0:02Welcome to getting started on your FedRAMP journey. We're going to be looking through the full life cycle of basically what it is, why it matters, how to get there, all those good things. My name is Ian Kelly. They threw my name on the first slide. I'm functionally the least important person here. With me, I have Tom and Jake, who actually do the work. So do you guys want to introduce yourselves? Hi, I'm Jake Schoffel. I'm a senior compliance. specialist on our FedRAMP GRC team. I've been with Cloudflare for about two years, and I've been working in the FedRAMP space for about a decade or more. And my name's Tom Lianza. I've been at Cloudflare for 11 years. I'm a VP of engineering here, and I work on some of our larger cross-company projects. Last year, FedRAMP High was a big one, and that's what we're going to talk about today.

0:50And then going forward, we're also working on the data residency architecture you've heard at the- keynote. I'm happy to talk about that after. If you like as well, we're working on that as well. Same crew of people. As I said, I'm Ian Kelly. I look after the customer engineers that focus on the public sector team in the U .S. Today, we're going to go through a couple of things. First, what is FedRAMP if your journey includes learning what it is at all? We're going to start there and talk about compliance at Cloudflare generally. Then we'll talk about what our solution is with the cloud. for government solution looks like and hopefully have tons of time for q a and help spend a lot of time there uh can i go show hands how many people in here participate in fed ramp or have experience with fed ramp oh there we go most are oh great um so we'll keep this kind of brief because a lot of these things you probably have heard before fed ramp's a government standard for procuring cloud services it's been modernized recently to change over from the traditional low moderate high impact score to A &E, C &D.

1:52The higher up you go, C &D, the higher the assurance levels you get. It's a standard that's required by the federal government if you're going to procure cloud services. So if government agencies want to buy a cloud service, then typically you're going to require a FedRAMP. The key benefit of FedRAMP to agencies is that it's a do -once -use -many process. It speeds up the assurance process. to validate cloud providers and making sure that they meet the high standards that the federal government has for storing their data. Some key things to note with FedRAMP, that it has third-party requirements that if you're using other third-party service providers, as a FedRAMP provider or an agency, those also must be using the same level of FedRAMP.

2:41So if you're using Class C, like your third-party service providers also have a Class C. This is very important with Cloudflare, a key meeting point between lots of different service providers bridging networks so we sure we try to get to the uh the highest assurance level as possible um other parts of fed ramp that are notable is that it's more like it's changing to more of a continuous validation versus like a single point in time like sock 2 or other frameworks so we have to continuously validate and ensure meeting uh the high standards for meeting vulnerabilities reporting incidents keeping our security safe continuously, not just at the annually audits. We do get annually audited by a third-party assessment organization, and that's very fun.

3:26We're kicking off our annual audit right now, and then it runs through the end of the year. And I would just add, when I did the first FedRAMP project ever, it was about 15 years ago, it took us about a year and a half, almost two years to get the website live. Has anybody been through that, like it takes a minute? There was a very high-profile government launch you may have seen about a month ago that Cloudflare got involved in. It took about a month from the time we got introduced to the customer to the time they were live in a presidential address. So when we're talking about this, this isn't just theoretical stuff that may matter someday. This actually is working, which is making me so happy you don't even know.

4:12It lets government have a chance of keeping pace and getting things out there faster. And if we can start treating compliance like a tool to go fast as opposed to a burden to slow us down, I think it's going to be a major advantage for everybody.

4:26All right, I want to give a little bit of a background on compliance at Cloudflare. I view that we do compliance differently than most of our provider is that we usually try to do a build one, three's everywhere. so like fed ramp is a pretty high standard we use that standard to lift up our compliance frameworks across the board so we try to generally drive these things up globally we also participate in a lot of other different compliance standards pci dss irap is map c5 ens iso like name it on the next side i'll show there's a whole bunch of logos for all the different things we do it's a lot of different things that we have to keep together but we've consolidated these into a common controls framework and we try to do these things basically across the board. It raises the standard Cloudflare for security.

5:13We don't use it just as a checkbox exercise. It really raises the bar. Other things we do uniquely is when frameworks like FedRAMP require regional specific controls, or you have a higher security standard for physical presence, we use regional services to be able to steer and drive. storage and processing to only the highest security sites that we can offer that meet the framework. We additionally provide a lot of documentation to our auditors and our agencies so that we can prove what we're doing is meeting their standards. And then we also try to make it as easy as we can for customers to be able to review compliance stocks through a trust hub. And then we provide for FedRAMP customer responsibility matrix that tells you what you're responsible for.

6:04and trying to make that as clear as possible. It's one area that we are trying to do better. So if you've ever come across that document, I apologize if it wasn't great, but it will be in the future. The other thing that is special about Cloudflare that we try to build beyond compliance. We look at where the security landscape is going and make sure that we're trying to push things, especially in post-quantum computing, AI, botnets. These things that we try to push forward, we don't try to... settle it a we're compliant we need fed ramp we've got phips we're good and let's just try to sell that uh we want to make it go beyond and push the industry forward now and has anybody noticed there were two sort of internet level disasters in the last two days right we had a ca get compromised and everybody else see php the shell i woke up this morning and got a text that said did you see this php the shell thing and i went oh no and then i looked and there was already a post out that it was remediated, right? And this is, it's remediated for us.

7:01I'm not going to speak for anybody else, anybody else on the internet, they've got their own stuff to do. Cloud Clarions, we feel pretty proud of that. We're able to react, right? This builds on what Grant was talking about, about the lifecycle, just how fast we have to move. And as we look at compliance and security, those aren't always the same. They're kind of next to our neighbors. But this should be the thing is there should be more to it than just a checkbox. You should be coming over and getting the best and evolving stuff where you're waking up to a blog post saying it's already fixed, as opposed to a disaster where everybody's pages are going off.

7:39As I mentioned before, we do a lot of different standards. We have this nice slide to show all the different logos and standards. Some notable ones that are in progress, relevant probably to this audience, is DoD aisle four. That's on our roadmap for going to the audit next year. It's a big, exciting push. It's a lot of... complexities that we're working through. If anybody has any questions later on, we can try to best answer those. Moving forward.

8:10Oh, all right. So how do you get started, which is the point of this whole thing? There's a few things. One, you have to decide that you're going to do something that requires FedRAMP. We can't choose that for you. It kind of makes sense, right? Motherhood and apple pie, like you didn't do some of these things. The second piece is really just figuring out how you're going to use it, where you're going to use it, and what has to go into it. And we always want to do this in a shared fashion, right? There's always a customer responsibility matrix. There's always that moment of things we can control, things we know, protecting the internet, attesting to how we do it, patching our servers, fixing CA leaks. All of that's on us. We don't physically know who you're- users are typically. We need you to tell us. We need you to tell us in a very secure way.

8:58So we ask you to set up things like an IDP that is compliant to sort of all of the mandates and two-factor authentication, all the sorts of things that governments require, right? And what we want to do is make it as easy to do this and adopt it as possible. And we'll talk a little bit more about that in a minute. We actually have lots of detail. I know when we talk about compliance being sort of too high level is typical. not useful so we brought details and we're hoping for questions fair okay

9:30and let me talk a little bit about how it works there's a couple points i want to make if you use cloudflare today sort of in a non-regulated environment you probably know we have a very big map of pops on earth that's what cloudflare is known for when i joined cloudflare we were we were always proud of all the dots as they appear because as sort of a little guy being protected by Cloudflare, that was sort of like a bigger shield and more places around the world to cash. And where, when regulated markets enter the picture, from an engineering perspective, what's tricky for us is the regionalization requirements. So we're not permitted to use all this capacity we're so proud of for every single capability in the regulated markets.

10:15But what we designed is a solution that... allows us to leverage as much of that capacity as we can while still remaining compliant. So we can still use our global presence for network layer DDoS. So we can still stop attacks using these pops all around the world, though we are not permitted to store or process the FedRAMP data, but in the orange dots of the map. So we can still absorb attacks. We pass the traffic through and they're ultimately, you know, encrypted and processed and in FedRAMP-compliant environments. This is our continuing to do our best to leverage the best of Cloudflare while still remaining compliant. So does anyone know where Prya is?

11:03Did anybody watch the World Cup? We had Cabo Verde make it in there somehow, which, can anybody find Cabo Verde on a map?

11:13It's one of the blue dots kind of next to Africa. I'm not going to go with the laser because somebody will get blind or something.

11:21In Cabo Verde, you know what they have? They have tourists. They have a U.S. embassy. They have people that do whatever it is they do on Cabo Verde on a daily basis. They definitely don't have a FedRAMP-Hide data center there. I'm really, really confident that they're not there. But that doesn't sound good. stop people from the state department needing to do functions of how they renewing passports, right? Tourists come in, they predictably lose a passport. The ability to connect to the edge where everybody is has always been Cloudflare's Be close to the world's internet population, make it fast, make it reliable, make it safe, and do it in a compliant fashion. So we're backholing stuff to FedRAMP compliant data centers to do the work.

12:07But being close with... fundamentally believe makes for a better experience for government employees wherever they happen to be um if you're curious we did a thing of the world cup teams something like 98 of world cup teams have a cloud clear data center uh in their home country so we encourage you to start thinking about this like it's not always everybody working from home but what happens when the diaspora happens what happens when people are out in the field and working how do we actually make their lives better and sort of argument that we should do i don't know a gov cloud like anybody knows aws you've heard of them you probably use them somewhere they have you know gov cloud west and gov cloud east does anybody know where gov cloud east is it's in ohio actually which if you're paying careful attention is secretly not in east right that's in like midwest somewhere and because the way they built it a lot of the services are a little bit out of sync with sort of big AWS to the part where you can't take a publicly facing AWS application and deploy directly on GovCloud.

13:13It's not well documented. It doesn't fit real well. They've sort of built theirs, not the way that Jake was describing, right? And so this idea that if we can reuse the common services that people use, it makes it much simpler to take the lessons learned on the commercial side. and bring it to the government side and doing the compliant fast makes sense all right great the other point i wanted to make about how we built this is it's not just that we can leverage all the blue dots for ddos protection and other things that don't require you know decryption or storage but the blue dots and the orange dots are running the same software there isn't they are running the same binaries for retail cloud or for global Cloudflare as FedRAMP Cloudflare.

14:05There isn't a less than, there isn't a fork. They are configured differently. They're running in different physical data centers, but it is the same software released at the same cadence to ensure, I mean, frankly, engineering sanity, but also to ensure that the product is equally capable and it's not a degraded version.

14:27All right, let's dig in a little bit more on the... different service offerings. Cloudflare offers a Class C and a Class D certified solutions. I'll talk about Class C first. Class C is accessed through the dash.cloudflare.com. This is what the global offering is. It's built through this. For compliance, it's primarily driven through entitlements based on getting the Cloudflare for government entitlements, and then configurations that are unlocked underneath that entitlement. This is primarily to be able to do regional services to FedRAMP regions. Within the Global Dash, there's two different region options. They can be used together or independently. There's the FedRAMP US only.

15:13There's the FedRAMP International one. So everything that's outside of CONUS on that map is included in the FedRAMP International. So this is like Japan, Australia, mainly Europe. But those can be used. together. All of those sites are all at FedRAMP Class C certified. We have auditors that go visit many of these sites every year to ensure that they're meeting those high standards. This is what we typically recommend for most customers who come to us and say, I need to use your FedRAMP offering. It's the best fit for Class A to Class C use cases. Traditionally, this would be called moderate impact. As Tom was saying, it does inherit a lot of the global capacity for DDoS, so like any of your zones that are behind this are going to inherit a lot of the firepower that Cloudflare has globally.

15:59But when you have your regional processing, it makes sure that the store of your processing is only done in those FedRAMP sites. That's a key thing to know. We make it a customer configurable option, because in some use cases, a customer may not want to, or like maybe this data isn't a class C, but it's like accessory data. Maybe I don't need to use the region for that, but we recommend that they do. But if you don't, it's fine. Switching gears in the Class D offering. This is our newest offering in the FedRAMP space. It was certified about two, three months ago. It took about two years of working. I basically joined CloudSler to help make sure that this happened, and it was a big achievement.

16:46The notable difference here, and first off, this is on... dash.fed.cloudflare.com it has a different entry point as a different api why does it have that well because one of the biggest hardest requirements for a huge company like us is that it has to be us storage and processing only like cloudflare we use things around the world we store control plane information in multiple regions so we're like how do we solve this for high well that means that we have to set up a separate dash to be able to do this but still be able to serve the same services we possibly can within the government or the global infrastructure. This is best fit for, you know, if you have a class D need, high impact, high assurance, mission critical, national, you know, high national importance workloads.

17:37As Ian was mentioning, one of our biggest customers is, you know, the federal government and they've recently launched America.gov using our high platform. It's been an amazing test of the platform and has exceeded everybody's expectations. I don't, I think everybody and all the cluster people in the room are pretty excited about Can I ask, one of the things we hear a lot of questions about is, is Class D inherently safer than Class C? Shouldn't I just get the highest possible one? Do you have any perspective on that? Yeah, that's a good question. Not really. So, interestingly enough, all the U.S. Ramp sites are the same for moderate, for high, Class D, Class D. These are the same ones. There are different primitives between these things to keep information separate to ensure the control plane information is only in the United States.

18:26But like the edge infrastructure for that U .S., if you selected FedRamp U .S. only, you're using the same edge presence as the high environment. The control plane information stored in the same data centers that are available in the United States. global dash and everything is so it's like we have this high security standard across the board for these things but the key difference is usually this is the thing that drives people to go to high is if do i need u .s storage only and this is guardrail a notable difference here is that like you have those options on the on the commercial dashboard to be able to set things well because it's optional like information is able to be stored Metadata can be scored in a lot of these other edge sites in case you do need to be able to process things at the edge.

19:17But with the high, it's that information, those primitives, your keys, any information is only in the high sites. So it's much tighter controlled within that. So like I said, highest assurance use cases for those ones, it has high availability. Another notable thing is that support-wise, if you put in a smart ticket for the high, you're only going to be getting served by U.S. person support from Cloudflare. With the commercial, it goes through our normal support ticketing process. FedRAMP for Class C doesn't have those requirements of U.S. soil, U.S. persons at all. But we encountered that specifically for the Class C one. And that's the way we've designed it. Makes sense?

20:01So we said how to get started. And I kind of touched on this, but I want to come back to it because this really was... the intent here first of all is you need to figure out is it class c or class d moderate or high i will say for most people and we hear this from commercial companies to say we want the most secure thing we want fed ramp high and we're going hold on a minute why what's your use case like do you really need that so that's a discussion we can have together that's when you come to us the second thing is cloudflare changes a lot like I looked on October 1st, and we'd launched two new products that I'd never heard of before. Didn't know they were coming. There was K2 and Basin. They're both awesome. But the way compliance works, neither one of them is certified today.

20:47So we need to be careful that as we're rolling these things out, there is a lag just between when we release things, because we release things quickly, particularly during things like, have you seen Birthday Week? I don't think I slept, because there was a new blog, a new product, a new way of doing things, a new perspective coming about every 20 minutes or so. And it was one of the ones where I had to use AI to say, I know it's my job to know these things, but I can't keep up. How on earth could a compliance person make sure that all of these things are safe? Okay, so it's, and I think, Jake, you're going to touch on this in a minute, but just making sure you're using stuff that's in the boundary. It's common sense, but our platform changes fast. We don't have a lot of cruft, and so we continue that philosophy. The third thing, you need to tell us that you're doing it because you can buy whatever you want from us.

21:37And functionally, the people that like answer phones will just sell you whatever you ask them for. And so if you don't ask for like the government version of this stuff, you are not going to get the government version. OK. And this happens more than I care to admit. It sounds silly and it sounds like we should just know what people want, but we're not quite there yet. I think the AI machine hasn't hasn't caught up yet. Okay, past that, it's setting up access, setting up IDPs, setting SSOs, deciding, you know, is it US only data processing? Is it ancillary? And you can be in Europe, for example. Those are decisions that you can make. We can make them together. And then there's a small set of things about setting up controls inside the platform. And what I'll tell you is we listed out a lot of things here, regional controls, identity, certificates, firewalls.

22:27product settings. You do not have to memorize this. We have a customer engineering team who exists to make this as easy as humanly possible. That's Johnny and Eric right there. If you have questions of how to do this, oh, and Devin's back there too. Those three are functionally the most knowledgeable people on the planet of how to help customers do this. And what I'll say is don't try and decode it yourself. Just let us know. We'll come sit down and do it with you. We'll figure out if it makes sense. We'll make sure that all the things are in boundary because functionally, this should be easy. Functionally, you should be able to go from zero to an accredited system using the FedRAMP stuff, taking advantage of all the compliance regimes that are in place, and it should make your life simpler and not harder. Right?

23:12And that's kind of a weird thing because usually compliance is like a main drag. We honestly think we can help you go faster.

23:24come find me come find them if you got questions that's literally why we exist

23:32there are a lot of words on this slide I'm not going to go through a lot of them but I did want to have slides up here to show like what are our certified services the Cloudflare GRC and security team is really proud of how many services we were able to bring over the years we've had class c for I don't know four or five years it was a lot of blood sweat and tears to get in the process. As Ian mentioned, we do try to bring in as many of the new GA products as we can. We have to have a process to bring these things in, so we ensure that they're meeting all the federal requirements, they have the right capabilities, they have the right regional service capabilities. Many of these products don't launch with those ones, so we have to make sure that they create those features and that they're also audited by our third -party assessment organization. That includes the PIN test.

24:19Um, they take these things through the ringer and only the ones that are approved to get out on the other side and they get certified. Um, these lists of services, you don't have to memorize them or anything like that. These are all available on the FedRAMP marketplace. You can just go to marketplace.fedramp.gov, I think. And you can look at our listing and we have one listing that combines and try to tell the difference between these ones. Um, let's go to the next one, the class D. There are some differences between these two things. I think what Ian was saying was very important is like when you're trying to plan out, are you using FedRAMP, you want to use FedRAMP, it's like ensuring that you're using services that are available.

24:59One special thing I get to share with you all, only in the room that no one else knows, are upcoming services. These are our new services that are coming up in the next cycle. Notable ones ever under the Class D are Workers AI and AI Gateway.

25:20disclaimer at the bottom these are all pending approval but these are the ones that we're going through with right now they're well along their way like i said we're in the audit um and i think