Phase 15 — Compliance and Authorization Engineering (FedRAMP and Beyond)

Track: Elite / Principal | Duration: 8 weeks | Prerequisites: Phase 03, Phase 07

Objective: treat compliance as engineering. Become able to design and build the engines for an authorization — NIST 800-53 controls and baselines, the FedRAMP ATO process, the authorization boundary and control inheritance, OSCAL / compliance-as-code, continuous monitoring and POA&M SLAs, FIPS-validated cryptography, and the crosswalk across PCI/HIPAA/SOC 2/ISO/CMMC. This is the capability that lets a company acquire the authorizations (FedRAMP, IL, PCI, SOC 2) that are table stakes in regulated markets — and prove to customers' auditors that the services are trustworthy.

Deep guides: WARMUP.md derives authorization from first principles; HITCHHIKERS-GUIDE.md is the operator's manual (OSCAL, evidence automation, ConMon in practice).

Why This Phase Exists

In US government, defense, payments, health, and enterprise SaaS, an authorization is a precondition to having customers. The gap between a company that earns FedRAMP High in months and one that flails for years is whether security treats it as engineering — controls as code, automated evidence, continuous monitoring with enforced remediation SLAs — or as a last-minute documentation scramble. Done as engineering, the same controls satisfy the auditor and genuinely protect customers, and the evidence chain serves both. This phase teaches the principal-level discipline that turns an authorization from a tax into a forcing function and a competitive moat.

Core Topics

• NIST 800-53 control families, enhancements, and impact-driven baselines (FIPS 199; Low/Mod/High, nested).
• The FedRAMP ATO process: SSP, 3PAO, SAR, POA&M, the Authorizing Official; authorizing with open POA&Ms; P-ATO/agency ATO.
• The authorization boundary; substantiated control inheritance (shared responsibility formalized).
• OSCAL and compliance-as-code: machine-readable controls, baselines, SSPs, assessment results, POA&Ms.
• Continuous Monitoring: monthly scans, severity-based POA&M SLAs (30/90/180), deviation requests, vendor-scope separation.
• FIPS 140-3 validated cryptographic modules vs "strong crypto"; FIPS mode; crypto inventory.
• The regime map and crosswalk: FedRAMP/CMMC-IL, PCI DSS, HIPAA, SOC 2, ISO 27001.
• Automated evidence collection and freshness; the audit as a query.

Labs

Pure-Python, offline, deterministic; faithful to FedRAMP rules. Run:

LAB_MODULE=solution pytest -q
pytest -q

Capstone — Authorization Engineering Package

Design (and partially implement) the authorization of a fictional multi-tenant SaaS for FedRAMP Moderate:

• impact categorization (FIPS 199) and baseline selection;
• an authorization-boundary diagram and a substantiated control-inheritance map (from a FedRAMP-High IaaS), expressed as OSCAL data;
• an SSP excerpt: implementation statements for a representative control per family;
• a control-readiness report (Lab 01) showing implemented/inherited/POA&M status and gaps;
• a ConMon plan (Lab 02): scan cadence, POA&M SLAs, deviation process, an example monthly posture;
• a FIPS-140-3 crypto inventory mapping sensitive-data encryption to validated modules;
• a crosswalk showing how the control library also satisfies PCI/HIPAA/SOC 2/ISO;
• an executive memo: the market/trust value of the authorization and the residual risk the AO accepts.

Recommended Sources

NIST SP 800-53 Rev. 5 / 800-53B / 800-37; FIPS 199 / FIPS 140-3 and the CMVP; FedRAMP documentation; OSCAL spec and Trestle tooling; PCI DSS v4.0; HIPAA Security Rule; AICPA SOC 2 TSC; ISO/IEC 27001; CMMC and the DoD Cloud SRG.

Measurable Outcomes

• Compute authorization readiness for a baseline and correctly classify missing controls, unsubstantiated inheritance, missing evidence, and gaps with/without on-time POA&Ms.
• Compute a monthly ConMon posture: detect stale/missing scans, overdue findings by severity, and honor approved unexpired deviations.
• Explain the FedRAMP ATO process, inheritance, OSCAL, ConMon SLAs, and FIPS validation.
• Crosswalk one engineered control across multiple regimes.

Evaluation Checklist

• Select a baseline from an impact categorization and explain the nesting.
• Explain authorizing with open POA&Ms and what makes a gap acceptable.
• Substantiate (or flag) a control-inheritance claim.
• Explain OSCAL / compliance-as-code leverage.
• State the ConMon scan cadence and severity SLAs and apply a deviation correctly.
• Distinguish FIPS-validated cryptography from strong crypto.

Common Mistakes

• Treating compliance as paperwork instead of tested controls + fresh evidence.
• Pretending the system has zero findings instead of tracking gaps in POA&Ms.
• Mis-stating inheritance (claiming a control the provider doesn't cover for your usage).
• Documenting controls in un-queryable Word/Excel instead of OSCAL.
• Letting scans go stale or POA&Ms go overdue after the ATO.
• Equating "AES-256" with FIPS 140-3 validation.

Interview Topics

NIST 800-53 baselines; the FedRAMP ATO process and authorizing with POA&Ms; the authorization boundary and control inheritance; OSCAL / compliance-as-code; ConMon scan cadence and severity SLAs; deviation requests; FIPS 140-3 validated modules; the regime crosswalk; automating evidence.