Compliance and certifications
Vantage for Government maintains compliance with U.S. federal security standards and requirements to ensure secure operations for government agencies and contractors.
Overview
Vantage for Government is designed and operated to meet the stringent security and compliance requirements of U.S. federal agencies. The platform undergoes regular assessments and maintains certifications that demonstrate adherence to federal standards.
FedRAMP authorization
This service is authorized under the Federal Risk and Authorization Management Program (FedRAMP) at the Moderate impact level. The authorization was issued by a U.S. federal authorizing agency following a comprehensive security assessment in accordance with FedRAMP requirements.
The FedRAMP Moderate Authorization to Operate (ATO) confirms that the service meets the security controls defined in National Institute of Standards and Technology (NIST) SP 800-53 for systems processing Controlled Unclassified Information (CUI), where the potential impact of a security compromise could be serious to agency operations, assets, or individuals.
Any authorization conditions, limitations, or constraints applicable to this service are documented as part of the FedRAMP authorization package and are maintained in accordance with FedRAMP continuous monitoring requirements.
FedRAMP provides a standardized approach to security assessment, authorization, and continuous monitoring for cloud services used by U.S. federal agencies.
Vantage for Government
Vantage for Government Is authorized under FedRAMP at the Moderate impact level.
This authorization demonstrates compliance with federal security requirements defined in NIST Special Publication 800-53.
For more details, see FedRAMP authorization.
Compliance frameworks
Vantage for Government adheres to the following federal compliance frameworks:
- FISMA compliance
- The Federal Information Security Management Act (FISMA) establishes requirements for federal information security programs. Vantage for Government implements security controls that support FISMA compliance.
- NIST 800-53 security controls
- The platform implements security controls from NIST Special Publication 800-53, which provides a catalog of security and privacy controls for federal information systems and organizations.
- FIPS 140-2 cryptography
- All cryptographic operations use Federal Information Processing Standards (FIPS) 140-2 validated modules to ensure data protection meets federal standards. For details, see Data security in Vantage.
Department of Defense compliance
Vantage for Government aligns with applicable Department of Defense (DoD) cloud security requirements where required by customer deployment, including impact level considerations consistent with the DoD Cloud Computing Security Requirements Guide (SRG).
Data residency and infrastructure
Vantage for Government operates within infrastructure that meets U.S. federal data residency and sovereignty requirements.
All customer data is stored and processed within AWS GovCloud (US-East) regions.
Data centers are located within authorized U.S. government cloud regions, with specific locations not publicly disclosed for security reasons.
No customer data is transmitted to or stored outside of authorized federal cloud infrastructure.
Personnel with access to customer data undergo background checks appropriate for government systems.
Audit and continuous monitoring
Vantage for Government maintains audit logs in accordance with FedRAMP Moderate requirements to support security monitoring, incident response, and compliance reporting.
Audit logs are retained for periods consistent with federal security control requirements and are protected against unauthorized access or modification. Authorized customers can export audit logs to approved government security information and event management (SIEM) or log aggregation systems using supported, secure mechanisms.
Compliance documentation
Organizations using Vantage for Government can access compliance documentation to support their own authorization and risk management processes.
The FedRAMP compliance artifacts below are made available to authorized government customers and partners upon request and are subject to applicable access controls and non-disclosure requirements:
- System Security Plan (SSP)
- Security Assessment Report (SAR)
- Plan of Action and Milestones (POA&M)
- Other related materials
Compliance updates
Federal security requirements and certifications are subject to change. Vantage for Government maintains current compliance through regular assessments and updates to security controls as requirements evolve.
Customers are notified of significant changes to compliance status or certifications through direct communication from Nozomi Networks, including email notifications and system announcements, as appropriate.