Across the federal government, teams that respond to FOIA, investigations, and litigation matters are responsible for managing vast quantities of data that are increasing in volume and complexity at a record-setting pace. At the same time, cyberthreats are constantly evolving.
To meet this challenge, it’s imperative that federal agencies become even more serious about security, especially when it comes to their technology providers. Federal agencies have long prioritized sophisticated security practices; they should hold their partners to the same standards. With waves of AI-powered cyberattacks from nation-state actors, malicious insiders, and opportunistic hackers hitting the federal government hourly, if not more frequently, federal agencies need to invest in data security solutions that are fit for their mission.
According to Sundhar Rajan, Chief Information Officer at Casepoint, “safeguarding sensitive data, particularly in the data discovery process where confidentiality and integrity are non-negotiables, must be top of mind today for federal agencies.” For Rajan, the best assurance for data security and integrity during the data discovery process comes from working with a trusted partner whose solutions and practices have attained the highest levels of compliance with best-in-class data security certification programs. For civilian agencies, this is FedRAMP High certification, and for the Department of Defense, this means Impact Level 4 (IL4) for unclassified information, Impact Level 5 (IL5) for more confidential information and Impact Level 6 (IL6) for classified information.
Understanding FedRAMP High
To help bring an understanding of the FedRAMP authorization classifications, we asked Rajan to explain the distinctions. “The Federal Risk and Authorization Management Program (FedRAMP) is a rigorous security compliance framework mandatory for all federal civilian agency cloud deployments,” he explained. “The different levels of authorization – low, moderate, and high, address the different security needs of the data that is in discovery. FedRAMP High Authorization explicitly addresses the security needs of data critical to law enforcement, emergency services, financial systems, and health systems. Achieving this level of security is paramount to ensuring the integrity and confidentiality of sensitive government information.”
The process of attaining FedRAMP high authorization is, as you would expect, lengthy and rigorous. “The Casepoint product was the first cloud eDiscovery solution to achieve FedRAMP Moderate certification and is now also the first and only of its kind to receive FedRAMP High authorization,” Rajan noted. “This means that we’ve attained the highest security designations for civilian agencies.
While these authorizations and imminent authorizations are impressive, what do they really mean for federal agencies, and what value do they bring to critical legal, eDiscovery, and FOIA work?
According to Rajan, it means that federal agencies using a system with FedRAMP high authorization have the level of security that meets their all their data needs, whether low, moderate, or high security, without increased costs or extra work required to secure the most sensitive data.
Understanding IL4, IL5 and IL6
For military and defense eDiscovery teams, security needs can be even more complex, and safeguarding classified information is critical. Casepoint is also the only cloud-based eDiscovery solution to achieve Department of Defense ATO Impact Level 4 (IL4) for controlled unclassified information, IL5 for more confidential information and IL6 for classified information up to Secret level.
Software companies seeking approval for IL6 must undergo a rigorous evaluation and authorization process. Unsurprisingly, given the requirements, the evaluation and authorization process for IL6 can take several months or even years, depending on the complexity of the system and the level of risk it presents.
Conclusion
Amid the landscape of escalating cyber threats, the emphasis on robust cybersecurity has become a non-negotiable aspect of business operations. The achievement of FedRAMP High and DOD IL4, IL5, and Il6 authorizations, while a notable achievement, is not the end of the security journey, but part of an unwavering commitment to keeping the federal government’s most important data safe from theft and misuse. “As the data security legal landscape evolves, our commitment to will not change,” concluded Rajan. “It’s our mission to be at the forefront of data discovery security, ensuring the confidentiality, integrity, and availability of critical information assets to support the federal government’s mission.”