FedRAMP-Compliant Cloud Solutions Boost Data Security for Aerospace and Defense Manufacturers

Cyberattacks are dominating today’s headlines, as digitization poses more security risks for the private and public sectors. In 2020, SolarWinds, a major U.S. information technology firm, experienced a security breach that compromised the internal systems of numerous private firms and government agencies.¹

In March of this year, hackers gained access to at least 30,000 Microsoft Exchange email accounts through vulnerabilities in its server.² And a few months later, Colonial Pipeline was forced to shut down the largest fuel pipeline in the U.S. due to a ransomware attack.³

With cyberattacks on the rise, data protection is a key consideration for product manufacturers as they make the transition to cloud-based solutions. Defense and aerospace companies, in particular, are subject to export control regulations (e.g., ITAR and EAR) that require certain security measures for technical data. Companies that work with the U.S. government are also subject to stringent FedRAMP cybersecurity regulations for cloud-based data.

So exactly what is FedRAMP and how can a FedRAMP-compliant Cloud PLM solution benefit your business?

What Is FedRAMP?

The Federal Risk and Authorization Management Program (FedRAMP) is a government program that provides a standardized approach to evaluating and monitoring the security of cloud platforms that are used by U.S. federal agencies. FedRAMP enables government entities to secure data and detect cybersecurity risks at high speed. It also ensures that the proper safeguards are always in place.

FedRAMP was established in 2012 by the National Institute of Standards and Technology (NIST), General Services Administration (GSA), Department of Defense (DoD), and the Department of Homeland Security (DHS) in an effort to streamline the evaluation and adoption of cloud-based solutions by federal agencies.

Requirements for FedRAMP Compliance

Cloud service providers must demonstrate that their product meets FedRAMP compliance requirements, as outlined by NIST SP 800-53A and the Federal Information Processing Standard (FIPS) 199. These requirements include:

• Implementation of proper security controls
  The level of security controls (i.e., low, moderate, and high) is determined by the type of data contained in the cloud platform and the potential impact of a security breach on confidentiality, integrity, and availability of data.
  • Low impact level (125 controls): The loss of confidentiality, integrity, and/or availability of data could have a limited adverse effect on an organization’s operations, assets, or individuals.⁴
  • Moderate impact level (325 controls): The loss of confidentiality, integrity, and/or availability of data could have a serious adverse effect on an organization’s operations, assets, or individuals. This impact level applies to approximately 80% of FedRAMP-approved applications.⁴
  • High impact level (421 controls): The loss of confidentiality, integrity, and/or availability of data could have a severe or catastrophic adverse effect on an organization’s operations, assets, or individuals. This typically applies to law enforcement, emergency services, financial, and health institutions.⁴

• Completion of system security plan (SSP)
  An SSP describes how security controls are addressed, how the system is structured, and the security authorization boundaries that are put in place.

• Review by a FedRAMP third-party assessment organization (3PAO)
  3PAOs are independent organizations that verify a cloud service provider’s security implementations and assess the overall security risk of the cloud environment.

• Development of a plan of action and milestones (POA&M)
  A solid plan needs to be in place to address any security weaknesses that are identified. This includes the provision of staffing and additional resources.

• Implementation of a continuous monitoring program, including monthly vulnerability scans
  Cloud service providers should implement a program to continuously monitor any risks or vulnerabilities to the system and assess the effectiveness of the security controls that are deployed.

Benefits of Using a FedRAMP-Compliant PLM Solution

As more aerospace and defense companies adopt cloud-based product lifecycle management (PLM) solutions, they need to be cognizant of industry regulations and the ability of the solution to meet their requirements. The use of a FedRAMP-compliant PLM solution provides manufacturers with greater insight into cloud security controls and instills added confidence that their product data is protected from imminent cyber threats. It also creates new opportunities for companies looking to diversify their product portfolio and expand their customer base in the government sector.

Arena PLM for AWS GovCloud FedRAMP Compliance Status

Arena, a PTC Business, as a cloud service provider has implemented a framework of controls that meets the security requirements equivalent to those established by the government for the Federal Risk and Authorization Management Program (FedRAMP) Moderate baseline. Additionally, Arena maintains controls that meet the requirements as stated in DFARS 252.204-7012 (c)-(g).

Interested to learn more about Arena’s secure Cloud PLM system? Contact us at [email protected].

References

1. https://whatis.techtarget.com/feature/SolarWinds-hack-explained-Everything-you-need-to-know
2. https://www.csoonline.com/article/3616699/the-microsoft-exchange-server-hack-a-timeline.html
3. https://www.zdnet.com/article/colonial-pipeline-ransomware-attack-everything-you-need-to-know/
4. https://www.fedramp.gov/understanding-baselines-and-impact-levels/