{"id":2444602,"date":"2024-07-24T10:48:02","date_gmt":"2024-07-24T17:48:02","guid":{"rendered":"https:\/\/www.esri.com\/arcgis-blog\/?post_type=blog&p=2444602"},"modified":"2024-11-13T09:39:58","modified_gmt":"2024-11-13T17:39:58","slug":"arcgis-online-fedramp-moderate-authorized","status":"publish","type":"blog","link":"https:\/\/www.esri.com\/arcgis-blog\/products\/trust-arcgis\/administration\/arcgis-online-fedramp-moderate-authorized","title":{"rendered":"ArcGIS Online FedRAMP Moderate Authorized!"},"author":3911,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"open","ping_status":"closed","template":"","format":"standard","meta":{"_acf_changed":false,"_searchwp_excluded":""},"categories":[37501],"tags":[773302,24071],"industry":[],"product":[36551,763582],"class_list":["post-2444602","blog","type-blog","status-publish","format-standard","hentry","category-administration","tag-certification","tag-security","product-arcgis-online","product-trust-arcgis"],"acf":{"short_description":"ArcGIS Online has been operating with FedRAMP Moderate controls in place since 2022 and is now officially authorized.","flexible_content":[{"acf_fc_layout":"content","content":"

We are excited to announce that the FedRAMP PMO authorized ArcGIS Online as FedRAMP Moderate on July 22, 2024, as seen within the FedRAMP Marketplace<\/a>.<\/p>\n

So, what happened to get us to this point, what’s changed, do you need to do anything to take advantage of this higher level of security within ArcGIS Online, and what’s next?<\/p>\n

Background<\/strong><\/p>\n

In 2022, ArcGIS Online was operating with a FedRAMP Tailored Low authorization, and our customers were asking for a stronger security assurance level to help protect their information, whether it was a federal agency, global commercial organization, or non-profit.\u00a0 We therefore increased the security controls of our operations to FedRAMP Moderate, were assessed by a 3PAO (an accredited 3rd party auditor) and submitted all evidence to our Authorizing Agency (Department of the Interior) at the end of 2022.\u00a0 After reviewing and validating the information, DOI authorized ArcGIS Online as Agency FedRAMP Moderate on May 8, 2023, and the FedRAMP PMO notified.\u00a0 During this time, FedRAMP also required transition to a new revision of security controls for all providers, from NIST 800-53 Rev 4 to Rev 5<\/a>.\u00a0 The good news is that it integrated stronger privacy controls as well as adding a whole family of security controls for a more robust supply chain.\u00a0 The combination of increasing our security assurance level and changing to the new security control revision resulted in the FedRAMP PMO authorization taking until now.<\/p>\n

What’s Changed?<\/strong><\/p>\n

Customers now have stronger security and privacy assurance which is in alignment for customers of any type to utilize more diverse datasets within ArcGIS Online.\u00a0 You may have noticed that ArcGIS Online was NOT affected by the recent Crowdstrike outage as we ensure strong segmentation of corporate and customer operations of our products, providing the resiliency you see and helping mitigate the scope of supply chain risks.<\/p>\n

Customer Actions Required?<\/strong><\/p>\n

The great news is that we made all of these security and privacy advancements transparently to our existing ArcGIS Online implementation – no customer migration to a different implementation is required.\u00a0 Since the utilization of cloud-based services is a shared responsibility between Esri and our customers we suggest reviewing the Customer Responsibility Matrix<\/a> (requires ArcGIS Login to access), to ensure you are taking advantage of secure customer-managed configuration controls.\u00a0 Once you make any security control changes, we then suggest running the ArcGIS Security & Privacy Adviser tool<\/a> to ensure your configuration is in alignment with best practices.\u00a0 Note, this tool will be refreshed with a clean new look by the end of July (some of you had a sneak-peek at the UC last week), and additional checks will be added later this year.<\/p>\n

What’s Next?<\/strong><\/p>\n

Customer’s utilizing our ArcGIS Online US-based operations already have a map security controls from FedRAMP Moderate to ISO 27001<\/a>, if they prefer referencing the international standard for assurance purposes.\u00a0 For customer’s utilizing our ArcGIS Online European Union(EU) region for their organization we are actively working on ISO 27001 and expect that certification to be complete before the end of 2025.<\/p>\n