11 Product Certifications You Need To Sell To The Federal Government Customer

If you want to do business with the Federal Government, then you may need the right product certifications to meet their specific standards and requirements. U.S. and International Governments are now mandating security certifications for products they are integrating into the technology infrastructure to help:

• Provide defense against increasingly sophisticated cyber attacks
• Meet Government mandates for security
• Achieve compliance to alleviate risk
• Reduce concern of security breaches and data loss

8 certifications related to products procured by the Federal Government directly support the above initiatives and you will need some or all of these credentials in order to do business successfully with the Government. These product certifications focus mainly on three areas:

1. Information Assurance
2. Federal cloud-strategy
3. Americans with Disabilities

11 Product Certifications The Federal Government Requires

1. Americans With Disabilities Act: (ADA) Section 508 (508 Compliant)

Americans With Disabilities Act: (ADA) Section 508 was enacted to eliminate barriers in Information Technology, to make available new opportunities for people with disabilities, and to encourage development of technologies that will help achieve these goals. The law applies to all Federal agencies when they develop, procure, maintain, or use electronic and information technology.

2. National Information Assurance Partnership: Common Criteria (NIAP CC)

The National Information Assurance Partnership (NIAP) is responsible for U.S. implementation of the Common Criteria, including management of the NIAP Common Criteria Evaluation and Validation Scheme (CCEVS) validation body. NIAP manages a national program for developing Protection Profiles, evaluation methodologies, and policies that will ensure achievable, repeatable, and testable requirements. In partnership with NIST, NIAP also approves Common Criteria Testing Laboratories to conduct these security evaluations in private sector operations across the U.S.

3. Federal Information Processing Standard 140 Level 3: (FIPS 140-3) - UPDATED

FIPS PUB 140-3 [pdf doc], Security Requirements for Cryptographic Modules provides the security requirements that cryptographic modules are tested against. Security requirements cover 11 areas related to the design and implementation of a cryptographic module. For each area, a cryptographic module receives a security level rating (1-4, from lowest to highest) depending on what requirements are met. Security Level 3 improves upon the physical security mechanisms of a Security Level 1 cryptographic module by requiring features that show evidence of tampering, including tamper-evident coatings or seals that must be broken to attain physical access to the plaintext cryptographic keys and critical security parameters (CSPs) within the module, or pick-resistant locks on covers or doors to protect against unauthorized physical access.

Need Help Identifying The Product Certifications You Need Do Business With The Federal Government?

Register for an upcoming Federal Sales Certification Training Course and gain the tactical skills you need to effectively sell to the Federal Government!

Learn More

4. Risk Management Framework (RMF)

The DoD Risk Management Framework (RMF) describes the DoD process for identifying, implementing, assessing, and managing cybersecurity capabilities and services, expressed as security controls, and authorizing the operation of Information Systems (IS) and Platform Information Technology (PIT) systems. RMF brings a risk-based approach to the implementation of cybersecurity, supports cybersecurity integration early and throughout the system life-cycle, promotes reciprocity to the maximum extent possible and stresses continuous monitoring. RMF replaces the DoD Information Assurance Certification and Accreditation Process (DIACAP).

The RMF process parallels the defense acquisition process from initiation and consists of six (6) steps:

1. Categorize System
2. Select Security Controls
3. Implement Security Controls
4. Assess Security Controls
5. Authorize System
6. Monitor Security Controls

5. Department Of Defense Information Network Approved Product List (DODIN APL)

The Department of Defense Information Network Approved Products List (DODIN APL) is established in accordance with the UC Requirements (UCR 2013) document and mandated by the DOD Instruction (DODI) 8100.04. Its purpose is to maintain a single consolidated list of products that have completed Interoperability (IO) and Cybersecurity certification. Use of the DODIN APL allows DOD Components to purchase and operate systems over all DOD network infrastructures.

The DODIN APL is the only listing of equipment by DOD to be fielded in DOD networks. DOD components are required to fulfill their system needs by only purchasing DODIN APL listed products, providing one of the listed products meets their needs. This means the DODIN APL must be consulted prior to purchasing a system or product. If no listed product meets the organizations needs, they may sponsor a product for testing that does meet their needs.

6. Federal Risk And Authorization Management Program (FedRAMP)

The Federal Risk and Authorization Management Program (FedRAMP) is a government-wide program that provides a standardized approach to security assessment, authorization, and continuous monitoring for cloud products and security. FedRAMP enables Agencies to rapidly adapt from old, insecure legacy IT to mission-enabling, secure, and cost effective cloud-based IT.

FedRAMP created and manages a core set of processes to ensure effective, repeatable cloud security for the government. FedRAMP established a mature marketplace to increase utilization and familiarity with cloud services while facilitating collaboration across government through open exchanges of lessons learned, use cases, and tactical solutions.

7. Authorization To Operate (ATO)

An Authorization to Operate (ATO) is a formal declaration by an Authorizing Official (AO) that authorizes operation of a Business Product and explicitly accepts the risk to agency operations. All agencies handle the ATO process differently, to develop a complete understanding of the process, speak with the targeted agency's security compliance specialist. Here s an example of a typical ATO process for a cloud.gov customer system.

8. Cybersecurity Maturity Model Certification (CMMC)

Thee Cybersecurity Maturity Model Certification (CMMC) is a more recent certification developed under The Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)). The goal of CMMC is to ensure that cybersecurity remains at the forefront of any acquisition by assessing the level of protection of controlled unclassified information (CUI) at various stages of the the supply chain as a means to reduce risk of specific cyber threats. CMMC builds upon existing regulation (DFARS 252.204-7012).

This certification applies to Defense Industrial Base (DIB) sector and requires that these companies obtain the certificate through authorized and accredited CMMC Third Party Assessment Organizations (C3PAOs).

9. Cyber Supply Chain Risk Management (C-SCRM)

The Cyber Supply Chain Risk Management (C-SCRM) process was developed by NIST in order to better identify, assess and mitigate the inherent risks associated with the information, communications, and operational technology (ICT/OT) supply chains. This process addresses supply chain threats and vulnerabilities for any product of service at any stage from design and development to acquisition, maintenance and end of life.

10. Trade Agreements Act (TAA)

The Trade Agreements Act (19 U.S.C. & 2501-2581) of 1979 requires the U.S. government may only acquire products that are U.S. made or have been “substantially transformed” in the US (Or in a TAA compliant country) prior to purchase. Many countries are TAA compliant, those that are not include, but are not limited to:

• China
• India
• Indonesia 
• Iran
• Iraq
• Malaysia
• Pakistan
• Russia
• Sri Lanka

11. Certificate of Networthiness: CoN - DoD (though not required customers still ask for it)

The Networthiness Certification Program manages the specific risks and impacts associated with the fielding of Information Systems (ISs) and supporting efforts, requires formal certification throughout the life cycle of all ISs that use the Information Technology (IT) infrastructure, and sustains the health of the Army Enterprise Infrastructure.

Networthiness Certification is concerned with the identification, measurement, control, and minimization of security risks and impacts in IT systems to a level commensurate with the value of the assets protected. Networthiness Certification applies to all organizations fielding, using, or managing ISs on the Army Enterprise Architecture/LandWarNet (LWN), to include Commercial Off-the-Shelf (COTS) and Government Off-the- Shelf (GOTS). In accordance with AR 25-1, paragraph 6-8 activities must obtain a Certificate of Networthiness (CoN) before they connect hardware/software to the LWN.

NOTE: Per ARCYBER OPORD 2018-097, published April 20, 2018, the RMF Assess Only process will be implemented NLT July 2, 2018 to replace the Army CoN process. The OPORD and NETCOM Operational TTP are both published on the RMF Knowledge Service which is available at the following link: https://rmfks.osd.mil/ (CAC Required).

Product Certifications Acronym List

• ADA – American with Disability
• AO – Authorizing Official
• ATO – Authority To Operate
• CCEVS – Common Criteria Evaluation and Validation Scheme
• CCRA – Common Criteria Recognition Arrangement
• CCTL – Common Criteria Testing Laboratories
• CoN – Certificate of Networthiness
• COTS – Commercial Off The Shelf
• CSO – Cloud Service Offering
• CSP – Cloud Service Provider
• CSP – Critical Security Parameters
• CST – Cryptographic and Security Testing
• DAA – Designated Approving Authority
• DODIN APL – Department of Defense Information Network Approved Product List
• DTR – Derived Test Requirements
• EAL – Evaluation Assurance Level
• FedRAMP – Federal Risk and Authorization Management Program
• FIPS – Federal Information Processing Standard
• FISMA – Federal Information Security Management Act
• GOTS – Government Off The Shelf
• IA – Information Assurance
• IO – Interoperability Objective
• IS – Information Systems
• NIAP – National Information Assurance Partnership
• NIST – National Institute of Standards and Technology
• NSTISSP - National Security Telecommunications and Information Systems Security Policy
• NVLAP – National Voluntary Laboratory Accreditation Program
• PIT – Platform Information Technology
• PP – Protection Profiles
• RMF – Risk Management Framework
• STIG – Security Technical Implementation Guide

This post was updated to include new certification requirements on October 25, 2021.

Do You Need Help Getting The Right Product Certifications To Sell To The Federal Government?

Then request a FREE Consultation from Sanctum Federal! Our team has successfully built several Federal sales startup practices and secured millions of dollars of revenue directly from the Federal market and our mission is to help other organizations do the same!

Use the form below to request your FREE Federal Sales Consultation and learn what methods you can leverage to increase you or your team's ability to sell to the Federal Government!