADR 0070 — FedRAMP Moderate ATO Specific Plan (Wave-5 D3)¶
| Status | Date | Author | Supersedes | Superseded by |
|---|---|---|---|---|
| Accepted | 2026-05-16 | André Luiz Gallon | — | — |
Context¶
ADR 0069 D3 establishes FedRAMP Moderate ATO as a Wave-5 deliverable. This ADR formalizes the 12-18 month sponsored process plan, control catalog mapping, and infrastructure changes required.
Architectural decision¶
10 LOCKED decisions.
D1: Authorization path = sponsored Joint Authorization Board (JAB) OR Agency¶
Two FedRAMP authorization paths:
- JAB P-ATO (Joint Authorization Board Provisional ATO): cross-agency acceptance; harder to obtain; ~18 month process
- Agency ATO: single agency sponsor; ~12 month process; agency-specific
Default: Agency ATO with first sponsor (typically DoD, DHS, or GSA). JAB upgrade pursued post-Agency ATO if customer demand materializes.
D2: Service offering = SaaS, NOT IaaS/PaaS¶
FedRAMP scope = TLSStress.Art SaaS product. Cloud providers (AWS/Azure/GCP) are leveraged-CSPs (already FedRAMP-authorized). We inherit their authorizations + add our SaaS layer's controls.
This dramatically reduces our control burden: - Cloud infra controls (AC-2, AC-3, SC-12, etc.) → inherited from AWS GovCloud / Azure Government / GCP Assured Workloads - TLSStress.Art-specific controls → our responsibility
D3: Deployment isolation = US Government cloud regions only¶
FedRAMP Moderate data MUST stay in US-jurisdiction:
- AWS GovCloud (US) — us-gov-west-1 + us-gov-east-1
- Azure Government — usgovvirginia + usgovtexas + usgovarizona
- GCP Assured Workloads — us-east1 + us-east4 (with Assured Workloads boundary)
Separate cells (per ADR 0053 cell architecture):
- gov-us-east-1-a etc. — only US Persons admin access
- Air-gapped from commercial cells (no cross-cell network paths)
D4: Control baseline = NIST 800-53 Rev 5 Moderate¶
325 controls from NIST 800-53 Rev 5 Moderate baseline:
- AC (Access Control) — 25 controls
- AT (Awareness and Training) — 5 controls
- AU (Audit and Accountability) — 16 controls
- CA (Assessment, Authorization, and Monitoring) — 9 controls
- CM (Configuration Management) — 11 controls
- CP (Contingency Planning) — 13 controls
- IA (Identification and Authentication) — 12 controls
- IR (Incident Response) — 10 controls
- MA (Maintenance) — 6 controls
- MP (Media Protection) — 8 controls
- PE (Physical and Environmental Protection) — 20 controls
- PL (Planning) — 11 controls
- PS (Personnel Security) — 9 controls
- RA (Risk Assessment) — 10 controls
- SA (System and Services Acquisition) — 22 controls
- SC (System and Communications Protection) — 45 controls
- SI (System and Information Integrity) — 23 controls
- SR (Supply Chain Risk Management) — 12 controls
Inheritance from leveraged-CSPs: ~40% of controls fully inherited; ~30% partially inherited (we extend); ~30% fully our responsibility.
D5: 3PAO selection¶
Third Party Assessment Organization: FedRAMP-accredited auditor performing the formal Security Assessment.
Shortlist (criteria: experience with SaaS+multi-cloud, TLS/cryptography expertise, federal customer references):
- Coalfire Federal
- Schellman
- Kratos SecureInfo
- A-LIGN Federal
Selected post Wave-5 D3 trigger. RFP comparison in PR-W5-2.1.
D6: System Security Plan (SSP) — single source of truth¶
Single 800-page SSP document covering: - System architecture (multi-cloud cell topology) - All 325 control implementation statements - Inheritance from leveraged-CSPs - Implementation evidence per control - POA&M (Plan of Action & Milestones) for partial implementations
Maintained in pkg/octopus/compliance/ssp/ as markdown chapters.
Auto-generated PDF for auditor delivery.
D7: Continuous monitoring = monthly vulnerability scans + annual reassessment¶
Per FedRAMP continuous monitoring requirements:
- Monthly: vulnerability scans (Tenable Nessus or Qualys VMDR); POA&M updates; access reviews
- Quarterly: configuration audits; user activity reviews
- Annually: full SSP review; penetration test; 3PAO reassessment
Tooling: Drata/Vanta (ADR 0069 D1) extended with FedRAMP-specific control mappings + monthly evidence packages.
D8: Personnel security¶
FedRAMP-Authorized people are a closed list:
- All TLSStress.Art employees with access to US Government cells MUST be US Persons (US citizens or Permanent Residents)
- Background checks: Tier 2 (NACI) minimum; Tier 5 (SSBI) for elevated access
- Annual security awareness training (FedRAMP-specific module)
- Personnel screening costs ~$5k/person/year
D9: Incident response¶
FedRAMP incident response requirements:
- Notify FedRAMP PMO within 1 hour of incident discovery
- Final incident report within 30 days
- Categorize per US-CERT taxonomy (HIGH/MEDIUM/LOW)
- All RCA + remediation tracked in POA&M
Wave-4 incident response runbook (wave4-incident-response.md)
extended with FedRAMP-specific phases in PR-W5-2.2.
D10: Annual cost¶
| Item | Year 1 | Annual ongoing |
|---|---|---|
| 3PAO Security Assessment | $200k-400k | $80k-150k (annual reassessment) |
| Continuous monitoring tools | $30k | $30k |
| FedRAMP PMO interaction | (sponsor-funded) | $20k |
| US Persons hiring premium | $50k (3-5 hires) | $50k |
| Personnel screening | $20k | $20k |
| Specialized US-Gov cloud spend premium (~20% over commercial) | $30k | $30k |
| Continuous monitoring vulnerability scanning | $15k | $15k |
| Total | $345k-545k | $245k-315k |
Timeline (12-18 month process)¶
Month 1-2: Sponsor agency engagement + LOI signed
Month 2-3: 3PAO selected + scope finalized
Month 3-5: SSP draft + control implementation gaps identified
Month 4-6: Gap remediation + Confidential Computing rollout
Month 6-9: 3PAO Security Assessment + SAR (Security Assessment Report)
Month 9-12: Sponsor agency review + remediations
Month 12-15: ATO grant (Authority to Operate)
Month 15-18: First continuous monitoring cycle + first agency customer
onboarded
Risk register¶
| Risk | Severity | Mitigation |
|---|---|---|
| Sponsor agency LOI fails to materialize | HIGH | Pursue Wave-5 D6 CMMC first as alternative defense vertical entry |
| 3PAO finds high-severity gap | MEDIUM | POA&M extends timeline by 3-6 months; engage 3PAO early on gap analysis |
| US Persons hiring shortage | MEDIUM | Plan 6-month lead time; partner with Cisco for talent sharing |
| Cost overrun on 3PAO | LOW | Fixed-fee engagement negotiated upfront |
| Cloud provider FedRAMP authorization changes | LOW | Multi-cloud strategy hedges; AWS GovCloud + Azure Gov both authorized |
Closes audit gap¶
Gap #30 — FedRAMP path not formalized; review board had no sponsor-engagement criteria nor 3PAO selection plan
Cross-references¶
- ADR 0069 D3 — Wave-5 umbrella (sibling)
- ADR 0053 — cell architecture (gov-us-east-1-a etc. naming convention)
- ADR 0054 — PQC compliance with CNSA 2.0 anticipates post-quantum FedRAMP requirements
- NIST 800-53 Rev 5 control catalog
- FedRAMP Authorization Boundary Guidance
- FedRAMP Continuous Monitoring Strategy Guide