FedRAMP 20x Community Update

All righty. Looks like we're at the top of the hour. Uh Lucky, do you want to go ahead and kick us off? >> Yeah, sure. So, yeah, welcome everybody to our uh Fed Ram 20X update for September. Uh next slide, please sash. So, we are recording today's meeting and uh we'll make it publicly available. A link uh to the video will be posted on our Fedram YouTube page within two business days. Uh next slide Sasha. So uh I'm going to read through our legal uh disclaimer. So we we are communicating today in our official capacity on behalf of Fedramp at the General Services Administration. We hold these uh meetings to enhance transparency between industry and FedRAM so that we can open a dialogue and share new developments. Nothing that we share constitutes uh business advice and any reference in this conversation to any specific commercial product or the use of any corporation name is for the information and convenience of the public and does not constitute endorsement recommendation or favoring by GSA. Next slide. So uh please use the Q&A uh function to submit questions during the meeting. Click the waffle icon in the lower right uh hand corner and enter your questions. So we'll be addressing those questions as uh time permits. Next slides. Here is today's agenda. it differs slightly from the previous one uh where we discussed all the classes provided uh submission guidance and shared the tips for a smooth process. So today uh we will hear from our CSPs about their class A experience after uh completing the process and achieving certification. Uh next slide. So, I'm handing uh handing it over to Emu and John who will welcome our CSPs and dive into their class A experience. Back to you, Emu. All righty. Thank you so much, Lucky. Um, all right. Uh, next slide, Sasha. So, what we're going to go ahead and do is we're going to hand it over to our cloud service providers who are uh Fed Ramp 20X class A certified uh to kind of give a little introduction of themselves where they're from and then we're going to get into asking kind of some top level questions um from us uh and then open it up to Q&A from the audience. Uh the Q&A today will be focused primarily on or focused entirely on, you know, their experience, class A submissions, things like that. Um any questions that are outside of those, we're we're just not going to be responding to today. Um all righty. Uh so Sasha, go ahead and cut the slides and let's start with uh Sean. Can you introduce yourself and your organization? Hello, my name is Sean Smith. I uh work for files.com. We are a um relatively small company between uh 60 some odd employees today, could be 70 next week. Um been around since 2012 actually uh with our platform. Um and I am the siso for files.com, but in a company that small, you wear multiple hats. So I also run the compliance team. Uh, so I was very heavily involved in putting all of this together. In fact, I did most of the leg work. >> All righty. Thank you so much. Uh, I'm going to pass it over to uh, Juan and Alyssa. >> Well, nice to meet everybody. Uh, my name is Juan Rio House. Along here is Alyssa Life right here. She their security compliance analyst. So, similar to you, Sean, we are a small organization. We're less than 100 people. Uh VO uh Bland AI is a voice based um AI platform, an AI voice platform and um and throughout this process um our security team is really Alyssa does everything for security and compliance. So she was she spearheaded this entire this entire piece um along with just the support of myself and um and we because it was actually pretty incredible seeing how I went through it years ago with R5 with Rackspace and see what it is now today. >> All righty. Uh John, do you want to kick us off with our first question? >> Sure. And if you guys want to use the raise hand function to whoever wants to go first, we'll kind of key in on that and uh we can get started. So first question, so I guess roughly how long did it take you to put together your class A package and what was the most timeconsuming part to develop? Um, I would say for bland probably took us a little over a month for the whole class A package. Um, pretty much as soon as the rules were released, we started working and then we submitted to the pipeline as soon as it was open. So that whole time was pretty much just dedicated entirely to class A. Um I would say the most like challenging part we were thinking about Fed ramp for a few months before that working with um Vanta who had done the pilot 20X program and I guess when we saw the rule set it looked pretty different from Vanta's experience. So I think how we had prepared oursel ended up being different from how we were actually going to implement the rule set. So really like just like making those changes and like going back and aligning what work we had done with what the actual rule set was was probably the biggest thing >> any other takers. >> This this is Sean. So um it took us 32 days from the time I found out about the the release because it was released on July 4th. I get in the morning of July 6, Monday morning. Uh, and our company mo is mostly remote. So, I am in New Mexico. So, I was getting emails at 7 a.m. from the CEO who had already gotten through his email. Um, and like, hey, they just released this and let's have a quick talk, excuse me. Took two minutes and the conversation was, can you get this done by August the 3? And I'm like, yes, good. Do it. Period. Um the hardest part I ran into um was not knowing the exact prerequisites that needed to be done in the proper order. Um I was you know starting doing the I always I say everything now is human readable and machine readable. I was going through all the the human readable uh rules trying to ingest them all and everything and I caught a couple things and got those started right away. Uh the big thing I missed was getting our marketplace listing from GSA for for Fed Ramp and that took a little bit of time. Uh otherwise we would have been sub or we would have submitted on August 3rd. Instead we got our submission in on August the 7th. So instead of a Monday we got it in on a Friday. Um lots of things to go through. I was a heavily user of AI since it was me myself and I putting all this together. Um, just as Alyssa said, that was my primary job for 32 days. And so, um, it was it was a heavy thing and and I creating my Claude project and changing focus middle there's lots of lessons learned there to pass along. >> You know, you know, I could expand also and Sean, everything you're talking about and listen, we we live through it is very relatable, but one thing also is um the there's a little bit of ambiguity. It feels like there's direction but then it's but it's it's built on interpretation and there is no knowledge base you can go refer to or anything you can go look at. So as the rules change there's interpretation where Alysa and myself like we were talking about it and we interpreted in a certain way and we said I believe this is the right way that we would that we should be looking at it. I think that's probably that was probably the time that was most consuming throughout this entire process. I would dovetail with that. The biggest lessons learned was I started focusing on just the class A rule set. You need to start with the entire rule set because some of the reporting requirements changed as I looked at the entire rule set versus just the class A rule set. Um, that was a big lessons learned and changed a lot of the focus and the way I was preparing everything for the submission. >> All righty. So, next question. uh what resources were the most helpful as far as you know whether it's the rules uh you know the schemas the videos like where did you look for guidance and what did what you know what was the more most helpful for you >> I would say just absolutely the rule set um at the end of the day everything that needs to be done is written there um and I think like that is the standard to which you should evaluate your implementation of the rules is what is written in the rules. Um and I think like maybe some of the hang-up that we were initially having just like working with like we use Vanta for our GRC platform and like working with their interpretation of previous pilot rules was a bit confusing for us. And so I think like the best resource you have is to just look at the actual rule set and read it and really understand it and ingest it versus like trying to look for external resources since a lot of what was done before doesn't necessarily line up. >> Yeah, I would dovetail on what Alyssa said. So, I used the videos and the human readable forms of the rule sets on the Fed Ramp website. And once I decided to engage Claude, um the GitHub repo has a JSON file, excuse me, a machine readable file for all of the rule sets, also all of the schemas, everything that you would need to get uh in our case, we use Claude as the AI uh engine to do this with was able to ingest those like that. Um that was a tremendous tremendous help then for me to try to literally read through what is it 153 156 rules total uh and try and read through them and and start writing stuff down on the yellow legal pad because I'm that old. Um that that GitHub repo is like a very very critical resource but everything else that was available through the Fed ramp website I engaged in in one form or fashion. Um, we also had never had a GRC platform. I had to immediately engage to get a trust center and we also happened to have chosen Vanta um for multiple reasons but getting a trust center RFP done in three days purchased and built out in two days was a massive um undertaking as well. Uh, so I have to, you know, kind of give a shout out to Vanta because they helped us get our trust center implemented in a very quick fashion, which is one of the blockers. If you don't have a trust center, don't bother submitting. All righty. And it seems like uh in some of the Q&A's coming in, they're specifically about a lot of like kind of trust centers. Did you build? Did you buy? Uh anything else you want to say about your trust center? Uh you know while we're kind of on that subject. >> Uh so we did not have one, right? We are a software company. We're software as a service company. And so we immediately uh I engaged my engineering department. Um, and we had sat down and we looked at them and in about a half hour um just looked at the CEO and said, "I need a check." And so this was all done on July the 7th on that Monday when this was released. We had all these communications. I put out an RFP to any of the major trust center vendors. Um, that f or that Monday afternoon. We had our trust center. We had all of our meetings. We had our RFP responses backed by that Thursday, Thursday night made a decision. Again, we chose Vanta for multiple reasons. Um, but their trust center was there and then we were able to turn on, you know, legal get through everything. Contracts get signed on Friday. Monday, they did their setup for us. Tuesday, I had the meeting with the implementation engineer and I spent about 10 hours on Tuesday going through getting it set, getting stuff uploaded, getting it branded, everything else. And we were able to turn up our trust center in that that quick amount of time. Um, I I I have actually have a list here of things that you need to work on right now. If you do not have a trust center, go do an RFP. Look at the trust center products. See which company works for your organization. Get it in place and get that built. Now, I will also say one caveat. You know, because we released our trust center, we have thousands and thousands and thousands of customers. Literally one hour after the trust center going live, I started getting requests from customers for access to the trust center. We had customers accessing the trust center weeks before we ever did our fed ramp submission. So if if you do not have a trust center product right now, 100% immediately turn get approval for it, get the budget for it, go do your RFP and get a vendor in place because you cannot move forward without that trust center in place. >> You know what our our experience was um slightly different. We are using Vanta also um but we started back in March. We moved vendors and went to Vant. It was pretty much an overnight decision and we started building and we started going through and redoing our entire sock 2 type 2 with the five TSC's. We did it through Vant and we immediately went to ISO 27,01 and we did it through Vant. So we're very familiar with it and did a fantastic job really organizing it well and structuring a point that it really becomes our source of fact. And as we were going through that that we also then extended to Feder and we started getting familiar with um just the overall modules. Um and as we went through the process um being an AI company we also found certain limitations even as you go through evids collection something so simple as um we couldn't uh we couldn't send uh we couldn't um download or save YAML files into into the trust center. that became a challenge that where we we were Alyssa literally create had to create PDFs for each of the evidence pieces to send back. So as we went through this we're also providing um feedback loop uh features and functionality that we need in the future and we had it so much so that our trust center partner along even with auditors we're asking well what should we be doing like instead of that we I was asking them there asking us about how should we go about doing that just because I think we stress tested the heck out of the system and just the overall process >> and to build off of uh what Juan and Sean are sort of saying I would also recommend like if CSP already has a trust center separating your trust centers. Um we have one trust center that's for our commercial product where we put our sock 2 reports and we put like our commercial policies um stuff that we post for ISO 27,0001 and then we have a separate Fed ramp trust center where we do replicate a lot of those policies and then we also have posted everything that we need for our certification package there and that has really helped us with sort of making sure that we're able to keep requests from certain types of clients different because we don't necessarily need to expose everything in our certification package to a commercial client when really that is intended for federal agencies. >> Yeah. Uh our company we have a a literally a philosophy of being as open and transparent as possible. We did have that discussion and it was no we want one trust center for everyone to see everything including our submissions because we're as open as we can possibly be. So our existing customers, potential customers can see everything we submitted. Again, that was our company philosophy and we chose that because it fit our organization. >> All right, John, you want to take on to the next question? Yeah. So, next question. What was the most challenging uh aspect or part of assembling your package? Like what required the most thought or or critical thinking? >> You know what? on the package. It it it isn't so much on the compliance package. I think it was more on the execution of the engineering activities associated with that package. I think that that because it was like Alysa said, rules were very clear. It's straightforward. There was there was interpretation, but the the challenging part was then translating that to all the engineering activities that we needed to go do to comply with that. So, I think that was probably the most challenging piece. And Alysa Cor expand on that please. Yeah, absolutely. I think like the actual engineering implementation of what we needed to do um and making changes, we've built a separate instance of bland to be our government offering versus just offering our commercial product and I think that was a massive lift for our engineering team. Um which they did an amazing job, but that was definitely the most challenging part as far as that goes. And for us, we, you know, our we have eight regions throughout the entire world that we do, you know, manage file transfer, moving files around, letting companies move files in and out wherever they want to, source, destination, all those things. Um so we actually built into our existing product uh we call it a fed ramp mode and you literally when you go into our product as the administrator of the you know the master administrator of the product you can set check fed ramp mode and it enforces all of the you know high level encryption data data residency in the United States only the technical requirements that were needed. I was lucky because we also have a HIPPA mode in our system that was almost identical. So our engineering uplift wasn't but just two days to do all this. Um I will mention Alyssa you guys built out a separate platform. We actually had that conversation about six months ago on whether to do this under the FedRE 5 rules and decided we were not. Um it was it would be very very cost prohibitive for us to uh be able to do that to create another whole region set up. We use Amazon or AWS as our our back end. We've been building AWS since 2012. So to do that would have been about, you know, a million dollars a year spend and we made the determination that wasn't appropriate and then 20x came along and all of a sudden AWS storage is 20x compatible and all the storage we're using and so it was like well then we just turned rent mode on click it you're hardcoded people cannot use insecure ciphers or you know um data residency even the data transfer goes through United States, we for enforced all those rules. So we were able to do our engineering because we had already been down this path with our HIPPA or HIPPA uh settings in that. So that was a relatively easy uplift for us. But that's because the harder work had been done before for HIPPA. But again, our organization was we made a conscious decision. Our product contains everything it needs to do. We didn't want to create a separate complete cloud uh just for Fed RAM. All righty. So uh final uh question from us uh and then we'll jump into the audience uh Q&A but um how was your overall experience um you know putting it together communicating with us you know certification report like just kind of going through the process uh you know give give us your your your advice you know commiserate with us you know like what how how was the experience for you you know, going going through like I said earlier when I when we first started the call, I went through the entire R5 process when I was with uh Rackspace at the time, like when I was a CIO there. >> Sure. >> And seeing what that was before versus what it is now, I found that one, it there even though there's it's more prescriptive guidance, there's some interpretation, but it was more prescriptive. Secondly, the level of communication and feedback was unprecedented. I had not seen that. And that was fantastic because it really showed a partnership and a dedication to really helping helping um CSPs like our like ourselves really improve and giving guidance like you know what look at it this way or try to do that. And that was um first of all I was very appreciative but it was really helpful that the entire process the communication was almost daily to the point that it felt like we were iterating in a true partnership and the the ability to do the I would say the continuous monitoring and the evidence collection going through that process knowing what it was going for an entire 18 months to get to that point to doing it in less than 30 days is incredible. So, for me, the experience has been fantastic. And, um, Elysa, how about you? >> Yeah, I would definitely just second all of that. Um, I feel like it was really great. Like, as long as we responded quickly, Fed Ramp would respond quickly and we could just sort of have an email back and forth and we could adjust our package as needed. um if there were small changes to implement, we could just do that, respond to the email six hours later being like it's done and the next day we would be moving past that. Uh which is just really wonderful, especially considering that this is a brand new rule set and maybe there are some things that are going to get missed on the first go round at doing certifications. So, >> so my experience I sort of break into two parts. It was the getting the submission ready part and then the postsubmission part. Um, I'll cover the postsubmission first because that was the easiest. Once we submitted, we submitted on Friday afternoon, Monday morning. I believe Alicia, you actually were the first one that requested access to our trust center. A couple days later, everybody else did. And I actually monitor the activity in trust center to see what was going on. And it was consistent day in and day out. There were things being pulled, obviously, things being reviewed. Um, we I think I only got one or two questions back. Um, and we were able to flip those around right away. Uh, and and get those back. And then magically on the 26th there was an email. Actually the 25th I had received I believe an email from you Alicia to our notification email u requesting to test it to make sure it would work and you know monitoring that flipping it right around and turning that around. And then the 26th we got the letter and um right then it was like it could breathe just for a minute. um putting the the the entire package together. I've got kind sort of a list of of things you need to focus on. Um number one, you have to have a good sock 2 report. We've been doing sock 2 since 2019, 2020, excuse me, was the first audit and we've always had a clean sock report. We've never had any findings to address or anything. So having a good SOCK 2 report is a key critical component. I I I explained that's the foundation that this is built on. So if you've got a SOCK 2 report that has maybe a some findings on it, you may want to go ahead and pull another audit quicker if you need to do this quicker, but you really want a good sock 2 report. It's the base of everything. The other lessons learned, trust center. Go get a trust center right now. If I can leave you with a couple things, start on getting your trust center in and set up right now. The second thing you need to get your FedRP marketplace listing submitted for your ueI number that you need first to do the the marketplace listing is essentially you get it immediately on the site. The marketplace listing takes a couple weeks to process through. Um, just a note, the email that comes from that marketplace listing has a link that tells you where your marketplace listing is. And for 48 hours, it kept 404ing because the link is bad. You go to the marketplace listing and look up your name of your organization to find the valid one. That gave that was a two-day delay or it had been submitted on the 7th, excuse me, the 5th instead of the 7th. Um the there is a requirement for a Fed rent notification email that has timings that you must reply to. You need to work with your engineering team to get that flow in place and figuring out how it will be monitored. We are heavy users of pager duty. So we've run ours through pager duty and I literally get a page every time we get one of these. Um, it's annoying because we're getting marketing emails to there first, but when someone submits to the our fed rent notifications at files.com email, we get triggered immediately. So, we can respond immediately. There are time frames in some of these notification emails down the road that it literally says if you've got 24 hours, you have to respond in 24 hours. So, we need to do that. Um, the engineering changes that are going to be required for your particular product or platform. Ours was relatively easy because we had something in place. But the engineering time that you're going to be required to spend may take your organization short amount of time, could take it longer amount of time. That is completely up to the platform or the product that you have. But you need to start looking at those now. Those are sort of the pre-erequisites that you have. Also note you need a web server that can serve up JSON files and cores or the cross origin resource sharing uh capable web server because there are some public files the public JSON file for your public fed RAM page that needs to be available. They have to pull off a course enabled web server. Um we had to make a little change on ours for that piece. the Fed ramp 20. Putting this together, I started with the Fed ramp just class A rules in human readable format. Decided I wanted to put together a claude project. Took me a couple days to do I set it to the website to the human readable form and it was modifying those and then I realized a couple days later that those rule sets are available on GitHub in JSON format. If you're using an automated tool like I did, pick your AI engine. We just happen to use Claude a lot. Um, point it to that rule set and have it as your master. These are the master things you work from. Going through using that, being able to pull the the uh schema JSONs that needed to be there for all the other files. I could get things put together, figure everything out. But one of the most important things I did is um because I'm also security background. I'm a siso as well. I I put in what I call fuzz testing. So I turned it when I thought everything was ready to go and I made our claude project look at it from an assessor point of view uh or fuzz testing, negative testing is what we call it in security. and it found a lot of things that needed better explanation and a lot of things that could be open to interpretation because that weren't documented correctly. I would highly suggest if you're using an automated tool to give it sort of the look at it from an assessor's point of view, not from your point of view because it found a lot of things that made our submission a lot better and a lot clearer when it actually occurred. Um that by the way that claude project I have built so it's now being used that we're starting down class B already. Um that I'm able to continue with that project and just keep moving forward. Um I don't you know we don't have a lot of staff and literally it was me myself and I putting this together with some assistance from engineering and other teams but so the automated tool worked for me. Everybody can pick however they choose to do so. Um, but the rule sets using the master rule set for everything because there are some requirements that report one this way. Well, really it needs to be reported that way and different. So I built it so it could be used going forward. Having those master rule sets in place so it knew everything was a big big big key. >> You know what? If I can just one last thing on that on that note. Um that rule set that that Sean was talking about, that's actually what helped us out. We submitted yesterday for class C. So everything that we had and everything that we learned from class A was transferable for class C. So it made that entire process go a lot smoother. >> 100%. >> All righty. Well, let's start picking out some uh questions from the audience. Um, let's see. Uh, Sasha, do you w to pull one and then pass it over to Lucky and then we'll like >> Yeah, let me look at the ones that are popular. Okay, so the first one I see here is, "Have conversations with potential government customers changed since getting class A certification?" >> Yes, they have. Um right now we are working with um we're we're working actively with a couple of um uh key agencies um that um that looked at that found some interest because we had some conversations initially they said you really have to get Fed ramp certified. So now we can actually have those conversations and it's actually progressing. So yes, we are definitely seeing traction as a result of this. >> And on our side, we have some existing customers that also deal directly with the federal government and they've been able to use us on their commercial side but not in the government side. Um so those conversations have started taking place as well. And any new customers we we've always been any government agency is immediate blocker. No, you're not Fed Ramp certified. They just move on. Now that's been taken away and all of a sudden we're starting to see prospects come up. Um you know our sales and marketing folks were the probably the most ecstatic to see the certification occur. Um so yeah we've been able to actually get actively engaged with existing and future customers. >> Uh I can read the next one. So there's a question in the chat. Uh have any of you built any of the optional KSI automation for class A? If so, are you using a specific platform or building it internally? >> Um as far as that goes, since we have submitted our class C certification, we're primarily leveraging Vanta um and then as needed internal KSI indicators sort of within AWS or within our code. Um, but Vanta has been pretty much our biggest help. I think they are still working to get the rule set to the point like their framework and their interpretation of the rule set to an absolutely perfect point. I think like they have maybe a little bit of work to do just because they are also just saw the rule set for the first time a couple of months ago. But I think that we've really been able to leverage it and we've gone in and changed their framework and customized it and really made it work for us. Um, so that would be my recommendation is Vanta, but I think that there are plenty of ways to do it as well with internal automation tools. >> From our side, right, I'm lucky. We are a software company and I have a team of about 40 engineers to lean on. Uh our product is API based and then we build a you know interface on top of that. So we are used to inter interfacing with everybody's APIs. So I have an engineering team that can build this. One of the reasons we selected Vanta was the ability to provide the evidence in the format that's needed with dashboards that's needed. um with that evidence and they are API based so we can actually build I I mean our folks can build something in two hours that can get can push the other advantage that we have we collect all this information now so all of the we use all of these for dashboards internal we're gathering all this information already it's literally just pushing it out to Bant um on a consistent basis so it's constantly upgraded uh That is the next phase of where we're going down. Again, we literally get it in flam, get it in to get trust center in place. Um, the next thing I turn to is finding a 3PAO assessor because our previous assessor decided not to do Fed ramp and so we have to change auditing firms. Um, so I'm working on that right now. We just finished that RFP to start down our class B and then it's immediately going to be okay. Now let's start putting the um KSI pieces out. The one thing that Claude did let me know because it's able to see some of our internal things that about I think there's 27 other KSIs above class A that we already have you know that we we um cover already without making any changes to our systems as needed or any more evidence gathering as needed. So we're it did let me know that we are well ahead of you know we're not starting from scratch to go from the you know class A requirements to class B and all these additional KSIS coming. Uh so that was a a big help but having the platform the full GRC platform for us was a an advantage. uh you know, Alyssa and those folks are already farther ahead in their process with Bant than we are, but we're going to go down the exact same road that you are. I'm just lucky I have an engineering team I can lean on to get stuff done. >> John, do you want to take the next? >> Yeah, looks like we're getting some interest around this question. Uh what were your most least favorite rule sets to implement and why? If you need a few minutes, no worries. >> Alisa is thinking hard. [laughter] >> Gosh. Um, it's a hard question. I feel like probably least favorite I would lean towards the training ones. Um, we're a younger company implementing some of those trainings. It gets difficult when you're chasing down your co-workers who are in their early 20s and very focused on building code and pushing changes to our software versus taking couple hours out of their day to do training. So really did a lot of hunting down of people um for that KSI. Uh as far as favorite ones, um I like the rule sets a lot like less of the KSIs and more of like the actual rules. Um, I found like they're like very like simple and like easy to apply and be like, "Okay, like checking off that box, checking off that box, like I don't know, creating an SDR, doing things like that." Um, it's just like a bit less convoluted than the KSIs, which sort of like link all together. Uh, but yeah, I don't know. Each one was sort of a challenge in and of itself. So >> for us it's it was different things like training we've been doing for six years. I've been fish testing everyone monthly for six years. So we you know we have a lot of that stuff already in place. Um it was the way we're collecting some information. So you know we have an incident management team. We run incidents all the time. Anything that we get an alert on our systems that customers never know about we engage the incident process regardless. Uh but we've never had a security or confidentiality incident. Um it's always been availability, but recording some specific information to do on the OCR reporting for incidents. I've got, you know, had to modify what we're collecting and our postmortem process and things like that. Um again, for us, training was a straightforward one. I already got this. Click check next. Um, but some of the things that we're actually doing and doing well, we're not collecting all the information that Fed Ramp and the rules need. And just like Alyssa says, rules are everything. If you follow the rules, you'll be okay. If you try and go off on a weird interpretation of the rules, you might get yourself in trouble. Um, following the rule set and what they're asking for is your best friend. >> Yeah. Yeah, to build off that as well, I think because we are AI first and we really leverage like a lot of these autonomous requirements that are already being asked of within Fed Ramp, I think we like had a lot of advantage there to sort of build off of like the way that we're already doing our instant response and vulnerability detection and that type of thing and we're already leveraging like AI tools to do monitoring of things continuously. like it's really just like building up the systems just to meet the requirement that we're already not far off of. So, >> all righty. Uh here's one. Uh what was your driver for getting a class A? Was this to support a specific agency requirement or was this to proactively get on the marketplace to attract future agency customers? And then uh if the latter has being class a res certified resulted in a new business. I >> I would say both. I think there was an impetus that we started having some of our commercial customers ask about these capabilities. Um and then secondly um there was interest um from other agencies um with asking if we were if we were certified. So that really is what prompted us to go do it. And like I said, we went from doing an entire new sock 2 with five TSC's to ISO 27,01. Uh our platform is GDPR and HIPPA compliant because we didn't store any we didn't train our models in any data. So we just naturally got a lot of interest and as we were going through the process we started letting those prospects that reached out know that we're going through that and because of the updates that we would get with uh FedRAM that's really what helped us out and right now we are in the I believe the builtin cyber security summit talking about how we have the FedRAM class A and there's been a lot of interest already and we are um also talking to a couple agencies where there's a potential pilot um going get a start in shorter order. So yes, it has led some new business >> on our side. Um we've actually been looking at Fed Ramp since 2022 and under the old rule set, it it would essentially especially with having to have GovCloud backend for everything would require us to have about a million dollars spend a year to build a separate cloud. Uh I'll give you a perfect example. So if you have to have fed ramp certified cryptographic modules, so you know whether it's Golang or pick your cryptographic module, the certification process for Fed ramp is there are several versions behind what's out today. We don't do that. As soon as a a bug or more importantly a security vulnerability is found in one of our cryptographic modules, we're updating it immediately. Uh so we're well ahead of the ex you know the certifi the fed ramp certified cryptographic module. Um and so you you've got a plan for those kind of things or were a little different. We have existing customer base that has talked to us. Um but we actually were actively engaged with a very large federal agency um very very large federal agency a year ago and we worked with them for three months to see exactly what the requirements were, what the contract capabilities were and they made a decision at that time that they weren't going to do that. um they weren't not just with us, they were going to sort of the project they had in mind they were going to pull back from um with all the the budgetary changes. So we had been actively engaged in going down the old version. Um and then we had you know with the the 20x release on July 4th was like oh wow this is quick and well it's not quick and easy but it we've got the needed things we can do to get this. Um, we have existing customers again who have a government arm and a commercial arm. Commercial arms been using it. The customers are like, "Man, we would love to be able to use this in our federal arm, but we can't because you're not Fed ramp." So, we've engaged actively engaged with existing customers. Um, and our sales and marketing team is like, "Okay, now we're going to go out and start talking to all the government entities as well." So we actively have new uh business expanding uh existing contract businesses to start to go in with this as well. So our ROI on this is going to be covered very very very quickly uh with this. >> All right, Sasha, you want to take the next? >> Sure. Um this one seems to have a lot of traction. Uh what were the major cost categories? For example, assessment audit costs, GRC tooling, outside consulting, engineering effort, or internal staff time. Did having an existing SOCK 2 type 2 or other security/compliance work significantly reduce the incremental effort or cost? >> Yeah, I would say definitely having existing stock too important. Um and reduce that overall cost. I think like obviously like there were like the cost of an assessor and the cost of our GRC tooling, but probably like the biggest internal cost was just time um with myself and the engineering team dedicated just a lot of work to this. Um so I would say that was probably like our main like cost within our company. Um those outside costs of like the assessor and GRC tooling are relatively small especially since we are already leveraging Vanta. So >> and I think and I think even on on that front in total as we were going through this process um it was really four of us four of us um constantly involved and there's two engineers u one platform engineer and then Alyssa and between themselves like they're they're the ones that created a brand new architecture and shippered this all the way through. So if I look at that was our biggest cost but if I look at if I look at the short amount of time it was fairly inexpensive >> from our standpoint actual spend right we needed to go get our trust center so you know there was a contract with Bant the three-year contract for that um the other capital outlay is you know we've having to switch to 3PAO uh assessor to go from class A to class B so we're just going through that we're changing assessors. Um, we already had our sock 2 and had a consistent sock 2. And matter of fact, our our sock 2 report is from May. So, we had a a very new sock report already done that we were able to use. So, that's already money that has been invested year over year over year. So, we didn't really count that piece. Um, probably, you know, internal resources. I think there were six engineers that took them about a day and a half to get our Fed ramp. uh section put in place uh um fed rent mode we call it put in place uh you know our leadership team was involved, legal was involved, our finance team was involved, engineering and myself but since I did all the work myself I was heavily dependent upon using claude to help with there was significant cla expense with that project. I think the bill for that's coming out right around nine grand uh to build that. So Claude was a very good help. Um helped me pull this off, but there is an expense to that. So you just need to be aware of that. Um, we were able to do this with outside assess outside assessors because I was able to link claw directly to the rule set and go down there and I've been doing some sort of sock assessment since 2014. So, um, I've got kind of a background in that as well as cyber security. Good thing working for small companies, you get to learn a lot. Um, so but there are expenses. Now what those are to your organization, you have to look at that and see. Uh you may already have the GRC tool in place, you know, like Bland AI does. We had to go buy one. You may have to buy one or leverage one or change one engineering time. Uh if you're going to use an outside uh firm to help you, you know, shepherd you through the process, you need to look at what fits your organization. But there is cost to this uh along with internal time costs if you want to track those. >> Lucky, do you want to take the next? >> Yeah, sure. So, uh I have one. Uh if you had to do it over again, would you go towards uh class A first and transition or would you go directly to a higher class B or C first? >> Well, absolutely. start class A. I think that was that's probably the best thing that we could have done. I've heard from a lot of the auditors a lot of companies were waiting and they wanted to jump to class C, but in class A you learn so much. Um, and the process was was really easy that that's what really catapulted us to go to class C because we had a really good foundation. So, I'd recommend anybody to start your class A just given that it will it will show you what you need to go do. It prepares you and gets you ready for any of the future certifications. >> Yes, from our standpoint, class A is was remove the block for us to be able to do business with the federal government. Uh so us getting this and getting it as quick as possible was an enabler for our organization to go start doing business. And just as you you guys have said, start at class A because that sets your foundation to build and to go, you know, we're going to go to class B right away and get this done before the end of the year. Uh, and get that submission put in and be able to go bang bang bang bang and then we go we're going to take a pause and decide whether we need to go to class C or not. Um, it requires some storage changes on our back end to do that to make sure that we're using the right Amazon uh setting or storage level that is class C certified. So, um, but class A, it's the it's think of it as a a do row of dominoes. Kick that first domino over with class A and then start following them. >> John, >> yeah, looks like we're kind of winding down the list here, but this is a good one. Um has or how has the certification improved your existing business andor security uh processes? >> I think on our end it's definitely sort of improved a lot our how just how we sell to government agencies and the fact that we're able to sell them at all. I think it just before this working with a government agency was kind of just a no-go which I feel like it's been said. Um, and now I think that our sales team has opened up a lot of possibilities. We're getting a lot of really good leads. Um, and looking forward to being able to work with federal agencies. So, >> yes, from our side, it took the the blocker away and that we were able to, you know, we've had this now. So, the 26th to the 9th, I think we're at two weeks that it's there. It took the block away for us to be able to work both, you know, with directly with federal government, but our sales team has immediately gone back out and engaged our existing customer base that they know has asked us for Fed Ramp certification to move to their federal arm of of their business to be able to use us. So our marketing team is going hot and heavy for new business and letting everybody know that hey we are now here um with a Fed ramp certification but our sales team are already actively engaged with existing customers large customers in fact um that had been asking us for this for a while now so it is a business enabler from us from either side now from the security standpoint I'm lucky or I'm not lucky I interviewed the CEO kind of before I took the job. Um, our CEO is a security engineer and built this platform in 2012 and so I work for somebody that has built it from security out. I'm also the SISO. So every time I do anything in the organization that we have done for SOCK 2 for five plus years now has all been done for a security focus. Um, so I've got that advantage where we have everything as security focused to start with. If you don't, yes, there are going to be some security changes that are required for you um to work with going forward. So, you're going to have to do your gap analysis, right? Everything comes back to gap analysis. Do your gap analysis once you get the rule set. Okay, here's the security things we need to address, right? that that dubtales into your engineering uh work that needs to get accomplished for your your product or platform as well. >> You know, if I could expand on that. I mean uh for us one of the biggest uh contributors that Fed RAM has enabled is to dramatically improve our security posture. Our company started just a few years ago and it's an AI company. It's always break things, move fast and kind of just going through that that startup culture. So this has actually allowed us to think about things having the non-negotiables in place from a security from a security perspective and and it and everything that we do now it's um it's securitydriven design um and compliance driven design. So, it really has allowed us to think in a different light than what we've had before. And I think that's one of the best things that could have happened cuz indirectly you all have pushed us to be a better and a stronger company with a with a very solid secure and compliance program. All righty. So, we're about five minutes left. I see Pete is popping in. Do you have a question? Do you have words? >> I have words. I [laughter] feel like uh all the ribbing I'm getting here in the room, I need to clarify that I have not sent anyone in in this uh meeting today any personal checks, swag, or guarantees of future service for all of the fantastic things that that you've been saying and sharing your experience. Um you know this is class A is very different. It's a it's a very different approach uh to to the entire concept. the idea of Feder acting as a bridge between industry and you know commercial best practices for security and government expectations has has been encoded in OM memorandum M2415 that directed us to pursue this path and I am going to admit that when I first started as the Feder director just a smidge over two years ago I had intense arguments with a lot of folks about the viability of reciprocity with external security frameworks. Um, and we spent a lot of time as well researching that and testing it out. And it was difficult for us to come to the the conclusion that reciprocity with an external security framework was never going to be a thing that we were comfortable doing. Like we could not simply say that because you have this you can have a Feder certification. But that process brought us to where we could realize that a lowrisk better certification could be given out based on a summary and a mapping of that information and sort of a commitment to down the road increasing your assurance levels in a way that federal uh uh purchasers are more likely and more commonly expecting. So, it's just been super super fascinating and fun hearing you. Everything that you said about this experience is accurate, right? Like we we put out some simple rules and said, "Let's see what happens." You know, it was it's not a concierge process with like all the details and everything, right? This is brand new. And and the arguments, the gentle arguments that I had with my team repeatedly about, you know, let's not overspec it. We can't overspec it. it's confusing. It's okay. We'll we'll make it less confusing later. But for now, it's more important to enable people to come up with innovative ideas. Uh seeing you do that has been amazing. Seeing others coming into our pipeline with that has been amazing. Um we have also seen people come into our pipeline that are not amazing that are that that did not take time to actually read through all the rules and look through this stuff. And so, you know, Sean, you were talking about uh using Agentic AI to help you kind of work through the requirements, their processes. We designed this from the ground up. That's the value of having these explicit standalone rules of having the JSON data, the underlying machine readability and all that. Uh it's so different from even just trying to get an agent to read through a bunch of PDFs to find rules. >> Yeah. So we are [sighs] it was just really great for me to hear your perspectives and your part participation in the process that like this is exactly what we expected some of would happen. Pros and cons we have a lot of things to do on our side to improve this for other people um going forward and we'll keep doing that iteratively. Our team is as you said the team is incredible. They are responsive. They are thoughtful. We are working as much as we can to put through this. Uh my single largest like hope for success is that there will come a point where we will be so overwhelmed that we will not be able to offer people the level of support that we have offered you. Um and hopefully we can grow in response to that so that everyone can have this experience. But for today, >> but I can tell you where I went going through the R5 and what it was before to this. I I've seen it before and after and it's incredible what you all have done. Like this is just like I kind of wish I wish I had this like five years ago, but like it's it's gone now. And like for example like Alyssa and the team it's a we have a small team and when we t when we thought about this said my only experience comes from R5 and it was overwhelming it's a ton of time and going through this we're like wow like this is really clear like really crisp and then we started going through the communication the submission like you all just made it really easy that's what gave us confidence for clans >> it's amazing I mean two years ago I when we announced Fed ramp 20x one of the core things was that we wanted to be able to deliver a low impact certification for less than a week and less than $5,000 of effort. We still got a lot to do to get that under a week and under $5,000, but like we are close on this class A and it is going to be that way in a year, I think, when when we have everything nailed down, people know the process and can go through it and it's super exciting. Thank you for being uh a builder in this space. Thank you for leading the way. Thank you for demonstrating and sharing your experience with others. I hope that for people >> This meeting is being recorded. >> Uh for people on the call, you'd consider reaching out uh to to these folks and maybe asking them to show you what they've done and get access to their stuff if they're willing to share so that you can learn a little bit here and there. Uh as a final riner, not an endorsement of any company. I don't know anything about what any of these companies do, but man, did we love the way that they approached their Better Amp certification. So, keep at it. And for all of the rest of you, sorry we didn't get a long Q&A, but very soon, next week we're gonna have our assessors community update, which we have not even put on our calendar yet. So keep your Wednesday free. Otherwise, again, thanks everyone. We'll see you all soon. >> Thank you.