{"id":"FR2201340492","name":"KnowBe4 Platform","provider":"KnowBe4, Inc.","providerSlug":"knowbe4-inc","status":"FedRAMP Authorized","impact":"Moderate","authType":"Agency","authDate":"2023-11-14","serviceModel":["SaaS"],"deployment":"Public Cloud","businessFunctions":["Cybersecurity & Risk Management","Education & Training"],"assessor":"Fortreum, LLC","assessorId":"201664","smallBusiness":true,"website":"https://www.knowbe4.com/federal","description":"The KnowBe4 Platform includes the following in-scope: KSAT Learning Management System and all included training content (ModStore, Compliance Plus), KSAT Simulated Phishing Platform, PhishER / PhishER Plus, Phish Alert Button, SecurityCoach (SCH) and AI Defense Agents (AIDA) (excluding AIDA Deepfakes).\r\n\r\nKnowBe4 products currently excluded from scope: Free Tools (SecondChance, RanSim, Password Exposure Test, Weak Password Test, Breached Password Test, Browser Password Inspector), AIDA Deepfakes, KCES (KnowBe4 Cloud Email Security of Defend / Prevent), Protect, Workspace and Webform.\r\n\r\nKSAT (KnowBe4 Security Awareness Training), which includes security awareness training and simulated phishing, is designed to provide users with an interactive platform to better manage IT security problems of social engineering, spear-phishing, and ransomware attacks. The ModStore and Compliance Plus are libraries of available training modules that can be used within the KSAT platform or in external learning management systems.\r\n\r\nPhishER (and its add-on PhishER Plus) is a Security Orchestration, Automation, and Response (SOAR) platform that can be used to manage emails that KSAT users report as suspicious or malicious. The purpose of this platform is to provide an organization with a way to evaluate suspicious emails making it through to the inbox of users.\r\n\r\nSecurityCoach (SCH) helps strengthen your organization’s security culture by delivering immediate feedback to your users at the moment risky behavior occurs.\r\n\r\nAI Defense Agents (AIDA) is a suite of AI Agents for human risk management that continuously automates administration and content personalization so security teams can focus on strategic risk decisions rather than operational tasks. Each included AIDA Agent is optional to enable.\r\n\r\nThe Phish Alert Button (PAB) is an optional component placed in the inbox of a customer end user. This allows end users to report a suspected phishing simulation and any suspicious email message to their security team. The PAB integrates with KSAT and PhishER / PhishER Plus.\r\n\r\nKnowBe4 products share a central configuration and authentication settings area located within the KnowBe4 Platform. This is included in scope and is used throughout the KnowBe4 suite of products.","logo":"https://www.fedramp.gov/assets/img/logos/CSP_logos/KB4%20Logo.png","inMarketplace":true,"agencies":["22-051","22-007","22-007-07","22-007-27","22-007-22","22-002","22-021-06","22-021-01","22-061","22-042-02","22-027-06","22-032","22-031","22-031-01","22-003","22-068","22-013","22-074","22-040","22-044","22-069","22-058"],"reuseCount":23,"leverages":["AGENCYAMAZONEW","FR1919750997","FR2120962552","F1508207205","FR1823447014","FR1821856903"],"leveragedBy":["FR2427142353","FR2430123303","FR1902240018","FR2433985791"],"timeline":[{"date":"2022-08-11","to":"Agency Authorization In Process","certType":"Rev5"},{"date":"2023-02-03","to":"FedRAMP In Process","certType":"Rev5"},{"date":"2023-11-14","to":"FedRAMP Certified","certType":"Rev5"}],"cr26":{"type":"Rev5","ocrOverdue":false,"valid":true,"findings":[{"level":"warning","message":"no UEI number; include it if you have one","rule":"CDS-CSO-PUB"},{"level":"warning","message":"no business category listed","rule":"CDS-CSO-PUB"},{"level":"warning","message":"no trust center link; CR26 requires one with access instructions","rule":"CDS-CSO-UTC"},{"level":"warning","message":"no link to secure configuration guidance","rule":"SCG-CSO-RSC"},{"level":"warning","message":"no next Ongoing Certification Report date","rule":"CDS-CSO-PUB"},{"level":"warning","message":"no service list; CR26 requires the services in scope","rule":"CDS-CSO-SVC"},{"level":"warning","message":"no documentation overview (repositories) listed","rule":"CDS-CSO-PUB"}],"assessor":"Fortreum, LLC"},"sponsor":"22-007","trustCenterCheck":null}