How to get started on your FedRAMP journey with Cloudflare

Welcome to Getting Started in your FedRAMP Journey. We're going to be looking through the full lifecycle of basically what it is, why it matters, how to get there, all those good things. My name is Ian Kelly. They threw my name on the first slide. I'm functionally the least important person here. With me, I have Tom and Jake, who actually do the work. So do you guys want to introduce yourselves? Hi, I'm Jake Schaeufele. I'm a senior compliance specialist on our FedRAMP GRC team. I've been with Cloudflare for about two years, and I've been working in the FedRAMP space for about a decade or more. And my name is Tom Lianza. I've been at Cloudflare for 11 years. I'm a VP of engineering here, and I work on some of our larger cross-company projects. Last year, FedRAMP High was a big one, and that's what we're going to talk about today. And then going forward, we're also working on the data residency architecture you heard at the keynote. I'm happy to talk about that after, if you like, as well. We're working on that as well. Same crew of people. Okay. As I said, I'm Ian Kelly. I look after the customer engineers that focus on the public sector team in the U.S. So today, we're going to go through a couple of things. First, what is FedRAMP, if your journey includes learning what it is at all? We're going to start there and talk about compliance at Cloudflare generally. Then we'll talk about what our solution is, what the Cloudflare for Government solution looks like, and hopefully have tons of time for Q&A and spend a lot of time there. Can I get a show of hands? How many people in here participate in FedRAMP or have experience in FedRAMP? Oh, there we go. Most of them. Great. So we'll keep this kind of brief because a lot of these things you probably have heard before. FedRAMP is a government standard for procuring cloud services. It's been modernized recently to change over from the traditional low, moderate, high-impact scores to A, B, C, and D. The higher up you go, C, and D, the higher the assurance levels you get. It's a standard that's required by the federal government if you're going to procure cloud services. So if government agencies want to buy a cloud service, they typically are going to require FedRAMP. The key benefit of FedRAMP to agencies is that it's a do-once -use-many process. It speeds up the assurance process to validate. Cloud providers are making sure that they meet the high standards that the federal government has for storing their data. Some key things to note with FedRAMP, that it has third-party requirements that if you're using other third-party service providers as a FedRAMP provider or an agency, those also must be using the same level of FedRAMP. So if you're using class C, your third-party service providers also have a class C. This is very important with Cloudflare. It's a key meeting point between lots of different service providers, bridging networks. So we try to get to the highest assurance levels possible. Other parts of FedRAMP that are notable is that it's changing to more of a continuous validation versus a single point in time like SOC 2 or other frameworks. So we have to continuously validate and ensure we're meeting the high standards for meeting vulnerabilities, reporting incidents, keeping our security safe continuously, not just at the annually audits. We do get annually audited by a third-party assessment organization, and that's very fun. We're kicking off our annual audit right now, and then it runs through the end of the year. And I would just add, when I did the first FedRAMP project ever, it was about 15 years ago, it took us about a year and a half, almost two years to get the website live. Has anybody been through that, like it takes a minute? Okay. There was a very high-profile government launch you may have seen about a month ago that Cloudflare got involved in. It took about a month from the time we got introduced to the customer to the time they were live in a presidential address. So when we're talking about this, this isn't just theoretical stuff that may matter someday. This actually is working, which is making me so happy you'd already even know. It lets government have a chance of keeping pace and getting things out there faster. And if we can start treating compliance like a tool to go fast as opposed to a burden to slow us down, I think it should be a major advantage for everybody. All right. I want to give a little bit of a background on compliance at Cloudflare. I view that we view compliance differently than most of our provider, is that we usually try to do a build once, reuse everywhere. So like FedRAMP is a pretty high standard. We use that standard to lift up our compliance frameworks across the board. So we try to generally drive these things up globally. We also participate in a lot of other different compliance standards, PCI DSS, IRAP, ISMAP. C5, ENS, ISO, like name it. On the next slide, I'll show there's a whole bunch of logos for all the different things we do. It's a lot of different things that we have to keep together, but we've consolidated these into a common controls framework, and we try to do these things basically across the board. It raises the standard in Cloudflare for security. We don't use it just as a like checkbox exercise. It really raises the bar. Other things we do uniquely is when frameworks like FedRAMP require regional specific controls, where you have a higher security standard for physical presence, we use regional services to be able to steer and drive storage and processing to only the highest security sites that we can offer that meet the framework. We additionally provide a lot of documentation to our auditors and our agencies so that we can prove what we're doing is meeting their standards. And then we also try to make it as easy as we can for customers to be able to review compliance docs through a trust hub. And then we provide, for FedRAMP, customer responsibility matrix that tells you what you're responsible for and trying to make that as clear as possible. It's one area that we are trying to do better, so if you ever come across that document, I apologize if it wasn't great, but it will be in the future. The other thing that is special about Cloudflare that we try to build beyond compliance. We look at where the security landscape is going and make sure that we're trying to push things, especially in post-quantum computing, AI, botnets. These things that we try to push forward, we don't try to just settle at, we're compliant, we need FedRAMP, we've got FIPS, we're good, and let's just try to sell that. We want to make it go beyond and push the industry forward. Now, has anybody noticed, there were two sort of Internet-level disasters in the last two days? We had a CA get compromised, and did anybody else see PHP to shell? I woke up this morning and got a text that said, did you see this PHP to shell thing? And I went, oh, no. And then I looked, and there was already a blog post out that it was remediated. And this is, well, it's remediated for us. I'm not going to speak for anybody else on the Internet. They've got their own stuff to do. Cloudflareians, we feel pretty proud of that. We're able to react. This builds on what Grant was talking about, about the lifecycle, just how fast we have to move. And as we look at compliance and security, those aren't always the same. They're kind of next-door neighbors. But this should be the thing, is there should be more to it than just a checkbox. You should be coming over and getting the best and evolving stuff where you're waking up to a blog post saying it's already fixed, as opposed to a disaster where everybody's pages are going off. As I mentioned before, we do a lot of different standards. We have this nice slide to show all the different logos and standards. Some notable ones that are in progress, relevant probably to this audience, is DoD Aisle 4. That's on our roadmap for going through the audit next year. It's a big, exciting push. There's a lot of complexities that we're working through. If anybody has any questions later on, we can try our best to answer those. Moving forward. All right, so how do you get started? Which was the point of this whole thing. There's a few things. One, you have to decide that you're going to do something that requires FedRAMP. We can't choose that for you. Kind of makes sense, right? Mother of an apple pie, like you didn't do some of these things. The second piece is really just figuring out how you're going to use it, where you're going to use it, and what has to go into it. There's a customer responsibility matrix. There's always that moment of things we can control, things we know. Protecting the Internet, testing to how we do it, patching our servers, fixing CA leaks. All of that's on us. We don't physically know who your users are typically. We need you to tell us. We need you to tell us in a very secure way. So we ask you to set up things like an IDP that is compliant to sort of all of the mandates and two-factor authentication, just adopt it as possible. And we'll talk a little bit more about that in a minute. We actually have lots of detail. I know when we talk about compliance, being sort of too high level is typically not useful. So we brought details, and we're hoping for questions. Fair? Okay. And let me talk a little bit about how it works. There's a couple points I want to make. If you use Cloudflare today, the map of POPs on Earth, that's what Cloudflare is known for. When I joined Cloudflare, we were always proud of all the dots as they appear because as sort of a little guy being protected by Cloudflare, that was sort of like a bigger shield and more places around the world to cache. And when regulated markets enter the picture, from an engineering perspective, what's tricky for us is the regionalization requirements. So we're not permitted for every single capability in the regulated markets. What we designed is a solution that allows us to leverage as much of that capacity as we can while still remaining compliant. So we can still use our global presence for network layer DDoS, so we can still stop attacks using these POPs all around the world, though we are not permitted to store or process the FedRAMP data, but in the orange dots of the map. We can still absorb attacks when we pass the traffic through and they're ultimately decrypted and processed and in FedRAMP compliant environments. This is our continuing to do our best to leverage the best of Cloudflare while still remaining compliant. So does anybody know where Prya is? Did anybody watch the World Cup? We had Cabo Verde make it in there somehow, Cabo Verde on a map. It's one of the blue dots kind of next to Africa. I'm not going to point with the laser because some people get blind or something, I don't know. In Cabo Verde, you know what they have? They have tourists, they have a U.S. embassy, they have people that do whatever it is they do on Cabo Verde on a daily basis. They definitely don't have a FedRAMP high data center there. Like I'm really, really confident that they're not there. But that doesn't stop people from like State Department needing to do functions of how they... renewing passports, right? Tourists come in, they predictably lose a passport, what do you do? The ability to connect to the edge where everybody is has always been Cloudflare's superpower. Be close to the world's Internet population, make it fast, make it reliable, make it safe, and do it in a compliant fashion so we're backhauling stuff to FedRAMP compliant data centers to do the work. But being close, we fundamentally believe makes for a better experience for government employees wherever they happen to be. If you're curious, we did a thing of the World Cup teams. Something like 98% of World Cup teams have a Cloudflare data center in their home country. So, we encourage you to start thinking about this. Like it's not always everybody working from home, but what happens when people are out in the field and working? How do we actually make their lives better? And sort of this argument that we should do, I don't know, a GovCloud? Like anybody knows AWS? You've heard of them? You probably use them somewhere. They have, you know, GovCloud West and GovCloud East. Does anybody know where GovCloud East is? It's in Ohio, actually. Which if you're paying careful attention, is secretly not in East, right? That's in like Midwest somewhere. And because of the way they built it, a lot of the services are a little bit out of sync with sort of big AWS to the point where you can't take a publicly facing AWS application and deploy it directly on GovCloud. It's not well documented. It doesn't fit real well. They've sort of built theirs not the way that Jake was describing. Right? And so this idea that if we can reuse the common services that people use, it makes it much simpler to take the lessons learned on the commercial side and bring it to the government side and do it in a compliant fashion. Make sense? All right, great. The other point I wanted to make about how we built this is it's not just that we can leverage all the blue dots for DDoS protection and other things that don't require decryption or storage, but the blue dots and the orange dots are running the same software. There isn't, they are running the same binaries for retail Cloudflare or for global Cloudflare as FedRAMP Cloudflare. There isn't a less than. There isn't a fork. They are configured differently. They're running in different physical data centers, but it is the same software released at the same cadence to ensure, I mean, frankly, engineering sanity, but also to ensure that the product is equally capable and it's not a degraded version. All right, let's dig in a little bit more on the different service offerings. Cloudflare offers a Class C and a Class D certified solutions. I'll talk about Class C first. Class C is accessed through like the dash .Cloudflare.com. This is what the global offering is. It's built through this. It's for compliance. It's primarily driven through entitlements based on getting the Cloudflare for government entitlements and then configurations that are unlocked underneath that entitlement. This is primarily to be able to do regional services to FedRAMP regions. Within the global dash, there's two different region options. They can be used together or independently. There's the FedRAMP US only. There's the FedRAMP International one. So everything that's outside of CONUS on that map is included in the FedRAMP International. So this is like Japan, Australia, mainly Europe. But those can be used together. All of those sites are all at FedRAMP Class C certified. We have auditors that go visit many of these sites every year to ensure that they're meeting those high standards. This is what we typically recommend for most customers who come to us and say, I need to use your FedRAMP offering. It's the best fit for Class A to Class C use cases. Traditionally, this would be called moderate impact. As Tom was saying, it does inherit a lot of the global capacity for DDoS. So any of your zones that are behind this are going to inherit a lot of the firepower that Cloudflare has globally. But when you have your regional processing, it makes sure that the storage and processing is only done in those FedRAMP sites. That's a key thing to know. We make it a customer configurable option because in some use cases, a customer may not want to. They're like, maybe this data isn't at Class C, but it's like accessory data. Maybe I don't need to use the region for that. But we recommend that they do. but if you don't, it's fine. Switching gears into Class D offering. This is our newest offering in the FedRAMP space. It was certified about two, three months ago. It took about two years of working. I basically joined Cloudflare to help make sure that this happened, and it was a big achievement. The notable difference here, and first off, this is on dash.fed .Cloudflare.com. It has a different entry point. It has a different API. Why does it have that? Well, because one of the biggest and hardest requirements for a huge company like us is that it has to be US storage and processing only. Like Cloudflare, we use things around the world. We store control plane information in multiple regions. So we're like, how do we solve this for high? Well, that means that we have to set up a separate dash to be able to do this, but still be able to serve the same services we possibly can within the government or the global infrastructure. This is best fit for if you have a class D need, high impact, high assurance, mission critical, high national importance workloads. As Ian was mentioning, one of our biggest customers is the federal government, and they recently launched america.gov, using our high platform, and it's been an amazing test of the platform and has exceeded everybody's expectations. I think everybody, all the Cloudflare people in the room are pretty excited about it. One of the things we hear a lot of questions about is, is class D inherently safer than class C? Shouldn't I just get the highest possible one? Do you have any perspective on that? Yeah, that's a good question. Not really. So interestingly enough, all the US FedRAMP sites are the same for moderate, for high, class C, class D. These are the same ones. There are different primitives between these things to keep information separate to ensure the control plane information is only in the United States, but like the edge infrastructure for that US, if you selected FedRAMP US only, you're using the same edge presence as the high environment. The control plane information stored in the same data centers that the global dash and everything is. So it's like we have this high security standard across the board for these things, but the key difference, usually this is the thing that drives people to go to high is do I need US storage only? And this is guardrailed. A notable difference here is that you have those options on the commercial dashboard to be able to set things. Well, because it's optional, information is able to be stored. Metadata can be stored in a lot of these other edge sites in case you do need to be able to process things at the edge. But with the high, it's that information that's primitives or keys. Any information is only in the high sites. So it's much tighter controlled within that. So like I said, highest assurance use cases for those ones. It has high availability. Another notable thing is that support wise, if you put in a smorgasbord ticket for the high, you're only going to be getting served by US person support from FlatFlare. With the commercial, it goes through our normal support ticketing process. FedRAMP for Class C doesn't have those requirements of US soil, US persons at all. But we encounter that specifically for the Class D one. That's the way we've designed it. Make sense? All right, so we said how to get started. And I kind of touched on this, but I want to come back to it because this really was the intent here. First of all, you need to figure out is it Class C or Class D, moderate or high? I will say for most people, and we hear this from commercial companies who say, we want the most secure thing. We want FedRAMP high. And we're going, hold on a minute. Why? What's your use case? Do you really need that? So that's a discussion we can have together. That's one you can come to us. The second thing is Cloudflare changes a lot. I looked on October 1st, and we had launched two new products that I'd never heard of before. Didn't know they were coming. There was K2 and Basin. They're both awesome. But the way compliance works, neither one of them is certified today. So we need to be careful that as we're rolling these things out, there is a lag just between when we release things because we release things quickly, particularly during things like, have you seen Birthday Week? I don't think I slept because there was a new blog, a new product, a new way of doing things, a new perspective coming about every 20 minutes or so. It was one of the ones where I had to use AI to say, I know it's my job to know these things, but I can't keep up. How on earth could a compliance person make sure that all of these things are safe? So it's, and I think Jake, you're going to touch on this in a minute, but just making sure you're using stuff that's in the boundary. It's common sense, but our platform changes fast. We don't have a lot of cruft, and so we continue that velocity. The third thing, you need to tell us that you're doing it because you can buy whatever you want from us, and functionally, the people that answer phones will just sell you whatever you ask them for. So if you don't ask for the government version of this stuff, you are not going to get the government version. And this happens more than I'd care to admit. It sounds silly, and it sounds like we should just know what people want, but we're not quite there yet. I think the AI machine hasn't caught up yet. Ask that. It's setting up access, setting up IDPs, setting SSOs, deciding is it US-only data processing, is it ancillary, and it can be in Europe, for example. Those are decisions that you can make. We can make them together. And then there's a small set of things about setting up controls inside the platform. And what I'll tell you is we listed out a lot of things here. Regional controls, identity, certificates, firewalls, product settings. You do not have to memorize this. We have a customer engineering team who exists to make this as easy as humanly possible. That's Johnny and Eric right there. If you have questions of how to do this... Oh, and Devin's back there too. Those three are functionally the most knowledgeable people on the planet of how to help customers do this. And what I'll say is don't try and decode it yourself. Just let us know. We'll come sit down and do it with you. We'll figure out if it makes sense. We'll make sure that all the things are in boundary because functionally this should be easy. Functionally, you should be able to go from zero to an accredited system using the FedRAMP stuff, taking advantage of all the compliance regimes that are in place. And it should make your life simpler and not harder. Right? And that's kind of a weird thing because usually compliance is like a main drag. We honestly think we can help you go faster. Come find me. Come find them. If you've got questions, that's literally why we exist. There are a lot of words on this slide. I'm not going to go through a lot of them, but I did want to have slides up here to show what are our certified services and what are The Cloudflare GRC and security team is really proud of how many services we're able to bring over the years. We've had Class C for, I don't know, four or five years. It was a lot of blood, sweat, and tears to get it in the process. As Ian mentioned, we do try to bring in as many of the new GA products as we can. We have to have a process to bring these things in so we ensure that they're meeting all the FedRAMP requirements and the right capabilities and the right regional service capabilities. Many of these products don't launch with those ones, so we have to make sure that they create those features and that they're also audited by our third-party assessment organization. That includes a pen test. They take these things through the ringer and only the ones that are approved get out on the other side and they get certified. These lists of services, you don't have to memorize them or anything like that. These are all available on the FedRAMP marketplace. You can just go to marketplace.fedramp.gov, I think, and you can look at our listing and we have one listing that combines and try to tell the difference between these ones. Let's go to the next one, the class D. There are some differences between these two things. I think what Ian was saying was very important is like when you're trying to plan out or you're using FedRAMP, you want to use FedRAMP, it's like ensuring that you're using the services that are available. One special thing I get to share with you all, only in the room that no one else knows, are upcoming services. These are our new services that are coming up in the next cycle. Notable ones that are under the class D are Worker's AI and AI Gateway. So... What? Disclaimer at the bottom. These are all pending approval, but these are the ones that we're going through with right now. They're well along their way. Like I said, we're in the audit. And I think that's it.