Encryption of Federal Data

Keith Kidd, Director, FedRAMP Assessment, Coalfire

One of the biggest challenges our customers face when pursuing Federal Risk and Authorization Management Program (FedRAMP) compliance is the federal mandate that Federal Information Processing Standards (FIPS) 140-2 validated cryptographic modules must be consistently applied where cryptography is required. Where is cryptography required you ask? FIPS mode must be applied for all inbound connections to the cloud service, connections to management interfaces within the cloud service offering (CSO), and wherever Federal data is stored. In addition, credentials such as passwords must be protected using FIPS-validated modules. You can find the list of FIPS 140-2 validated solutions by searching the National Institute of Standards and Technology (NIST) Cryptographic Module Validation Program.

FIPS 140-2 validated solutions like those provided by SafeLogic can be implemented to help organizations successfully protect customer information. Because navigating the relationship between FIPS 140-2 validated encryption and FedRAMP certification can be confusing and complex for many enterprises, SafeLogic and Coalfire collaborated to write “FedRAMP Requirements for Validated Cryptographic Modules,” a white paper discussing the encryption-relevant FedRAMP security controls that must be implemented.

The whitepaper is available immediately for complimentary download.

Understanding the FIPS-140-2 encryption requirements is, of course, just one element of the comprehensive FedRAMP process. Yet, the federal government continues to migrate applications to the cloud as agencies work to modernize their IT infrastructures and garner greater efficiencies—making FedRAMP an important compliance framework for Cloud Service Providers wishing to tap into this market opportunity. If you would like to learn more about FedRAMP, feel free to contact our team.

Keith Kidd


Keith Kidd — Director, FedRAMP Assessment, Coalfire

Recent Posts

Post Topics



Accounting Agency AICPA Assessment assessments ASV audit AWS AWS Certified Cloud Practitioner AWS Certs AWS Summit bitcoin Black Hat Black Hat 2017 blockchain Blueborne Breach BSides BSidesLV Burp BYOD California Consumer Privacy Act careers CCPA Chertoff CISO cloud CMMC CoalfireOne Compliance Covid-19 credit cards C-Store Culture Cyber cyber attacks Cyber Engineering cyber incident Cyber Risk cyber threats cyberchrime cyberinsurance cybersecurity danger Dangers Data DDoS DevOps DevSecOps DFARS DFARS 7012 diacap diarmf Digital Forensics DoD DRG DSS e-banking Education encryption engineering ePHI Equifax Europe EU-US Privacy Shield federal FedRAMP financial services FISMA Foglight forensics Gartner Report GDPR Google Cloud NEXT '18 government GRC hack hacker hacking Halloween Health Healthcare heartbleed Higher Education HIMSS HIPAA HITECH HITRUST HITRUST CSF Horror Incident Response interview IoT ISO IT JAB JSON keylogging Kubernetes Vulnerability labs LAN law firms leadership legal legislation merchant mobile NESA News NH-ISAC NIST NIST 800-171 NIST SP 800-171 NotPetya NRF NYCCR O365 OCR of P2PE PA DSS PA-DSS password passwords Payments PCI PCI DSS penetration Penetration Testing pentesting Petya/NotPetya PHI Phishing Phising policy POODLE PowerShell Presidential Executive Order Privacy program Ransomware Retail Risk RSA RSA 2019 Safe Harbor Scanning Scans scary security security. SOC SOC 2 social social engineering Spectre Splunk Spooky Spraying Attack SSAE State Stories Story test Testing theft Virtualization Visa vulnerability Vulnerability management web Wifi women XSS