Onboarding Process for FedRAMP Deployment

This guide outlines the implementation process and shared responsibilities between your team and the 2F platform. It covers each onboarding phase, the required artifacts, and how the team will work together to securely deploy your application and receive FedRAMP Certification.

Implementation phases & milestones

Phase	What Second Front Does	What You Do
Pre-engagement Alignment	Validate FedRAMP alignment. Assess technical feasibility.	Identify a U.S. Federal Agency Sponsor. Confirm your intent to pursue FedRAMP authorization. Complete the FedRAMP Technical Intake Form.
Kickoff	Assign a Mission Success Manager (MSM). Provide FedRAMP onboarding guidance.	Assign technical, compliance, and security leads. Review FedRAMP onboarding requirements. Begin collecting artifacts and planning documentation.
Configuration	Configure development environments. Set up pipelines, Helm charts, and platform integrations.	Provide container images. Configure identity and access management. Begin platform integration activities.
Gap Assessment & Documentation Development	Coordinate Security Advisory Services. Coordinate engagement with the sponsoring agency. Support identification of FedRAMP control gaps.	Participate in control gap analysis and remediation planning. Develop required FedRAMP documentation, including: System Security Plan (SSP) Control implementation statements Policies and procedures Asset inventory Plans of Action & Milestones (POA&Ms)
Security Review	Perform platform-level security assessments. Review Dynamic Application Security Testing (DAST) results. Review container scan results.	Resolve vulnerabilities in your application. Provide justifications for findings when applicable. Close all Critical and High vulnerabilities. Submit the application for security review.
Approve	Approve readiness for production deployment.	No action required.
Deploy to Production	Enable production deployment.	Deploy your application to the Production environment using the 2F platform.
Third-Party Assessment (3PAO)	Coordinate the Third-Party Assessment Organization (3PAO) engagement.	Participate in assessment activities. Support interviews and evidence reviews. Contribute to development of the Security Assessment Report (SAR). Perform Static Application Security Testing (SAST). Submit SAST results to the 3PAO for review. Important: Customers are responsible for performing SAST and providing the results to the 3PAO.
Authorization	Submit the authorization package to the sponsoring agency. Coordinate the FedRAMP PMO review.	Support agency review activities. Respond to clarification requests. Upon approval, your application will be listed as Authorized on the FedRAMP Marketplace.
Day 2 Operations – Continuous Monitoring (ConMon)	Perform monthly platform scans (OS, database, web application, container, and configuration). Submit monthly platform inventory to FedRAMP. Submit customer scan artifacts to FedRAMP. Submit POA&Ms. Submit the Continuous Monitoring Executive Summary.	Perform monthly container vulnerability scans. Maintain the application container inventory. Create and update POA&Ms. Support ongoing Continuous Monitoring reporting.

Shared Responsibility Model

Second Front uses the Shared Responsibility Model to define customer-owned and Second Front-managed responsibilities, streamlining implementation and compliance. Refer to Game Warden's Shared Responsibility Model for more information.

Required technical artifacts

To support a smooth and secure implementation, collect, review, and submit the required items. listed in the Technical Artifacts guide before you begin the onboarding process.

Security requirements

Security is core to the 2F platform. Prepare the following:

Requirement	Details
Authorization Boundary Diagram	Visual representation of your system's FedRAMP boundary, showing what falls within the authorization scope and how external systems integrate.
CVEs & Remediation	You'll use Findings to manage container scans. Address CVEs per the Acceptance Baseline Criteria.
SSP	Complete FedRAMP authorization package containing all security documentation, control implementations, test results, and supporting evidence required for ATO.
Control Implementations	Detailed documentation demonstrating how your system implements each required NIST SP 800-53 security control with evidence of compliance.
SAST Scan & AI Attestation	Prepare static analysis outputs and AI-related disclosures, if applicable.

Technical considerations

Access Control: Identity federation, least privilege, and strong authentication
Logging & Monitoring: Centralized logging, audit trails, and monitoring
Pipelines & Image Push: Secure CI/CD pipelines, signed images, and controlled promotion
Configuration Management: Change control and configuration baselines

Action items & best practices

Secure a Federal Agency Sponsor
Assign clear compliance ownership
Start system security control planning and BoE development
Resolve vulnerabilities in the process
Align application architecture with FedRAMP authorization boundaries
Treat the 3PAO assessment as a formal audit
Establish ConMon workflows before authorization