Authorization Boundary Diagram Examples

Right click on the image above to open in a new tab or window for better visibility.

Question 1.1: Can you find any services that may need to be switched for a different provider?

• The items in the purple box labeled “External Services without FedRAMP authorization all need evaluation. Do they receive Federal Data or affect the Confidentiality, Integrity or Availability of the system? If yes, then yes they will need to be addressed and communicated with your sponsor to determine best path forward.

Question 1.2: Of the 2 items listed as outside the boundary, customer’s local laptops and the underlying physical data centers, which could be considered part of this system’s supply chain and relevant to its authorization?

• The data centers must have a FedRAMP authorization to be considered an acceptable infrastructure provider in the system’s supply chain. As it stands the certification of the infrastructure is inherited from AWS’s own FedRAMP certification and does not need to be included in the boundary diagram.

Right click on the image above to open in a new tab or window for better visibility.

Question 2.1: What indicates that the external connection must be FedRAMP authorized?

• In the case of the external connection to the weather service, the value data, the weather data, is entering the boundary rather than leaving the boundary. Therefore the data does not belong to the SaaS system or the sponsoring Federal Agency. The security of the originating system is not in scope, but also poses a low risk.
• In the case of the external connection to the weather service, the value data, the weather data, is entering the boundary rather than leaving the boundary. Therefore the data does not belong to the SaaS system or the sponsoring Federal Agency. The security of the originating system is not in scope, but also poses a low risk.

Question 2.2: What constitutes a “no-risk” service?

• Very few things have a zero risk, but we know some data will not affect the CIA of the system and will be very low risk.
• Ingress Data is generally coming into the system is low risk
• Some egress data, such as requests for information, may be low risk and should be discussed with your Federal sponsor for approval of the determination.

Right click on the image above to open in a new tab or window for better visibility.

Question 3.1: Public School systems may need to send records to each student’s record stored in the relational database. If the public school systems cannot afford GovRamp certification, will this connection be a roadblock to achieving GovRamp Authorized?

• The data from the public schools are being sent electronically but records from the platform are not being shared back to the public school system, therefore, as long as no student PII is returned back, their systems are out of scope for the Authorization Boundary.

Question 3.2: Should this example organization start with or make Ready their end goal? How do they make this decision?

• All external connections should be evaluated, not just the trusted Federated Identity Management. However, in this case the Federated Identity Management connects only University Azure Active Directories which all inherit FedRAMP authorization from Azure.
• Perhaps the connection to the public high school should not be routed via the Federated Identity Service, but instead have a direct API managed access into isolated storage accounts which then can be integrated individually into the student records by the application. This migration would require an additional time and cost to accomplish. Another option is to have the CSP pay for a snapshot for each of the connected High Schools. A Business Impact Analysis, Risk Assessment, and potentially a significant change request would all need to be documented to support the decision making and the auditing process.

Right click on the image above to open in a new tab or window for better visibility.

Question 4.1: which impact level is right for the example organization? How do they make that decision?

• In this case, the Universities involved may have to show GovRamp Authorized Compliance per State Law. Investing in a GovRamp snapshot for each external system that processes system data is well worth the cost to receive full authorization status. It will also help identify any external services that should be replaced with a different service provider if they cannot pass the snapshot. It helps to ensure supply chain due diligence.