FedRAMP authorization boundary of a government SaaS

Views in this map

1. 1
   The boundaryWhat runs inside, what is leveraged from AWS, what is outside, and who uses it.
2. 2
   Data flowsTen flows across the boundary and their encryption. Flow 10 is not authorized.
3. 3
   InterconnectionsEach outside connection and its agreement: signed, pending or not needed.
4. 4
   Who owns each controlWho meets each control: AWS, Marshlight or both. Pick one under Control to see where.
5. 5
   Continuous monitoringOctober’s findings and open POA&M items where they apply, due in 30, 90 or 180 days.

The boundary ‹ › Data flows ‹ › Interconnections ‹ › Who owns each control ‹ › Continuous monitoring

Flows to play

• ▷
  An application, end to endOne benefits application, from the applicant’s sign-in to the support ticket that sends its file outside. In the Data flows view.
• ▷
  Where the controls are metFive controls, from Marshlight’s own to wholly inherited, and the components that meet each one. In the Who owns each control view, beside the Control filter that picks one control at a time.
• ▷
  October’s monthly scanFrom October’s scans to the POA&M the sponsoring agency received on the 15th. In the Continuous monitoring view.

The model behind it

73 records of 10 types. Every box on the map is one of them, so the filters and the record panel read the same data.

• Components 18
• Controls 14
• Data flows 10
• Leveraged services 7
• External services 6
• POA&M items 6
• Interconnections 5
• 3 more types 7

Filters

Boundary and Responsibility and Control: pick a value and everything else fades.