// Module included in the following assemblies:
//
// * rosa_govcloud/rosa-fedramp-security-config.adoc

:_mod-docs-content-type: CONCEPT

[id="rosa-fedramp-overview_{context}"]
= Learn about FedRAMP Rev5 Secure Configuration Guidance (SCG) requirements

[role="_abstract"]
Federal Risk and Authorization Management Program (FedRAMP) Rev5 Secure Configuration Guidance (SCG) gives you complete coverage for all your administrative tasks. {product-title} completes all the SCG requirements for you, so you can focus on configuring your accounts to your needs.

To learn more about the about the cloud service offering requirements that {product-title} has already completed for you, see the following table: 

.Cloud service offering requirement 
[cols="1,2,3",options="header"]
|===
|Requirement
|Description
|{OCP} Solution

|SCG-CSO-RSC (Recommended Secure Configuration)
|Providers must create, keep, and make available recommendations for securely configuring their cloud services.
|Delivers comprehensive security configuration documentation covering all top-level administrative and privileged accounts.

|SCG-CSO-AUP (Authorization Package)
|Providers must include instructions in the FedRAMP authorization package that explain how to obtain and use the SCG.
|Publishes security configuration guidance on docs.redhat.com with indexed navigation, searchable table of contents, and sequential implementation procedures for all administrative security controls.

|SCG-CSO-PUB (Public Availability)
|Providers should make the SCG publicly available, enabling agency review before any procurement and implementation decisions.
|Publishes security configuration guidance on docs.redhat.com, accessible to anyone with a free Red Hat account (no subscription required). Federal procurement officers can review security implementation requirements during vendor evaluation without purchasing a subscription.

|SCG-CSO-SDF (Secure Default Settings)
|Providers SHOULD set all settings to their recommended secure defaults at service provisioning, reducing customer configuration burden.
|Deploys clusters with hardened default security configurations.
|===

In addition to the requirements, you have the option for enhanced capabilities based on your specific needs. To learn more, see the following table: 

.Enhanced capabilities 
[cols="1,2,3",options="header"]
|===
|Recommendation
|Description
|Red Hat OpenShift Solution

|SCG-ENH-CMP (Comparison)
|Comparison Capability: Providers should offer capability to compare all current settings against the recommended settings identified in the SCG.
|Gives the Compliance Operator for continuous configuration assessment against National Institute of Standards and Technology (NIST) 800-53 security control baselines. Executes automated ComplianceScan resources comparing active cluster settings to FedRAMP Moderate and High profiles.

|SCG-ENH-EXP (Export)
|Export Capability: Providers should offer capability to export all security settings in machine-readable format, such as: JSON, XML, or CSV.
|Exposes comprehensive REST APIs for programmatic security configuration management through OAuth 2.0 authentication. Supplies official client libraries supporting Python, Go, Java, and JavaScript development environments.

|SCG-ENH-API (Application Programming Interface)
|API Capability: Providers should offer capability to view and adjust security settings through the API and management console.
|Enables complete programmatic control over all security policies and configurations.

|SCG-ENH-MRG (Machine-Readable Guidance)
|Machine-Readable Guidance: Providers should also give the SCG in machine-readable format that automated compliance processes can ingest.
|Generates machine-parsable compliance assessment artifacts conforming to Open Security Controls Assessment Language (OSCAL) schema standards through the compliance operator.

|SCG-ENH-VRH (Versioning and Release History)
|Versioning and Release History: Providers should give versioning and release history of the SCG as the recommended settings change.
|Maintains version-controlled documentation tracking security configuration changes across platform releases.
|===