{"id":"FR2001619337","name":"Idira Identity Security Government Services Platform","provider":"Palo Alto Networks, Inc.","providerSlug":"palo-alto-networks-inc","status":"FedRAMP Authorized","impact":"High","authType":"Agency","authDate":"2024-03-14","serviceModel":["SaaS"],"deployment":"Public Cloud","businessFunctions":["Cybersecurity & Risk Management"],"assessor":"Schellman Compliance, LLC","assessorId":"136571","smallBusiness":false,"website":"https://www.cyberark.com/products/access-management/","description":"The Idira™ Identity Security Government Services Platform by Palo Alto Networks is a comprehensive solution designed to secure identities across the entire IT ecosystem, ensuring government agencies can confidently protect their most critical assets. By integrating privileged access management (PAM), access management (AM), the platform delivers a unified approach to identity security that aligns with federal compliance requirements.\r\n\r\nThe Idira Identity Security Government Services Platform is a FedRAMP High Authorized solution that integrates Privileged Access Management (PAM), Access Management (AM) into a unified identity security platform for federal agencies. The platform enforces least privilege, secures privileged credentials, and manages access across on-premises, cloud, and hybrid federal environments in alignment with NIST SP 800-53 Rev 5, FISMA, and EO 14028 Zero Trust requirements.\r\n\r\nThe platform provides robust capabilities to secure human identities, enforce least privilege, and manage access across complex infrastructures. It includes advanced tools for securing privileged credentials, automating identity lifecycle management, and applying adaptive authentication policies based on risk. Key features include:\r\n\r\n● Privileged Access Management (PAM): Secure, monitor, and manage privileged accounts and sessions to prevent unauthorized access and mitigate insider threats. Includes capabilities such as credential vaulting, session isolation, and real-time session recording with keystroke logging.\r\n\r\n● Access Management (AM): Enable secure access to applications, devices, and infrastructure with single sign-on (SSO), multi-factor authentication (MFA), and lifecycle management. Supports protocols like SAML, OpenID Connect (OIDC), and SCIM for seamless integration with third-party applications.\r\n\r\n● Hybrid and Multi-Cloud Support: Provides secure access and identity management across on-premises, cloud, and hybrid environments, with support for AWS, Azure, Google Cloud, and private cloud infrastructures.\r\n\r\nThe Idira Identity Security Government Services Platform is designed to meet the unique needs of government organizations, providing a scalable, secure, and compliant solution to protect against evolving cyber threats.\r\n\r\nIdira Identity Security Government Services Platform: Unified Access & Identity Management\r\n\r\nIdira Identity Security Government Services Platform is a cloud-based platform that unifies essential services like Single Sign-On (SSO) and Multi-Factor Authentication (MFA) into a single interface. Designed for Government Organizations, it secures access to critical resources (applications, devices, IaaS, PaaS, and VPNs) across on-premises, cloud, and hybrid environments.\r\n\r\nSSO and Application Gateway: The platform features a catalog with thousands of pre-configured application connections. Administrators can easily add custom applications via templates using SAML, OpenID Connect (OIDC), OAuth2, WS-FED, or traditional credentials. For legacy environments, the App Gateway provides secure, VPN-less access to on-prem applications, allowing for granular, per-user, and per-application access control.\r\n\r\nPhishing-Resistant MFA and High-Assurance Authentication: Idira supports a broad range of authentication methods, including FIDO2/Passkeys, Security Keys, Smart Cards, and Magic Links. These protections extend across the entire infrastructure, covering Windows and Mac workstations, servers, virtual desktops, VPNs, RADIUS servers, and 3rd-party IDPs. Adaptive MFA enhances this by evaluating real-time risk signals such as device posture, location, and network context, to apply dynamic, situation-aware authentication policies.\r\n\r\nUnified Directory Services and Hybrid Integration: Idira provides a hybrid architecture that unifies Active Directory, LDAP, and cloud-native users into a single source of truth. By utilizing a secure, outbound-only connector, agencies can bridge on-premises repositories for real-time authentication without the need for VPNs or invasive firewall modifications. This creates a centralized, high-availability identity hub that ensures consistent enterprise-wide policy enforcement while keeping sensitive identity data protected.\r\n\r\nPrivileged Access Manager SaaS for Government\r\n\r\nIdira Privileged Access Manager SaaS by Palo Alto Networks is a FedRAMP High Authorized, cloud-native solution that enables federal agencies to secure, monitor, and manage privileged access across on-premises, cloud and hybrid environments. The Service is hosted on FedRAMP-compliant infrastructure and supports agency compliance with NIST SP 800-53 Rev 5, FISMA, FIPS 140-2/140-3, OMB M-22-09, EO 14028, and CISA Zero Trust guidance.\r\n\r\nWith Idira Privileged Access Manager SaaS, government organizations can secure, monitor, and manage privileged credentials and sessions across complex infrastructures. The solution enables rapid onboarding of privileged accounts, enforces least privilege policies, and provides real-time session monitoring and recording to detect and respond to suspicious activity. This supports Cloud-Native Architecture that further simplifies deployment and reduces infrastructure overhead while ensuring high availability and scalability. It is built on a microservices architecture with containerized components for rapid updates and resilience.\r\n\r\nKey capabilities include:\r\n\r\n● Discovery and Onboarding: Automatically discover and onboard privileged accounts across on-premises, cloud, and hybrid environments. Supports integrations with Active Directory (AD), LDAP, and cloud directories like Azure AD.\r\n\r\n● Session Monitoring and Recording: Monitor and record privileged sessions in real time to detect and respond to anomalous behavior. Includes features like live session termination, command filtering, and session playback for forensic analysis.\r\n\r\n● Audit and Compliance Reporting: Generate detailed audit logs and compliance reports to meet regulatory requirements, including OMB, FIPS, FISMA, and CISA guidelines.\r\n\r\n● Credential Management and Rotation: Securely vault and automatically rotate privileged credentials across on-premises, cloud, and hybrid environments to eliminate static passwords. Includes features like automated rotation based on flexible policies, SSH key management, and the ability to verify credential synchronization to prevent unauthorized access and lateral movement.\r\n\r\nIdira Privileged Access Manager SaaS empowers government organizations to strengthen their security posture, reduce operational complexity, and ensure compliance with federal regulations, all while protecting their ecosystem from advanced cyber threats.","logo":"https://www.fedramp.gov/assets/img/logos/CSP_logos/Idira%20Logo.png","inMarketplace":true,"agencies":["22-034","22-061-01","22-062"],"reuseCount":2,"leverages":["AGENCYAMAZONEW","F1603047866","FR2001619708"],"leveragedBy":["FR2427142353","FR2001619708"],"timeline":[{"date":"2022-03-30","to":"Agency Authorization In Process","certType":"Rev5"},{"date":"2023-03-23","to":"FedRAMP In Process","certType":"Rev5"},{"date":"2024-03-14","to":"FedRAMP Certified","certType":"Rev5"}],"cr26":{"type":"Rev5","ocrOverdue":false,"valid":true,"findings":[{"level":"warning","message":"no UEI number; include it if you have one","rule":"CDS-CSO-PUB"},{"level":"warning","message":"no business category listed","rule":"CDS-CSO-PUB"},{"level":"warning","message":"no trust center link; CR26 requires one with access instructions","rule":"CDS-CSO-UTC"},{"level":"warning","message":"no link to secure configuration guidance","rule":"SCG-CSO-RSC"},{"level":"warning","message":"no next Ongoing Certification Report date","rule":"CDS-CSO-PUB"},{"level":"warning","message":"no service list; CR26 requires the services in scope","rule":"CDS-CSO-SVC"},{"level":"warning","message":"no documentation overview (repositories) listed","rule":"CDS-CSO-PUB"}],"assessor":"Schellman Compliance, LLC"},"sponsor":"22-034","trustCenterCheck":null}