Achieve CMMC Level 2 with GitLab Dedicated for Government

For Defense Industrial Base (DIB) companies, the U.S. Department of Defense's release of the Cybersecurity Maturity Model Certification (CMMC) Final Rule and new guidance on “FedRAMP equivalency” has dramatically increased the cost of compliance and fundamentally changed the way in which they drive their risk management programs. Gone is the era of “self-attestation” of security programs; DIB companies are required to strictly apply NIST 800-171 to their environments that handle Controlled Unclassified Information (CUI), and have their security controls audited by a Third-Party Assessment Organization (3PAO) every three years.

DIB companies are engineering focused, not compliance driven, and formal audits get pricey quickly. These changes add significant complications for companies focused on supporting the warfighter. The good news? GitLab Dedicated for Government's FedRAMP Moderate Authorization means DIB companies can directly use GitLab Dedicated for Government with no additional audits or authorizations, which reduces the impact and cost of compliance.

The foundational rule: FedRAMP Moderate Equivalency

The protection of Controlled Unclassified Information (CUI) within the DIB is driven by a foundational legal and contractual mandate: the Defense Federal Acquisition Regulation Supplement (DFARS) Clause 252.204-7012. This clause specifically states that if a contractor uses an external cloud service provider to "store, process, or transmit any covered defense information," that provider must meet security requirements "equivalent to those established by the Government for the FedRAMP Moderate baseline."

The DOD's January 2, 2024, memorandum, "Federal Risk and Authorization Management Program (FedRAMP) Moderate Equivalency for Cloud Service Provider's (CSPs) Cloud Service Offerings" defines “FedRAMP Moderate Equivalency,” and also directly specifies that FedRAMP Moderate Cloud Service Offerings (CSOs) can be used without any additional assessment, such as individual CMMC assessment, to meet equivalency requirements:

“This memorandum does not apply to CSOs that are FedRAMP Moderate Authorized under the existing FedRAMP process. FedRAMP Moderate Authorized CSOs identified in the FedRAMP Marketplace provide the required security to store, process or transmit CDI in accordance with Defense Federal Acquisition Regulations Supplement (DFARS) Clause 252.204-7012, "Safeguarding Covered Defense Information and Cyber Incident Reporting" and can be leveraged without further assessment to meet the equivalency requirements.”

The GitLab platform: A proven path to compliance

GitLab's GovCloud Offering, GitLab Dedicated for Government, has achieved FedRAMP Moderate Authorization. This means that DIB companies can leverage GitLab Dedicated for Government as their DevSecOps platform immediately and without any additional audits or compliance checks. DIB companies leveraging GitLab Dedicated for Government inherit all of our security controls and our Body of Evidence, shifting the risk and cost of compliance away from themselves and allowing them to focus on their mission.

The Shared Responsibility Matrix: Your role as a DIB contractor

While a FedRAMP-authorized solution significantly reduces your compliance burden, compliance is a joint effort. You are responsible for the security controls that fall under your purview. This is where the Shared Responsibility Matrix (SRM), also called the Customer Responsibility Matrix (CRM), comes in.

When you adopt GitLab Dedicated for Government, you will receive a comprehensive SRM that clearly delineates which security controls are managed by GitLab and which are your responsibility as the customer. Your CMMC C3PAO will use this document to ensure you have implemented the necessary controls on your end. By leveraging GitLab's FedRAMP-authorized platform, you can confidently address your CMMC Level 2 compliance requirements, focusing on your mission while trusting that GitLab has you covered.

To learn more about GitLab Dedicated for Government, visit our GitLab for Public Sector page. Interested in a demo? Contact Sales for more information at [email protected].

References

• CMMC “Final Rule” DFARS Supplement
• DOD-CIO “FedRAMP Moderate Equivalency” Memo
• GitLab Dedicated for Government FedRAMP Marketplace Listing