← view all case studies

AWS Cloud-Based Service Automates FedRAMP Authorization

HanaByte automates Indr’s FedRAMP Authorization for 50 to 75% faster ATO

Executive Summary

Indr, a provider of Human-Centered Transformation (HCT) SaaS solutions, partnered with HanaByte to achieve FedRAMP Moderate ATO (Authority to Operate), enabling them to offer cloud-based services to government contractors. Facing significant challenges in risk assessment and third-party audits, Indr benefited from HanaByte’s expertise in FedRAMP automation using Terraform, CI/CD pipelines, and OSCAL. Along with partner Paramify, HanaByte helped automate Indr’s compliance with adherence to NIST 800-53 guidelines and complete their System Security Plan (SSP). This partnership accelerated the process, positioning Indr to serve government contractors effectively.

About Indr

Indr provides a Human-Centered Transformation (HCT) SaaS platform focused on helping organizations improve operational efficiency, plan and execute digital transformation (DX), boost revenue generation, and drive business reinvention.

Why AWS

To meet their infrastructure needs, Indr opted for AWS due to its user-friendly cloud platform. AWS provides a scalable and secure Infrastructure as a Service (IaaS) that eliminates the need for managing backend infrastructure, allowing Indr to focus on software development.

The Challenge

A key obstacle for Indr was obtaining FedRAMP Authorization as they transitioned to the cloud. Without it, they would be unable to provide cloud-based services to government contractors, which is crucial to their business model. Securing FedRAMP Authorization is essential for assessing and mitigating risks, particularly for a company providing digital transformation tools to government agencies. To meet this requirement, Indr needed to build an AWS environment, pipelines, and a complete System Security Plan (SSP) to bridge the gap between their existing SOC 2 Type II attestation and FedRAMP.

Services Provided

AWS Services

Amazon EC2
Amazon Route 53
AWS Elastic Load Balancing (ELB)
AWS Virtual Private Cloud (VPC)
AWS Kinesis
AWS Web Application Firewall (WAF)
AWS Elastic File System (EFS)
AWS Security Hub
Amazon Inspector
Amazon S3
Amazon Config
AWS Key Management Service (KMS)
AWS Secrets Manager
Amazon Relational Database Service (RDS)
Amazon Simple Email Service (SES)
Amazon CloudWatch
AWS Backup
Amazon Elastic Beanstalk
Amazon CloudFormation

Third-Party Integrations

Paramify
Crowdstrive
Drata
Terraform

Why HanaByte

Indr chose HanaByte due to its extensive experience with FedRAMP automation and comprehensive end-to-end compliance services. They discovered HanaByte through CTO Eric Evan’s FedRAMP automation Terraform presentation, which showcased his expertise and leadership in this area. HanaByte’s role in automating Indr’s FedRAMP OSCAL version was critical, transforming Indr’s environment into a readable format and incorporating it into the SSP.

Strategy & Solution

The strategy HanaByte employed was to deliver technical solutions while also taking a consultative approach. As Indr is a start-up with limited prior experience in FedRAMP, HanaByte guided them through each step of the process, including:

Educating Indr On FedRAMP Requirements: HanaByte explained how the FedRAMP process works, what an agency would expect from the evidence being submitted, and the steps involved in risk acceptance and third-party audits.
Developing A Landing Zone: HanaByte collaborated with Paramify to create a FedRAMP-compliant landing zone using Terraform for automating infrastructure setup.
Automating FedRAMP Controls: All controls were automated per NIST 800-53 Revision 5 guidelines, ensuring the cloud environment adhered to stringent security standards.
Building Pipelines And Completing Documentation: HanaByte helped develop the necessary infrastructure but also focused on documentation. They completed the SSP by lifting configurations, detailing how to safeguard them, and addressing any policy gaps with Paramify’s help.
Consultation On Maintaining Authorization: Beyond delivering the technical elements, HanaByte’s strategy was also about helping Indr understand how to maintain its authorization post-launch. This involved educating key stakeholders, technical personnel, and support teams on how to maintain and monitor the environment once the repository was handed over.

Partner Solution

HanaByte partnered with Paramify to handle the documentation gap and ensure Indr’s SSP was up to FedRAMP standards. Together, they:

Created a landing zone using Terraform to automate the FedRAMP Authorization framework.
Automated FedRAMP controls according to NIST 800-53 Revision 5 guidelines.

Results & Benefits

Indr has achieved FedRAMP ATO, having completed the authorization process in significantly less time than the industry average. While typical FedRAMP Authorization takes 12-15 months, HanaByte’s automation reduced this timeframe to 6 months, helping Indr to achieve ATO 50 to 75% faster than in comparison to the national average.

By leveraging cutting-edge compliance automation, Indr earned ATO with limited resources and significantly accelerated its go-to-market timeline.

Next Steps

As Indr moves forward with a full FedRAMP launch, maintaining its ATO status is critical. HanaByte will continue to support Indr through:

Workshops and Training: HanaByte’s workshops are designed to educate Indr’s key stakeholders, technical personnel, and support teams on how to maintain the landing zone and ensure ongoing compliance.
Continuous Monitoring: HanaByte will provide ongoing monitoring and support to maintain Indr’s ATO status. Indr’s team will receive the completed repository, along with instructions on how to manage and sustain it, with HanaByte offering guidance on long-term compliance and risk management.

By maintaining a consultative relationship, HanaByte ensures that Indr achieves FedRAMP Authorization and can sustain it for future growth and government contracts.

About the Partner

HanaByte is a cloud security consultancy focused on compliance automation based out of Atlanta, Georgia. We are a remote-first consulting firm, working with cloud-native technologies and processes. HanaByte is an AWS APN Consulting Partner and an AWS Advanced Tier Services Partner.