Lesson plan

FedRAMP and federal cloud with Moraph

Prepare and maintain a NIST SP 800-53 security package with the FedRAMP ATO Accelerator, build on Moraph's federal managed platforms, and keep clear about who makes the authorization decision.

Back to the course

Product: FedRAMP ATO Accelerator
Level: Advanced
For: Administrators, Implementation partners
Total time: 2 hr 51 min
Lessons: 13 in 3 modules
Assessments: 4

Course objectives

Explain who makes an authorization decision, what an assessor does, and why Moraph supports that decision without holding an authorization itself
Define an authorization boundary, a baseline and inherited, shared and customer-implemented controls for a system
Run the FedRAMP ATO Accelerator workflow from read-only connections through drafted statements, review and approval to an approved package version
Produce the SSP and OSCAL output, share it with an assessor safely, and keep it current through drift reviews, POA&M items and monthly deliverables
Use the FedRAMP High Managed Landing Zone's customer responsibility matrix, guardrails and exception process when building an application on it
Describe how ServiceNow for Federal Service Management and Civic-Secure Microsoft 365 divide responsibilities between the platform vendor, Moraph and your agency

Before the course

You have completed Security, privacy and compliance with Moraph, or you already know which assurances Moraph holds and which frameworks it only maps to
You have worked with NIST SP 800-53 controls, a System Security Plan or an authorization package before
You know who your organization's system owner, ISSO or compliance lead is

Module 1: Authorization and responsibility (33 min)

Lesson	Type and time	Learners will be able to	Activity and assessment
Who owns the authorization decision	Reading 12 min	Name the parties in an authorization and what each one does Explain why Moraph supports an authorization decision but never makes or holds one Correct wording that overstates Moraph's assurance in a proposal or package	Reading
Boundaries, baselines and inherited controls	Reading 13 min	Explain how security categorization leads to a FedRAMP Low, Moderate or High baseline Decide what belongs inside an authorization boundary Classify a control as implemented, inherited, shared, planned or not applicable, and read a customer responsibility matrix	Reading
Module 1 knowledge check	Assessment 8 min	Check that you can say who makes an authorization decision and what Moraph contributes Check that you can classify controls and use a customer responsibility matrix	5 questions · pass mark 70% · unlimited attempts

Module 2: Governance as code with the ATO Accelerator (1 hr 10 min)

Lesson	Type and time	Learners will be able to	Activity and assessment
Drafting the package from configuration	Reading 14 min	Describe how the Accelerator turns read-only configuration into drafted implementation statements Review a drafted statement against its cited evidence and correct a misread Assign the controls the Accelerator cannot draft and keep drafting and approval separate	Reading
Assembling the SSP and sharing it with your assessor	Reading 12 min	Generate an SSP and OSCAL output from an approved package version Explain why the system owner approves a version before anyone outside sees it Grant scoped, time-limited assessor access and review it afterwards	Reading
Drift, POA&M items and continuous monitoring	Reading 14 min	Review a drift finding and choose between updating the package, reverting the change or recording no impact Work a POA&M item from scan finding to verified closure Prepare monthly continuous monitoring deliverables for the compliance lead to send	Reading
Practical: triage a package before assessment	Practical exercise 20 min	Decide what must happen before a package version is approved and shared Route drift, POA&M and access decisions to the right role	Practical exercise with a checklist
Module 2 knowledge check	Assessment 10 min	Check that you can run the Accelerator's draft, review and approval workflow correctly Check that you can handle drift, POA&M items and assessor access	5 questions · pass mark 70% · unlimited attempts

Module 3: Federal and government managed platforms (1 hr 8 min)

Lesson	Type and time	Learners will be able to	Activity and assessment
Building on the FedRAMP High Managed Landing Zone	Reading 14 min	Describe what the landing zone provides and how responsibilities split between Moraph, the cloud provider and your agency Request an application environment, a guardrail exception or a baseline change with the right approvals Use the landing zone's control documentation in an application's own package	Reading
Running ServiceNow for federal service management	Reading 12 min	Explain what ServiceNow, Moraph and the agency each own in the managed service Take a configuration change through managed change control Handle PIV and classified-network token requests within the service's limits	Reading
Civic-Secure Microsoft 365 and the CJIS Security Policy	Reading 12 min	Explain how Civic-Secure Microsoft 365 supports the FBI CJIS Security Policy and what it cannot do on its own Identify the decisions that belong to the LASO, the agency and the state CJIS Systems Agency Prepare for a state CJIS audit with the evidence Moraph provides and the evidence you hold	Reading
Module 3 knowledge check	Assessment 10 min	Check that you can route work on the landing zone, ServiceNow and Microsoft 365 services to the right owner Check that you can apply each service's approval rules and limits	5 questions · pass mark 70% · unlimited attempts
Final assessment	Assessment 20 min	Show that you can apply the whole course to realistic authorization, continuous monitoring and managed platform situations	12 of 18 questions · pass mark 80% · 3 attempts

Completing the course

Every lesson must be completed: reading lessons are marked complete by the learner, exercises when every checklist item is confirmed, and assessments only when passed. Completing the course issues a certificate of completion with a verification code.