FedRAMP Configurations

the federal risk and authorization management program (fedramp) is a government wide program that provides a standardized approach to security assessment, authorization, and continuous monitoring for cloud products and services listed below are features that are required to be fedramp compliant in password complexity the password complexity specifies the password complexity requirements for application users fedramp requires specific values to be set for the password complexity and minimum password length fields from the configuration console, go to configure > security controls > security and session to open the security and session workspace go to the password policy section and set the minimum password length the minimum password legth should be 8 to comply with fedramp standards select fedramp from the password complexity list (optional) you can define the complexity regular expression if this is set, the value defined here for the minimum password length will take effect and not the one defined in the minimum password length field click save password history password history defines the number of times a user can change the password in from the configuration console, go to configure > security controls > security and session to open the security and session workspace go to the password policy section and set the history depth to 24 this is the minimum value required, according to fedramp standards a user will be unable to change the application password using any one of the last 24 previous passwords click save minimum password age in days minimum password age defines the number of days for a password before it can be reset by a user for example, if the value is set to 2, then a user will be unable to reset the password for two days if the minimum password age in days value is set to zero, then the password can be reset at any point in time if a user wants to reset the password before meeting the set value, then the user must contact the administrator from the configuration console, click configure > security controls > security and session to open the security and session workspace go to the password policy section, and type the desired number of days in the minimum password age in days field click save limit concurrent session (internal auth) concurrent interactive sessions refer to the number of active sessions a user can have simultaneously on one or more devices or browsers when users reach the concurrent session limit, an error message will be displayed and an option will be provided to do a force login, which will terminate all their existing sessions from the configuration console, click configure > security controls > security and session to open the security and session workspace go to the concurrent session section, and enter the number of concurrent sessions for all three types of users named user , privileged user , and non privileged user click save limit concurrent session (external auth) these configurations are applicable to users who reach the concurrent session limit, when they are connected to through active directory (ad), ldap, or other single sign on (sso) technologies from the configuration console, click configure > security controls > authentication providers to open the authentication providers workspace select an existing record or click new record menu and then select new adfs/saml from the list the force login option is applicable to users reaching concurrent session limits, in the case of external authentication if the option is selected, when users reach a concurrent session limit, the application terminates all existing sessions and devices and automatically logs them into a new session if the option is not selected, when users reach a concurrent session limit, an error message will appear on the page, and the users will need to log out of existing sessions or devices, and then try logging in again if the value is set to zero, the number of times a user can login is unlimited this means, infinite number of active sessions are possible at the same time click save auto deactivate user if idle for \[n] days as per fedramp standards, the auto deactivate user feature sets the duration to automatically deactivate users who do not log in to the to set the auto deactivate feature for a user, do the following steps from the configuration console, click build > global constants to open the global constants workspace select userdeactivationduration from the list the following information is displayed for the global constant field description name a unique name for the global constant for example, userdeactivationduration value the value for the global constant by default, the value will be displayed as 5184000 , for 60 days to adapt to fedramp specifications, the value can be changed to 35 days the calculation can be done as follows 35 days x 24 hours x 60 minutes x 60 seconds = 3024000 type field type text, number, boolean in this case, type in the value number description a description of what the global constant is used for for example, duration set for a user who does not log in to for \[n] number of days once the set number of days has passed, the user will get disabled, as per fedramp standards click save to save any changes done from the configuration console, click build > workflow > workflows to open the workflows workspace go to the schedule entry section, and select disable inactive user select more actions , and then select activate version from the list click save the workflow will run daily, based on the "disable user not logged in last n days" daily schedule if there are any users who did not log into the application for \[n] days, they will get disabled automatically