Menu
|
Menu
The Cisco Meraki for Government FedRAMP Moderate authorization is the single most important infrastructure event for DIB contractors in the last two years. It is also one of the most misunderstood.
We’ve seen vendors selling the GovCloud migration as a CMMC compliance shortcut. We’ve seen contractors believe that if they move their network into Meraki for Government, the audit is mostly done. We’ve seen one C3PAO almost walk off an engagement because the contractor’s networking vendor had positioned FedRAMP authorization as equivalent to certification.
This post is the explainer that should have come with the announcement.
FedRAMP authorization is granted to a cloud service provider. CMMC certification is granted to your organization. They assess different things and they don’t substitute for each other.
The Cisco Meraki for Government FedRAMP Moderate authorization tells the federal government that Cisco’s GovCloud platform meets a specific baseline of controls. That helps you because some of the controls Cisco has implemented at the platform layer are controls your assessor doesn’t need to re-evaluate at your layer.
It does not certify your organization. Your C3PAO does that, after you’ve implemented the rest of the controls that FedRAMP doesn’t cover.
The migration is real value, but it’s value at a specific layer of the stack. Knowing exactly which layer is the difference between a good audit and a bad one.
FedRAMP (Federal Risk and Authorization Management Program) is a federal program that standardizes how cloud service providers (CSPs) demonstrate they meet security controls drawn from NIST SP 800-53. FedRAMP has three impact levels: Low, Moderate, and High. The Moderate baseline covers most non-classified federal workloads.
When a CSP like Cisco achieves FedRAMP Moderate authorization for a service, three things follow:
For Cisco Meraki for Government specifically, this means:
This is the part that helps you. The part that confuses people is what comes next.
The Cybersecurity Maturity Model Certification (CMMC) is a Department of Defense program that requires DIB contractors to demonstrate cybersecurity maturity before they can win contracts that involve Federal Contract Information (FCI) or Controlled Unclassified Information (CUI).
CMMC has three levels:
CMMC Level 2 is the level most DIB contractors are scoping toward. It is assessed by a C3PAO (CMMC Third-Party Assessment Organization) for most Phase 2 contracts.
The 110 practices in CMMC Level 2 cover fourteen domains:
Your C3PAO will assess all 110 practices. Some practices are network controls. Most aren’t.
Here’s where the value of Meraki for Government becomes concrete.
A subset of the CMMC Level 2 practices are network controls that the GovCloud directly supports through inherited platform controls or platform features. The practices most materially helped:
Out of 110 practices, that’s roughly 8 to 12 practices where the GovCloud migration produces direct, network-layer evidence.
The remaining ~100 practices are your organizational, procedural, and non-network technical controls. They are not addressed by a network migration.
This is the part vendor positioning gets wrong.
The GovCloud migration does not address:
Your C3PAO assesses every one of these. Your remediation work for Level 2 will touch every one of these. A network migration helps with none of them.
The point is not that FedRAMP authorization is unimportant. It is materially important for the controls it does address, and the FIPS-validated Auto VPN is genuinely the only correct way to handle CUI in transit on Meraki today. The point is that it is not a substitute for the rest of the work.
If you’re scoping toward a Level 2 assessment and your network is moving (or has moved) to Meraki for Government, here’s the right way to claim and document the inheritance:
If you’re evaluating vendors for the migration or for compliance work, ask these questions. The answers tell you whether they understand what they’re selling.
“What specific NIST 800-171 practices does the GovCloud migration help me with?” A correct answer names 8 to 12 specific practices and explains why. A wrong answer is “FedRAMP Moderate covers Level 2” or any variation of that.
“What practices does the migration not help with?” A correct answer names roughly 100 practices and groups them by domain. A wrong answer is hedging or “you’d have to ask your C3PAO.”
“Will the migration get us through CMMC certification?” A correct answer is “No. It helps with the network controls. Your C3PAO certifies the rest based on the remediation work you do across the other domains.” A wrong answer is “Yes” in any form.
“What documentation do you produce that my C3PAO can use as evidence?” A correct answer lists specific artifacts: pre-migration baselines, post-migration baselines, change logs, FIPS 140 dashboard outputs, control mapping summaries. A wrong answer is vague.
“Do you do C3PAO assessment work?” A correct answer is “No, we do not. We migrate the network and produce evidence. Your C3PAO certifies.” A wrong answer is “We can be your assessor too” — that is a conflict of interest, and you should not engage that vendor for both jobs.
FedRAMP Moderate authorization of Cisco Meraki for Government is a substantial, useful event. It means:
It does not mean:
If you’re scoping toward a Level 2 assessment, the network migration is one workstream of several. It is an important workstream because the FIPS-validated Auto VPN is the only correct path for CUI in transit on Meraki, but it is not the whole job.
The contractors who get this right end up with two partners: a network migration partner who delivers audit-ready evidence at the network layer, and a CMMC consultant or C3PAO who handles assessment and the other twelve domains. Those are different jobs that require different skill sets.
If your current vendor isn’t drawing that line clearly, that’s the signal to get a different vendor.
Boundless migrates Meraki networks and produces audit-ready configuration evidence for DIB contractors preparing for CMMC Level 2. We do not perform C3PAO assessments. We work alongside your C3PAO partner, or introduce you to one if you don’t have one yet.
1207 Delaware Ave #552, Wilmington, Delaware 19806
Americas: +1 (347) 464 6510 - EMEA: +33 (0) 181 22 12 80
