Search for: All records

The U.S. Federal Risk and Authorization Management Program (FedRAMP) has long relied on extensive sets of controls and static documentation to assess cloud systems. However, this manual, point-in-time approach has struggled to keep pace with cloud-native development. FedRAMP 20x, a 2025 pilot program, reimagines the NIST Risk Management Framework (RMF): replacing traditional NIST 800-53 controls with Key Security Indicators (KSIs), using automated, machine-readable evidence, and emphasizing continuous reporting and authorization. This case study presents a practitioner-led field report from an industry participant who led multiple FedRAMP 20x pilot submissions and engaged directly with the FedRAMP PMO, 3PAOs, and community working groups. It explores how KSIs, continuous evidence pipelines, and DevSecOps integration can streamline authorization and improve cyber risk management. The study shows FedRAMP 20x as a live testbed for implementing the RMF in a cloud-native, automation-first approach and shares actionable recommendations for risk professionals seeking to modernize compliance and support real-time, risk-informed decision-making. 

Document files with sensitive information are used across nearly every industry. In recent years, cyberattacks have resulted in millions of sensitive documents being exposed. Although document encryption methods exist, they are often flawed in terms of usability, security, or deployability. We present a structured framework for evaluating document encryption methods, adapting the usability-deployability-security ("UDS") model to the document encryption context. We apply this framework to compare current methods, performing a comprehensive evaluation of nine document protection methods, including password-based, passwordless, and cloud-based approaches. Our analysis across 15 design properties highlights the benefits and limitations of current methods. We propose strategies and design recommendations to address key limitations such as memory-wise effort, granular protection, and shareability.