Advice for young startups eyeing federal: Do certifications matter?
One of the things we pride ourselves on at Merlin Ventures is preparing our portfolio companies for the federal market. What that means varies by company, but one area we like to focus on up front is helping you to understand the various federal certifications that exist (there are a bunch!) and which ones you actually need to be concerned about. Perhaps even more important than understanding which certifications matter is developing a timeline that makes sense for your company. Getting it right means you are prepared to take orders when customers are ready to place them. Getting it wrong means potentially wasting hundreds of thousands of dollars on a certification that may expire before it ever helps you.
My goal in this blog post is to spotlight four key certifications. That’s not to say you should drop everything in your roadmap and refocus your engineering team on these immediately. Rather, these are some of the more common ones we see and companies interested in federal should have a plan to address them at the right time.
Before diving into certifications, I should probably clarify that “certifications” isn’t even necessarily the right word. There are a few terms to be aware of, and sometimes they are used interchangeably when they should not be.
- Compliant – A pretty low bar, compliance means you are following the rules, but no one has verified what you are doing. You’ll see this quite often with companies claiming to be FIPS (Federal Information Processing Standards) compliant, which should not be confused with being FIPS validated.
- Validated or Certified – This is where a third-party has inspected what you are doing, validated that it does in fact meet the requirements, and certified the results. While validation is technically part of a certification process, these two terms are often used interchangeably. Most notably, you will typically see products referred to as being FIPS validated, meaning they have gone through the FIPS testing process and been shown to meet the requirements.
- Authorized – This typically refers to a government agency validating that your solution meets their agency requirements and authorizing it for use. You will often see this referred to as an ATO, or Authority to Operate. While getting one ATO can often help you get others, ATOs refer to specific implementations and are not a stand-alone product certification.
Section 508 Compliance and VPAT
Section 508 of the Rehabilitation Act provides accessibility guidelines and requires that information and communications technology (ICT) used by the federal government or organizations funded by the federal government be in compliance with the law. Compliance, while mandated, is self-regulated as there is neither a certification process nor a certification authority that evaluates and attests to compliance.
To assist organizations in demonstrating compliance, the Information Technology Industry Council (ITI) has established a template called the Voluntary Product Accessibility Template (VPAT). A VPAT is a document that explains how ICT products such as software, hardware, electronic content, and support documentation meet laws and standards for IT accessibility. If your organization wants to conduct business with the federal government, you will need a VPAT. While self-assessment is possible, it can be complicated to complete the form internally without substantial accessibility experience. Firms therefore often rely on accessibility consultants to conduct a full audit and check for all applicable portions of Section 508, which includes the technical requirements; the functional performance criteria; and the information, documentation, and support requirements. While this is a requirement for selling into many agencies, the good news is that getting a VPAT is relatively easy and inexpensive.
Federal Information Processing Standard (FIPS) 140-2/140-3 Cryptographic Certification
FIPS 140 is a set of security requirements defined by the National Institute of Standards and Technology (NIST) for cryptographic modules deployed in the federal government. FIPS 140 accreditation validates that hardware and software cryptographic modules produced by private-sector firms meet requirements designed to protect a module from being altered, cracked, or otherwise tampered with. FIPS 140 validation is mandatory for federal agencies that collect, store, transfer, share, and disseminate sensitive but unclassified (SBU) information and extends to their contractors and service providers.
While FIPS 140-2 has been the standard for the last 20 years, FIPS 140-3 was approved on March 22, 2019 as the successor to FIPS 140-2 and became effective on September 22, 2019. Both FIPS 140-2 and FIPS 140-3 are accepted as current and active, but there are some gotchas to be aware of. While FIPS 140-2-certified modules will be valid until September 21, 2026, unless you are already in the queue, you can no longer apply for FIPS 140-2 validation in the traditional ways. (I say “the traditional way,” because there are some loopholes that still allow you to get a FIPS 140-2 certificate.)
Both FIPS 140-2 and FIPS 140-3 define four security levels, depending on the level of security that is needed. For most commercial software products, we find that level 1 is appropriate. However, FIPS is one place where the difference between “compliant” and “validated” comes into play. While there is some debate about it, many federal agencies will accept software so long as the encryption libraries it uses are FIPS 140 validated, which means the overall solution is compliant. However, some agencies will require that the entire product receives its own validation. We typically recommend our partners set themselves up to be able to go through the validation process, if necessary, but stick with compliance until they get to that point. While the standard FIPS validation process is extremely lengthy, there are some alternative approaches that we can recommend that can get companies through the process in a couple of months if it becomes necessary.
National Information Assurance Partnership (NIAP) Common Criteria Certification
Operated by the National Security Agency, NIAP is responsible for U.S. implementation of the Common Criteria, including management of the NIAP Common Criteria Evaluation and Validation Scheme (CCEVS) validation body. NIAP’s mandate is to provide neutral third-party testing of Commercial Off The Shelf (COTS) Information Assurance (IA) and IA-enabled IT products used in National Security Systems (NSS). NIAP certification is mandated by federal procurement requirements (CNSSP 11) for layered COTS product solutions to protect information on NSS and is most applicable to the Intelligence Community (IC), Department of Defense (DoD), and DoD contractors or affiliates.
NIAP evaluations are conducted by Common Criteria Test Labs (CCTLs) that are accredited by the NIST National Voluntary Laboratory Accreditation Program (NVLAP). All products evaluated under NIAP must demonstrate exact compliance to the applicable Protection Profile (PP), which is an implementation-independent set of security requirements and test activities for a particular technology that enables achievable, repeatable, and testable evaluations. Evaluations can be completed in less than 90 days, but must not exceed 180 days.
Common Criteria evaluation includes both cryptographic and non-cryptographic security functions of an IA or IA-enabled COTS IT product. In many cases, the cryptographic portion of a product will be evaluated under FIPS 140-2/FIPS 140-3. To eliminate duplicate test activities, NIAP accepts Cryptographic Algorithm Validation Program (CAVP) and CMVP certificates to demonstrate compliance to certain test requirements. To be posted on the NIAP Product Compliant List (PCL), the product’s cryptography must have a CAVP certificate, and optimally, a CMVP certificate. A NIAP certificate indicates that the product has successfully completed an evaluation and complies with the requirements of the NIAP program and, where applicable, the requirements of the FIPS validation program.
If and when to pursue Common Criteria certification is dependent on where you expect to sell your product within the U.S. Government. As mentioned above, while much of DOD will require it, most civilian agencies do not.
Federal Risk and Authorization Management Program (FedRAMP)
Established in 2011, FedRAMP is one of the government’s most rigorous security compliance frameworks. FedRAMP provides a standardized approach to security assessment, authorization, and continuous monitoring for commercial cloud products and services used by the U.S. government. While difficult to achieve, the beauty of a FedRAMP ATO is that it qualifies a cloud service offering (CSO) to be used at multiple agencies.
Before a CSO can be used by a federal agency, it must demonstrate compliance with all FedRAMP requirements, which are outlined in NIST 800-53. Additionally, a cloud service provider (CSP) must implement continuous monitoring and regular evaluation against this standard to maintain its status.
Because of the various gates that are part of the process, FedRAMP typically takes at least six months to get through, although it’s not unheard of for companies to take two years to complete it. For SaaS-only products, FedRAMP can be a significant barrier to entry to the federal market, and it’s one that’s important to plan for. Even before a company is necessarily ready to invest in going through the formal process, there is pre-work that can be done to set yourself up for success, and understanding that timeline is key to entering the federal market at the right time.
Merlin has built out its own FedRAMP managed service called Constellation GovCloud to help companies get through the process more easily. If you’re looking for more info on FedRAMP, the Constellation site and blog are great sources of information.
Section 508, VPAT, FIPS, NIAP, FedRAMP… In this world of regulations that read like alphabet soup, we understand the challenges of complying. A big part of taking on the federal market is knowing when is the right time to pursue critical certifications. If you’re uncertain which standards you need to comply with – and when – we’re here to help.
