FedRAMP Security Mode

FedRAMP (Federal Risk and Authorization Management Program) is a U.S. government-wide program that standardizes security assessment, certification, and continuous monitoring for cloud products and services used by federal agencies.

FedRAMP Security Mode sets a defined group of security settings to the values FedRAMP requires and locks them. No administrator can relax a locked setting while the mode is enabled. Only Site Administrators can enable or disable the mode, and disabling it is the only way to unlock those settings.

Enabling the mode does not make your site FedRAMP authorized. It enforces the controls a FedRAMP authorization package expects. Files.com's FedRAMP certification status covers where we are in that process.

The mode applies sitewide, across every Workspace. Workspace Administrators cannot enable or disable it, and cannot relax anything it locks.

Enable the mode when your organization pursues federal, state, or local government work that requires these controls. If you still support legacy clients that depend on plain FTP, legacy SFTP ciphers, or weak Diffie-Hellman parameters, those connections stop working the moment you enable the mode. Turning the mode back off does not restore those settings. Move those clients onto encrypted connections first.

What the Mode Sets and Locks

Enabling FedRAMP Security Mode applies all of the following at once.

Your files stay in US storage regions for as long as the mode is enabled. Assigning a folder to a region outside the United States fails with this message:

Behavior is not allowed for FedRAMP sites

You can still enable or disable two-factor authentication methods other than SMS, along with sitewide 2FA requirements. The mode removes SMS as an option and leaves the rest of your 2FA configuration alone.

When FedRAMP Security Mode is enabled, you cannot change a user's settings to Allow unencrypted/plain FTP support.

Before You Enable the Mode

Two conditions stop the mode from turning on until you resolve them, and a third affects your users without blocking the change.

Clear any per-user FTP SSL overrides. While any user still holds one, enabling the mode fails with this message:

Allow user level ssl override cannot be disabled while users still have per-user FTP SSL overrides

Your site does not clear these overrides for you. Review your users to determine who is affected, reset each override to use the system setting, then enable the mode.

Clearing them by hand is deliberate. A user configured to bypass SSL is often one half of a working exchange with an outside party, and quietly forcing that connection to SSL could break the exchange with nothing to explain why it broke. Doing it yourself means you choose which connections change and when.

Move any folders assigned to their own storage region back onto your site's default region. While those assignments exist, enabling the mode fails with this message:

Fedramp cannot be enabled while storage region folder behaviors exist

Users who authenticate with SMS do not block the change. Enabling the mode removes SMS as an available two-factor authentication method, and any user left without a method is required to set one up the next time they connect. That applies to file transfer clients as well as the web interface, so nobody is stranded without a way to authenticate. Tell those users ahead of time so the prompt is expected.

Disabling the Mode

Disabling the mode removes the locks and returns every affected setting to your control.

The hardened values stay as they are. SMS two-factor authentication, legacy ciphers, and per-user FTP SSL overrides remain off until you turn them back on yourself.

FedRAMP Security Mode on Child Sites

Child Site Management Policies include the option to enforce FedRAMP Security Mode. Enabling it in a policy adds the six enforced values to that policy and locks them on every Child Site the policy covers, for as long as the policy stays in the mode.

On a Child Site under such a policy, two independent mechanisms hold each setting at its enforced value: the Child Site Management Policy, which prevents Child Site Administrators from changing it, and FedRAMP Security Mode itself.

Removing FedRAMP Security Mode from the policy hands control of it back to the Child Site Administrator. The mode stays enabled on the Child Site, and the Child Site Administrator can then disable it. Keep the mode in the policy for as long as you need it enforced.

Clear the per-user FTP SSL overrides on your Child Site's users before bringing it under a policy that enables the mode.