Skip to content

Moraph for clients

Sign in

FedRAMP ATO Accelerator

FedRAMP and federal cloud with Moraph

Prepare and maintain a NIST SP 800-53 security package with the FedRAMP ATO Accelerator, build on Moraph's federal managed platforms, and keep clear about who makes the authorization decision.

Advanced2 hr 51 min13 lessonsFor Administrators, Implementation partnersCertificate of completion

Lesson plan (printable)

About this course

Preparing a system for a FedRAMP or agency authorization means describing how hundreds of controls are implemented, proving it with evidence, and keeping that description true as the system changes. This course shows how the FedRAMP ATO Accelerator drafts the System Security Plan from your system's real configuration, how your team reviews and approves every statement, and how the package stays tied to the live system after authorization. It then covers the Moraph managed platforms that government clients build on: the FedRAMP High Managed Landing Zone, ServiceNow for Federal Service Management and Civic-Secure Microsoft 365.

One idea runs through every lesson: the authorizing official decides. Moraph holds no FedRAMP authorization for any of these products. Moraph's software and services produce documentation, control mappings and evidence that support your authorization decision; the assessment is done by an independent assessor, and the risk decision belongs to your agency. Where anything here differs from your agreement with Moraph, your agreement applies.

What you’ll be able to do

  • Explain who makes an authorization decision, what an assessor does, and why Moraph supports that decision without holding an authorization itself
  • Define an authorization boundary, a baseline and inherited, shared and customer-implemented controls for a system
  • Run the FedRAMP ATO Accelerator workflow from read-only connections through drafted statements, review and approval to an approved package version
  • Produce the SSP and OSCAL output, share it with an assessor safely, and keep it current through drift reviews, POA&M items and monthly deliverables
  • Use the FedRAMP High Managed Landing Zone's customer responsibility matrix, guardrails and exception process when building an application on it
  • Describe how ServiceNow for Federal Service Management and Civic-Secure Microsoft 365 divide responsibilities between the platform vendor, Moraph and your agency

Skills you’ll gain

  • Authorization roles and boundaries
  • Control inheritance and responsibility matrices
  • Governance as code and SSP preparation
  • Continuous monitoring and POA&M management
  • Federal managed platform administration

Before you start

  • You have completed Security, privacy and compliance with Moraph, or you already know which assurances Moraph holds and which frameworks it only maps to
  • You have worked with NIST SP 800-53 controls, a System Security Plan or an authorization package before
  • You know who your organization's system owner, ISSO or compliance lead is
  • Recommended first: Security, privacy and compliance with Moraph

Syllabus

3 modules · 8 readings · 1 practical exercise · 4 assessments

  1. Module 1Authorization and responsibility

    1. Reading: Who owns the authorization decisionReading · 12 min
    2. Reading: Boundaries, baselines and inherited controlsReading · 13 min
    3. Assessment: Module 1 knowledge checkAssessment · 8 min

  2. Module 2Governance as code with the ATO Accelerator

    1. Reading: Drafting the package from configurationReading · 14 min
    2. Reading: Assembling the SSP and sharing it with your assessorReading · 12 min
    3. Reading: Drift, POA&M items and continuous monitoringReading · 14 min
    4. Practical exercise: Practical: triage a package before assessmentPractical exercise · 20 min
    5. Assessment: Module 2 knowledge checkAssessment · 10 min

  3. Module 3Federal and government managed platforms

    1. Reading: Building on the FedRAMP High Managed Landing ZoneReading · 14 min
    2. Reading: Running ServiceNow for federal service managementReading · 12 min
    3. Reading: Civic-Secure Microsoft 365 and the CJIS Security PolicyReading · 12 min
    4. Assessment: Module 3 knowledge checkAssessment · 10 min
    5. Assessment: Final assessmentAssessment · 20 min

What completion gives you

Complete every lesson and pass each assessment to complete the course. You then get a completion record in My learning, and a certificate of completion you can print or share, with a code anyone can check at academy.moraph.com/verify.

Completion is not certification

Course completion records and certificates of completion show that a person completed a Moraph Academy course. They are not a Moraph certification (which needs the certification exam), a professional license or an accreditation, and they do not authorize anyone to configure, operate, resell or support Moraph products on Moraph’s or anyone else’s behalf.

Course updates

  • Version 1 · · First version.