FedRAMP Moderate with ServiceNow Continuous Monitoring for a Grants Platform
An agency authorization, and monthly continuous monitoring packages that take two days to assemble instead of two weeks.
Client name withheld by agreement- Client
- Grants management software provider to federal and state agencies
- Region
- Rockville, Maryland
- Year
- 2024
- Duration
- 36 weeks
- Scope
- Moderate baseline · 323 controls · POA&M and ConMon in ServiceNow
- Practice
- AI, Cloud & Digital Trust
The challenge
What was at stake.
A grants management software provider served state agencies and wanted to sell to a federal department that funds research grants. That required a FedRAMP Moderate authorization, and the sponsoring agency wanted to see a credible continuous monitoring process before it would commit.
The company tracked vulnerabilities in a spreadsheet, changes in Jira and incidents in ServiceNow. Every monthly continuous monitoring deliverable would have meant reconciling all three by hand, for as long as it held the authorization.
What we did
The approach, step by step.
- 01
Authorization boundary designed
We defined a dedicated boundary in a government cloud region, with its own identity provider, logging, scanning and deployment pipeline, separate from the commercial product.
- 02
Controls implemented with the engineers
FIPS-validated encryption, configuration baselines, centralized audit logging and authenticated scanning were engineered in, and each of the 323 control narratives was written with the person who runs it.
- 03
POA&M managed in ServiceNow
Scanner findings flow into ServiceNow Vulnerability Response, deviation requests are approved in workflow, and the POA&M is generated from those records in the FedRAMP template.
- 04
Significant change built into change control
ServiceNow change records now ask whether a change touches the boundary, and anything that could be a significant change goes to the security lead before approval.
- 05
Assessment supported to authorization
We prepared evidence for the 3PAO, tracked findings to closure and supported the agency’s review through to its authorization decision.
Outcomes
What changed, in numbers.
- 323
- controls implemented and documented
- 2 days
- to assemble the monthly ConMon package
- 0
- high findings at the 3PAO assessment
- 10
- months from kickoff to agency authorization
The agency asked to see our continuous monitoring before they signed. We showed them ServiceNow, and the conversation was over in an hour.
Services delivered
Related engagements
More work in AI, Cloud & Digital Trust.
-
Boston, Massachusetts · 16 weeks
AI, Cloud & Digital Trust · 2024SOC 2 Type II with Evidence Built into ServiceNow Change RecordsAn unqualified Type II report with zero exceptions, and change-management evidence that now collects itself.
-
New York, New York · 20 weeks
AI, Cloud & Digital Trust · 2026 · OngoingISO/IEC 42001 and Adversarial Testing for a Commercial Underwriting AI PlatformDoctored broker submissions no longer steer risk rankings, and an AI management system is on track for its certification audit.
-
Pittsburgh, Pennsylvania · 22 weeks
AI, Cloud & Digital Trust · 2025Multi-Cloud Security Guardrails for a Regional Health SystemClinical imaging and analytics in two clouds under one set of guardrails, with no change to how radiologists read studies.
Let’s talk about your version of this.
Share what you are up against. A senior practitioner who has delivered this kind of work will reply within one business day.