Blog

Any Cloud Service Provider (CSP) who is familiar with FedRAMP likely knows that presenting an authorization package that includes a non-FedRAMP-authorized external service storing or processing of federal metadata wouldn’t get you very far—it’s likely a showstopper. However, some may not realize that that’s not necessarily the case regarding StateRAMP.

TAMPA, Fla. – March 31, 2025 – Schellman, a leading provider of attestation and compliance services and a top 50 CPA firm, is pleased to announce that it has received a Facility Security Clearance (FCL), enabling the company to expand its offerings to perform classified assessments for its clients. As an accredited FedRAMP® Third Party Assessment Organization (3PAO), this enables Schellman to perform Department of Defense (DoD) Impact Level 6 (IL6) assessments as well as other NIST-based assessments, SOC 2 examinations, and penetration testing for classified systems. This milestone strengthens Schellman’s position as a trusted assessment partner for government and defense-related classified environments.

As more government agencies move sensitive data to the cloud, ensuring security and compliance is of paramount importance. As such, the FedRAMP (Federal Risk and Authorization Management Program) assessment and authorization process is a critical framework to ensure that cloud environments meet federal security standards.

Recent changes to FedRAMP® have sparked conversations about the program’s future, but one fact remains clear: FedRAMP is here to stay. Recognized as a critical program by the General Services Administration (GSA), it plays a key role in ensuring the security of cloud services used by federal agencies. That said, as the program evolves, notable changes are imminent.

Cybersecurity is no longer just a best practice—it’s a necessity, a foundational pillar of our national security. For over a decade, FedRAMP, or the Federal Risk and Authorization Management Program, has set the gold standard for securing the federal government’s cloud infrastructure, saving time, resources, and taxpayer dollars. But today, we stand at a crossroads. The challenges in front of us - bureaucratic roadblocks, inefficiencies, and budget constraints - threaten to unravel years of progress. The question is clear: Will we rise to the occasion, modernizing FedRAMP without sacrificing its integrity? Or will we allow short-term obstacles to drag us backward into an era of duplication, inconsistency, and increased vulnerability?

Given today’s continually evolving threat landscape, strengthening access controls is an essential element and growing priority of any robust security program. As such, it’s no surprise multi-factor authentication (MFA) has become a widely adopted compliance requirement by a significant number of security standards across industries. That said, it can be difficult to understand the intricacies of the MFA regulations for each compliance framework.

Since the beginning of 2024, FedRAMP Revision 5 has mandated that organizations not only perform traditional penetration tests, but also undergo comprehensive red team engagements. This new requirement reflects a broader emphasis on assessing not just technical vulnerabilities, but also the effectiveness of an organization’s overall security posture, including it’s response to sophisticated and realistic threats. Over the past year, we’ve conducted many red team exercises, each tailored to different organizational environments and threat landscapes. These engagements have varied significantly in scope and complexity, offering us a wealth of insights into both our successes and the challenges we’ve faced.

Looking back, December 2023 was a big month for the Department of Defense (DoD). Not only did they release the 32 CFR Part 170 - Cybersecurity Maturity Model Certification (CMMC) Proposed Rule, but they also published a memorandum titled Federal Risk and Authorization Management Program (FedRAMP) Moderate Equivalency for Cloud Service Provider’s (CSP) Cloud Service Offerings (CSOs). The latter, in a huge development, clarified requirements for CSOs that are currently (or will be) storing, processing, or transmitting Covered Defense Information (CDI)—more commonly referred to as Controlled Unclassified Information (CUI)—although there are some nuances that must be understood.