Coalfire Public Sector, a Division of Coalfire Systems: Fueling the Dreams of Federal Authorization

“We thought FedRAMP would grow to be something big. So we pulled together a team based in different cities to address what we thought was a growing trend in federal cloud security. This required the knowledge and experience to educate commercial cloud providers on how to meet federal requirements—who traditionally weren’t experienced with federal processes and procedures—and assess them to the requirements,” says Rob Barnes, Public Sector Practice Leader at Coalfire. This led to the formation of Coalfire Public Sector, the Coalfire team that provides assessment and advisory services for nearly half of all cloud service providers pursuing FedRAMP authorizations.

Headquartered in Washington, D.C., Coalfire Public Sector is an accredited Third Party Assessment Organization (3PAO) under the federal government’s FedRAMP program. Founded by Tom McAndrew, Rob Barnes, Nick Son and Marshall England, Coalfire is dedicated to understanding the unique needs of cloud service providers serving the federal government and has been the assessor of major government contractors, commercial service providers, and software developers.

Coalfire offers IT security solutions that specialize in implementing compliance programs and reducing information technology risks, while helping clients achieve a solid security posture and comply with regulatory and legal mandates.

Under FedRAMP, Coalfire offers assessment and advisory services. One of the most popular services is the re-assessment. The Pre-assessment service helps cloud service providers understand their readiness level to complete a full FedRAMP assessment. While gauging the “FedRAMP readiness” of the company, this process increases the likelihood of successfully completing the full FedRAMP assessment, the first time; saving time and money in the long run. Coalfire also provides advisory and assessment services to meet client’s FISMA (Federal Information Security Management Act) authorization needs. From controls mapping of various environments to documentation development for system security plans (SSP) and supporting policies, plans and procedures, to security testing, Coalfire’s solutions are equipped to help organizations prepare for security review and assessments to meet federal cloud security requirements. For assessment engagements, Coalfire provides a final Security Assessment Report (SAR) and also recommends any remediation steps necessary to address ‘risks’ in a Plan of Action and Milestone document (POA&M).