{"id":"FR2122038682","name":"iboss Government Cloud Platform (IGCP)","provider":"iBoss","providerSlug":"iboss","status":"FedRAMP Authorized","impact":"Moderate","authType":"Agency","authDate":"2022-07-25","serviceModel":["SaaS"],"deployment":"Government Community Cloud","businessFunctions":["Cybersecurity & Risk Management","Education & Training","Health & Wellness","Law Enforcement","Learning Management","Legal & Policy","Mobile Device Management (MDM)","Network Management","System Administration","Virtual Private Network (VPN)"],"assessor":"A-LIGN Compliance and Security, Inc. dba A-LIGN","assessorId":"138665","smallBusiness":true,"website":"https://www.iboss.com/","description":"FedRAMP Authorized Zero Trust Security Service Edge for Government, Defense, and Defense Industrial Base\r\nThe iboss Government Cloud Platform (IGCP) is a state-of-the-art, FedRAMP Moderate Authorized solution designed to provide Zero Trust Security Service Edge (SSE/SASE) for U.S. Federal agencies, defense contractors, Managed Security Service Providers (MSSPs), and organizations entrusted with Controlled Unclassified Information (CUI). IGCP's architecture is built to deliver Zero Trust Network Access (ZTNA), aligning with Cybersecurity Maturity Model Certification (CMMC) requirements and NIST 800-171/172 controls. This ensures compliance and robust security for sensitive government data.\r\n\r\n===== DEPLOYMENT FLEXIBILITY =====\r\nDirect Agency Deployment: Federal agencies can deploy IGCP directly as their Zero Trust SASE platform, with full control over policies, configurations, and security operations through the unified management console.\r\nMSSP Service Delivery: MSSPs can leverage IGCP's multi-tenant architecture to deliver managed security services to multiple defense contractors and federal customers from a single platform, streamlining compliance and security operations.\r\n===== COMPLIANCE FRAMEWORKS SUPPORTED =====\r\n• CMMC 2.0 Requirements (addresses 78 of 110 NIST SP 800-171 controls)\r\n• NIST SP 800-171 (Protecting CUI)\r\n• NIST SP 800-172 (Enhanced Security Requirements for CUI)\r\n• NIST SP 800-207 (Zero Trust Architecture)\r\n• NIST Cybersecurity Framework (CSF)\r\n• DFARS 7012 (Safeguarding Covered Defense Information)\r\n• CJIS (Criminal Justice Information Services)\r\n• HIPAA (Health Insurance Portability and Accountability Act)\r\n• ITAR (International Traffic in Arms Regulations)\r\n• EAR (Export Administration Regulations)\r\nGovernment agencies and defense contractors are constantly challenged by evolving cyber threats, increasing renewal costs, and the complexity of managing multiple legacy security products. To address these issues, iboss offers both direct deployment for agencies and Managed Security Service Provider (MSSP) solutions. By delivering a SaaS-based Zero Trust SASE platform and comprehensive managed security services, iboss enables organizations to shift their security focus from physical buildings to the continuous protection of people and resources, regardless of where work occurs.\r\n\r\n===== FEDERAL MSSP SASE PLATFORM FEATURES =====\r\nPurpose-built for both direct agency use and MSSP operations, the Federal MSSP SASE Platform streamlines and enhances service delivery through several key features:\r\nFor MSSPs:\r\n• Multi-Tenant Management: Allows MSSPs to manage all customers from a single, unified interface\r\n• Pooled Device Licensing: Enables licenses to be shared across tenants, providing greater flexibility\r\n• Billing in Arrears: Monthly billing cycles designed to align seamlessly with MSP operations\r\n• Audit-Ready Compliance Reports: Pre-configured CMMC and NIST 800-171 compliance reports for each tenant\r\n\r\nFor Direct Agency Deployment:\r\n• Unified Management Console: Single pane of glass for policy management, threat monitoring, and compliance reporting\r\n• Zero Trust Policy Engine: Centralized policy creation and enforcement across all users, devices, and applications\r\n• Real-Time Security Analytics: Comprehensive visibility into all network traffic and security events\r\n• Automated Compliance Monitoring: Continuous assessment against FedRAMP, CMMC, and NIST requirements\r\nThis structure supports rapid scaling while maintaining profitability and operational efficiency in the federal compliance market.\r\n\r\n===== CORE CAPABILITIES =====\r\nZero Trust Architecture (NIST 800-207 Aligned): Enforces least-privilege access and continuous verification for users, devices, and applications, eliminating implicit trust throughout the network. Implements all core Zero Trust principles including identity-based segmentation, encrypted traffic, and continuous monitoring.\r\nSecure Access Service Edge (SASE): Integrates advanced cloud security functions with wide-area networking to ensure secure and optimized connectivity for both remote and on-premises users. Converges networking and security into a unified cloud-delivered service.\r\nZero Trust Network Access (ZTNA) & VPN Replacement: Offers granular, identity-based access to applications without exposing the network, effectively replacing traditional VPNs with a secure, modern alternative. Provides application-level access control with continuous authentication and authorization.\r\n\r\nIntegrated SD-WAN Capabilities: IGCP provides native SD-WAN functionality for secure, optimized WAN connectivity, enabling intelligent traffic routing, application prioritization, and multi-link failover. Additionally, IGCP seamlessly integrates with existing third-party SD-WAN solutions, allowing organizations to enhance their current infrastructure with advanced Zero Trust security without requiring a complete replacement of their networking architecture.\r\nSecure Web Gateway (SWG): Advanced URL filtering, SSL/TLS inspection, malware detection, and content filtering to protect users from web-based threats.\r\nCloud Access Security Broker (CASB): Comprehensive visibility and control over SaaS applications, shadow IT discovery, and data loss prevention for cloud services.\r\nFirewall as a Service (FWaaS): Next-generation firewall capabilities delivered from the cloud, including intrusion prevention, application control, and threat intelligence integration.\r\nData Loss Prevention (DLP): Protects CUI and FCI from unauthorized disclosure through content inspection, contextual analysis, and policy-based blocking. Integrates with Microsoft Purview for enhanced data classification.\r\nAdvanced Threat Protection: Multi-layered defense including anti-malware, ransomware protection, sandboxing, and threat intelligence feeds to detect and prevent sophisticated attacks.\r\nContainerized Cloud Architecture: Patented isolation technology ensuring each organization's traffic is processed in dedicated containerized gateways, guaranteeing data never mixes with other customers—critical for federal data protection requirements.\r\n\r\n===== DEFENSE CONTRACTOR ENABLEMENT =====\r\n\r\nIGCP supports organizations within the Defense Industrial Base (DIB) by securing CUI, FCI, and ITAR data flows. This enables compliance with Department of Defense mandates, CMMC 2.0 requirements, and the Presidential Executive Order on Cybersecurity (EO 14028). With pre-mapped controls addressing 78 of the 110 NIST SP 800-171 requirements, IGCP significantly accelerates the path to CMMC Level 2 certification.\r\n\r\nCMMC Control Family Coverage:\r\n• Access Control (AC): 82% coverage\r\n• Audit and Accountability (AU): 100% coverage\r\n• Identification and Authentication (IA): 100% coverage\r\n• System and Communications Protection (SC): 94% coverage\r\n• System and Information Integrity (SI): 90% coverage\r\n• Incident Response (IR): 83% coverage\r\n===== KEY BENEFITS =====\r\n✓ FedRAMP Moderate Authorized Zero Trust SASE for government-grade security\r\n✓ CMMC 2.0 Compliance Accelerator addressing 78 of 110 required controls\r\n✓ NIST 800-207 Zero Trust Architecture fully aligned with federal mandates\r\n✓ Cloud-native architecture providing scalability and resilience without hardware\r\n✓ Rapid deployment for hybrid and remote workforces (cloud-delivered, no appliances)\r\n✓ Comprehensive compliance for CMMC, NIST 800-171/172, DFARS, CJIS, HIPAA, and ITAR\r\n✓ Unified Zero Trust Platform with integrated ZTNA, SWG, CASB, FWaaS, DLP, and SD-WAN\r\n✓ Containerized data isolation ensuring federal data never mixes with other customers\r\n✓ Continuous monitoring with real-time threat detection and automated incident response\r\n✓ Cost optimization by consolidating 5-8 security point products into one platform\r\n\r\n===== USE CASES =====\r\nFederal Agency Modernization: Replace legacy VPNs and security appliances with cloud-native Zero Trust, enabling secure hybrid work while reducing infrastructure costs.\r\nDefense Contractor CMMC Compliance: Achieve CMMC Level 2 certification faster with pre-mapped controls, audit-ready documentation, and integrated CUI protection.\r\nMSSP Service Delivery: Deliver FedRAMP-authorized managed security services to multiple defense contractors from a single multi-tenant platform.\r\nRemote Workforce Security: Secure access to applications and data for teleworking federal employees and contractors from any device, anywhere.\r\nCloud Migration Security: Protect agencies migrating to AWS, Azure, Google Cloud, and other cloud environments with consistent security policies.\r\nBranch Office Connectivity: Connect distributed offices, remote sites, and field operations with secure SD-WAN and Zero Trust access.\r\nThird-Party Access: Provide secure, time-limited access to contractors, partners, and vendors without VPN credentials or network exposure.\r\nIncident Response: Rapidly isolate compromised users or devices, block threats in real-time, and generate forensic audit trails for security investigations.\r\n===== TECHNICAL ARCHITECTURE =====\r\n\r\nDeployment Model: Cloud-delivered Security Access Service Edge (SASE)\r\nAgent Options: Native agents for Windows, macOS, Linux, iOS, Android; agentless options for managed devices\r\nIdentity Integration: Supports SAML, OAuth, OIDC, Active Directory, Azure AD, Okta, Ping Identity, PIV/CAC cards\r\nSIEM Integration: Native integration with Splunk, QRadar, ArcSight, Microsoft Sentinel, and other SIEM platforms\r\nAPI Access: RESTful APIs for automation, orchestration, and integration with existing security tools\r\nPerformance: Processes over 150 billion daily transactions globally with sub-10ms latency\r\nAvailability: 99.99% uptime SLA with automated failover and geo-redundant infrastructure\r\n===== SUPPORT & SERVICES =====\r\nFederal Support Team: Dedicated 24/7/365 support team with federal expertise and cleared personnel\r\nOnboarding Services: Comprehensive deployment planning, configuration, and migration services\r\nCompliance Assistance: Guidance on CMMC assessments, NIST control implementation, and audit preparation\r\n\r\nContinuous Monitoring: FedRAMP-required continuous monitoring with monthly POA&M updates\r\nSecurity Operations: Optional 24/7 managed security services including threat hunting and incident response\r\nTraining & Enablement: Administrator training, user awareness programs, and best practice workshops\r\n","logo":"https://www.fedramp.gov/assets/img/logos/CSP_logos/iboss%20Logo.png","inMarketplace":true,"agencies":["22-075","22-062"],"reuseCount":2,"leverages":["AGENCYAMAZONEW","F1508207205","FR1821856903"],"leveragedBy":[],"timeline":[{"date":"2021-08-10","to":"Agency Authorization In Process","certType":"Rev5"},{"date":"2022-02-07","to":"FedRAMP In Process","certType":"Rev5"},{"date":"2022-07-25","to":"FedRAMP Certified","certType":"Rev5"}],"cr26":{"type":"Rev5","ocrOverdue":false,"valid":true,"findings":[{"level":"warning","message":"no UEI number; include it if you have one","rule":"CDS-CSO-PUB"},{"level":"warning","message":"no business category listed","rule":"CDS-CSO-PUB"},{"level":"warning","message":"no trust center link; CR26 requires one with access instructions","rule":"CDS-CSO-UTC"},{"level":"warning","message":"no link to secure configuration guidance","rule":"SCG-CSO-RSC"},{"level":"warning","message":"no next Ongoing Certification Report date","rule":"CDS-CSO-PUB"},{"level":"warning","message":"no service list; CR26 requires the services in scope","rule":"CDS-CSO-SVC"},{"level":"warning","message":"no documentation overview (repositories) listed","rule":"CDS-CSO-PUB"}],"assessor":"A-LIGN Compliance and Security, Inc. dba A-LIGN"},"sponsor":"22-075","trustCenterCheck":null}