Getting started with FedRAMP ATO Accelerator

The FedRAMP ATO Accelerator reads the configuration of your cloud environment, code repositories and security tools, and drafts control implementation statements, evidence and the System Security Plan from what it finds. Your compliance team reviews and approves every statement before it goes into the package. The package stays tied to the live configuration, so when the system changes you see which controls and documents are affected.

What it is for

Preparing for a FedRAMP or agency authorization means describing hundreds of NIST SP 800-53 controls in a System Security Plan, collecting evidence for each, and keeping all of it current through assessment and continuous monitoring. Most teams write these documents by hand in word processors and spreadsheets, interviewing engineers to find out how the system works. The documents drift from the real configuration as soon as they are written, and assessors find gaps between what the plan says and what the system does.

• Control statements are written from interviews and memory rather than from the system itself
• Evidence is gathered by screenshot and spreadsheet, and goes stale between assessments
• Changes to the system are not traced to the controls and documents they affect
• POA&M items, scan results and monthly deliverables are tracked in separate files

Who uses it

• Software and cloud service providers pursuing FedRAMP authorization
• Agency system owners and ISSOs preparing an agency authorization to operate
• Compliance and GRC teams who write and maintain the security package
• Cloud and platform engineers who are asked to explain how controls are implemented
• Independent assessors and agency reviewers who need traceable evidence

Before you start

• Your organization licenses FedRAMP ATO Accelerator from Moraph.
• A Moraph client account in that organization, signed in.
• Access to FedRAMP ATO Accelerator in Moraph Apps, given by an administrator in the Moraph Portal under People and access.
• For setup: the product administrator role.

Steps to get started

1. Sign in at app.moraph.com with your Moraph account.

2. Open FedRAMP ATO Accelerator from the launcher. The first time anyone opens it, its workspace is created from the default described in Workspace reference.

3. Check your role: what you can see and do depends on it. See Roles and permissions.

4. Product administrators: work through Set up FedRAMP ATO Accelerator before your team starts.

5. Everyone else: start with Everyday tasks.

Where to go next

• Set up FedRAMP ATO Accelerator
• Everyday tasks
• Connect your systems
• Security, data and compliance
• Troubleshooting and the support guide
• Product overview on moraph.com