Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

FedRAMP docs #8815

Merged
merged 9 commits into from
Nov 22, 2024
Merged

FedRAMP docs #8815

Show file tree
Hide file tree
Changes from 8 commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
00d79f6
Add fedramp doc and compliance overview
melindafekete Nov 20, 2024
d0db527
Apply formatting to markdown tables
melindafekete Nov 20, 2024
6ee384b
Fix broken link
melindafekete Nov 20, 2024
e91088d
Fix title
melindafekete Nov 20, 2024
5166c3b
Apply suggestions from code review
melindafekete Nov 21, 2024
9421ff4
Tweak fedramp intro
melindafekete Nov 21, 2024
cdf57cc
Essential -> crucial
melindafekete Nov 21, 2024
a90dd04
Update titles
melindafekete Nov 21, 2024
ab0130f
Apply suggestions
melindafekete Nov 21, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 12 additions & 0 deletions website/docs/using-unleash/compliance/compliance-overview.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,12 @@
---
title: Compliance for feature flags
description: 'Secure and compliant feature flags at scale with Unleash.'
---

# Compliance

## Overview

Unleash is designed to help organizations meet strict compliance requirements, supporting frameworks like [FedRAMP](https://www.fedramp.gov/program-basics/), [SOC 2](https://www.aicpa-cima.com/topic/audit-assurance/audit-and-assurance-greater-than-soc-2), [ISO 27001](https://en.wikipedia.org/wiki/ISO/IEC_27001), and more. Features such as [audit logs](/reference/events#event-log), [role-based access control](/reference/rbac) (RBAC), and [change request](/reference/change-requests) workflows enable secure feature management at scale.
melindafekete marked this conversation as resolved.
Show resolved Hide resolved

For a detailed overview of how Unleash can help you with FedRAMP requirements, refer to our [FedRAMP compliance documentation](/using-unleash/compliance/fedramp). For information regarding any other frameworks, [reach out to us](mailto:[email protected]).
56 changes: 56 additions & 0 deletions website/docs/using-unleash/compliance/fedramp.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,56 @@
---
title: FedRAMP Compliance for feature flags
description: 'FedRAMP compliant feature flags at scale with Unleash.'
---

# FedRAMP compliance

## Overview

When operating in a [FedRAMP-compliant](https://www.fedramp.gov/program-basics/) environment, it's crucial to ensure that all integrated systems, including feature flagging solutions, adhere to the same compliance standards. Using a homegrown or third-party feature flag system that does not support FedRAMP standards can compromise your certification and introduce unnecessary risks.

This guide provides an overview of how Unleash features align with FedRAMP controls, helping your organization meet its compliance requirements.

## Access Control

| **FedRAMP Control** | **Unleash Features** |
|-------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| [AC-02 Account Management](https://csrc.nist.gov/projects/cprt/catalog#/cprt/framework/version/SP_800_53_5_1_0/home?element=AC-2) | Unleash uses [role-based access control](/reference/rbac) (RBAC) with configurable permissions. In addition, you can integrate Unleash roles with other identity systems using [SCIM](/reference/scim). You can control authorization at different levels with [single sign-on](/reference/sso) (SSO) and [personal access tokens](/reference/api-tokens-and-client-keys#personal-access-tokens). |
| [AC-04 Information Flow Enforcement](https://csrc.nist.gov/projects/cprt/catalog#/cprt/framework/version/SP_800_53_5_1_0/home?element=AC-4) | Unleash supports information flow control with architectural system components like [Unleash Proxy](https://docs.getunleash.io/reference/unleash-proxy) or [Unleash Edge](/reference/unleash-edge), and configuration-level options like IP allow-lists. |
| [AC-07 Unsuccessful Logon Attempts](https://csrc.nist.gov/projects/cprt/catalog#/cprt/framework/version/SP_800_53_5_1_0/home?element=AC-7) | Unleash restricts user logins after 10 failed attempts. |

## Audit and Accountability

| **FedRAMP Control** | **Unleash Features** |
|----------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| [AU-02 Event Logging](https://csrc.nist.gov/projects/cprt/catalog#/cprt/framework/version/SP_800_53_5_1_0/home?element=AU-2) | Unleash provides detailed [audit logs and event tracking](/reference/events), accessible through the Admin UI or exportable for integration with other systems. |
dsusa72 marked this conversation as resolved.
Show resolved Hide resolved
| [AU-12 Audit Record Generation](https://csrc.nist.gov/projects/cprt/catalog#/cprt/framework/version/SP_800_53_5_1_0/home?element=AU-12) | Unleash provides detailed [audit logs and event tracking](/reference/events) to support auditors with the required evidence. Depending on the audit automation level, the evidence can be collected using the Unleash Admin UI, or exported to other systems. |

## Security Assessment and Authorization

| **FedRAMP Control** | **Unleash Features** |
|-------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| [CA-8 Penetration Testing](https://csrc.nist.gov/projects/cprt/catalog#/cprt/framework/version/SP_800_53_5_1_0/home?element=CA-8) | Unleash conducts annual penetration testing by external auditors. Results are available for download from the Trust Center. |
melindafekete marked this conversation as resolved.
Show resolved Hide resolved

## Configuration Management

| **FedRAMP Control** | **Unleash Features** |
|--------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------|
| [CM-02 Baseline Configuration](https://csrc.nist.gov/projects/cprt/catalog#/cprt/framework/version/SP_800_53_5_1_0/home?element=CM-2) | Unleash provides [Export](/how-to/how-to-environment-import-export) functionality that facilitates keeping a configuration snapshot in the audit records. |
dsusa72 marked this conversation as resolved.
Show resolved Hide resolved
| [CM-05 Access Restrictions for Change](https://csrc.nist.gov/projects/cprt/catalog#/cprt/framework/version/SP_800_53_5_1_0/home?element=CM-5) | Unleash provides advanced [role-based access control](/reference/rbac) (RBAC) controls to implement logical access restrictions. [Change Requests](/reference/change-requests) help you define and track approval flows. |

## Identification and Authentication

| **FedRAMP Control** | **Unleash Features** |
|-----------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------|
| [IA-02 Identification and Authentication](https://csrc.nist.gov/projects/cprt/catalog#/cprt/framework/version/SP_800_53_5_1_0/home?element=IA-2) (Organizational Users) | Unleash provides single sign-on (SSO) to enable customers to enforce multi-factor authentication (MFA) for all Unleash users. |
| [IA-02 (01) Identification and Authentication](https://csrc.nist.gov/projects/cprt/catalog#/cprt/framework/version/SP_800_53_5_1_0/home?element=IA-2) (Organizational Users); Multi-factor Authentication to Privileged Accounts | Unleash provides SSO to enable customers to enforce multi-factor authentication (MFA) for all Unleash users. |
| [IA-02 (02) Identification and Authentication](https://csrc.nist.gov/projects/cprt/catalog#/cprt/framework/version/SP_800_53_5_1_0/home?element=IA-2) (Organizational Users); Multi-factor Authentication to Non-privileged Accounts | Unleash provides SSO to enable customers to enforce multi-factor authentication (MFA) for all Unleash users. |
| [IA-02 (08) Identification and Authentication](https://csrc.nist.gov/projects/cprt/catalog#/cprt/framework/version/SP_800_53_5_1_0/home?element=IA-2) (Organizational Users); Access to Accounts — Replay Resistant | Unleash restricts user logins after 10 failed attempts. |

## System and Communications Protection

| **FedRAMP Control** | **Unleash Features** |
|-------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------|
| [SC-08 (01) Transmission Confidentiality and Integrity](https://csrc.nist.gov/projects/cprt/catalog#/cprt/framework/version/SP_800_53_5_1_0/home?element=SC-8) (Cryptographic Protection) | Unleash implements cryptographic protection for data in transit, as detailed in our SOC2 report (available upon [request](https://www.getunleash.io/plans/enterprise). |
| [SC-17 Public Key Infrastructure Certificates](https://csrc.nist.gov/projects/cprt/catalog#/cprt/framework/version/SP_800_53_5_1_0/home?element=SC-17) | Unleash uses PKI certificates issued by AWS and Google. |
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Would service accounts as well as personal access tokens be based on PKI as well @dsusa72 ?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't know, but I don't think it's relevant because we're not going to list here all the points in the solution where we use encryption. When we implement my suggestion in cell G15 (Encryption overview diagram), we will get down to this detail level.

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this section isn't about encryption, but rather PKI, e.g. certificates. Saying that we use certificates only on AWS and Google, if we in fact use certificate-based auth on our API seems like an omission. Unless of course we don't use certs on those services. Could an engineer validate this quickly?

Copy link
Member

@dsusa72 dsusa72 Nov 22, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@michaelferranti , This was already validated with a principal eng. For clarification: we're not saying we use certificates "on" AWS & Google. We're saying "issued by" them, which is different. We're saying these are the only two CAs (Certification Authorities) that we get certificates from, as opposed to using certs from a Gov authority or self-signed ones. In the NIST control wording these two CAs sohuld be considered "approved service providers".
I.e. this is about the type of certs se use and not "where" we use them. If we attempt to describe "where", I still recommend my suggestion on cell G15.

15 changes: 15 additions & 0 deletions website/sidebars.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -537,6 +537,21 @@ const sidebars: SidebarsConfig = {
],
},
'generated/unleash-proxy',
{
type: 'category',
label: 'Compliance',
link: {
type: 'doc',
id: 'using-unleash/compliance/compliance-overview',
},
items: [
{
type: 'doc',
label: 'FedRAMP',
id: 'using-unleash/compliance/fedramp',
},
],
},
{
label: 'Troubleshooting',
type: 'category',
Expand Down
Loading