FedRAMP High CDSS Single SKU
Learn about the FedRAMP High Cloud-Delivered Security Services (CDSS) Single SKU for
NGFW deployments in FedRAMP High environments.
| Where Can I Use This? | What Do I Need? |
|---|
- NGFW (Managed by Strata Cloud Manager)
- NGFW (Managed by PAN-OS or Panorama)
|
- FedRAMP High CDSS Single SKU license
- US Government Premium support license
- PAN-OS 11.1 or later
|
Palo Alto Networks® Cloud-Delivered Security Services (CDSS) subscriptions are
available for customers operating in FedRAMP High environments. You can
activate these licenses using a single FedRAMP High CDSS license which
streamlines the ordering process and enforces compliance by requiring all CDSS
subscriptions on an NGFW to operate within the same compliance
environment. You cannot mix FedRAMP High, FedRAMP
Moderate, and commercial licenses on the same NGFW.
For networking requirements and fully qualified domain names (FQDNs) for CDSS services in
FedRAMP High environments, see
FedRAMP
High
FQDNs.
The following table describes the classification requirements for the FedRAMP High
environment:
|
Device/Platform
|
Classification Requirement
|
Subscription Requirement
|
|
NGFW
Cloud NGFW
VM-Series
|
You must classify the NGFW as FedRAMP High.
You can achieve this by:
- Activating the FedRAMP High modifier license on the NGFW on your commercial Customer Support Portal account.
- Linking your commercial account to your FedRAMP Customer Support Portal account.
|
All CDSS subscriptions for the classified NGFW must use FedRAMP High SKUs. All subscriptions associated
with the NGFW must be in the same compliance environment. You
cannot mix FedRAMP High with FedRAMP Moderate or commercial licenses on the same NGFW.
|
Requirements for using the single SKU differ based on whether you want to cover your full
or partial environment with a FedRAMP High classification:
|
|
Full Estate
|
All devices in your linked commercial account have the FedRAMP High modifier license.
|
|
High Estate
|
During the quoting process, you select the portion of your estate to
classify as FedRAMP High. Only the NGFWs you
select have the FedRAMP High modifier license.
|
The Devices page on the FedRAMP Customer Support
Portal lists all devices in your linked commercial account, including devices you don't
use in FedRAMP High, and you can't filter the list. Any device with the
FedRAMP CDSS High license is a FedRAMP High device. To filter
the list, export it to CSV.
The following CDSS subscriptions are included in the single FedRAMP High SKU:
- Advanced Threat Prevention
- Advanced URL Filtering
- Advanced WildFire
- Advanced DNS Security
- Strata Cloud Manager Pro
- Enterprise DLP
- SaaS Security Inline
- Device Security
- SaaS Security Posture Management
- Data Security (SaaS Security API)
- Strata Logging Service
- Cloud Identity Engine
Use Cases
This section describes the requirements and processes for implementing the FedRAMP
High SKU across common use cases, including:
- New purchases
- Adding subscriptions to an existing NGFW
- Renewal or add-ons for existing customers
New Purchases
During the fulfillment process:
- You purchase a new NGFW.
- You indicate that the NGFW will be classified as FedRAMP High.
- You select the CDSS subscriptions you want (for example, Advanced Threat Prevention, Advanced WildFire).
- You purchase US Government Premium support, which FedRAMP High subscriptions require.
- Palo Alto Networks updates your profile to show which subscriptions are active
for FedRAMP High.
- You register and activate the NGFW on your commercial Customer Support Portal account and link it to your FedRAMP Customer Support Portal account.
Adding Subscriptions to an Existing NGFW
During the fulfillment process:
- You have an existing FedRAMP High subscription on a NGFW and want to add a new subscription (for example, adding
Advanced WildFire to an existing Advanced Threat Prevention and Advanced URL Filtering subscription).
- The system identifies the existing NGFW classification and applies the
FedRAMP High SKU to the new subscription.
- Palo Alto Networks updates your profile to reflect the added subscription with
the FedRAMP High classification.
- After you activate the new subscription on your commercial account, it appears on the Devices page of your FedRAMP Customer Support Portal.
Renewal and Add-ons for Existing Customers
During the fulfillment process:
- You currently have Advanced WildFire, Enterprise DLP, or SaaS Security Inline subscriptions.
- At renewal or when adding subscriptions, the fulfillment process requires you to
specify FedRAMP High, FedRAMP Moderate, or commercial. Mixed environments are
not supported.
Troubleshooting
Palo Alto Networks validates the authorization code when you activate a single
SKU license for an
NGFW in a
FedRAMP High
environment. When you activate a license using the
commercial Customer Support Portal, the
FedRAMP Hub, or through an
NGFW, the
following scenarios apply based on whether you are a new or existing customer.
Palo Alto Networks recommends that you file all support cases through the
FedRAMP Customer Support Portal. Open cases that contain controlled
unclassified information (CUI), or that depend on data inside the FedRAMP High boundary such as Advanced WildFire logs, in
the FedRAMP Customer Support Portal. You can open cases about the NGFW itself in either portal.
Because FedRAMP High requires US Government Premium support, cases
from either portal route to the U.S. Government Technical Assistance Center (USG
TAC).
New Customers
The following scenarios apply to new customers purchasing à la carte subscriptions
(Advanced Threat Prevention, Advanced URL Filtering, Advanced WildFire, Advanced DNS Security, Device Security, Enterprise DLP, SaaS Security Inline, Strata Cloud Manager Pro):
- First license activation—When you activate the first license, no
validation occurs. The activation can be commercial or FedRAMP
High.
- Subsequent license activation—After the first activation, an error
appears if you attempt to activate a license from a different environment
(commercial vs. FedRAMP High).
Consider the following scenarios:
Scenario 1—You activated a FedRAMP High license on an
NGFW and attempt to activate a commercial license
for the same NGFW:
Auth code {auth code} cannot be activated because there is already a
FedRamp High license activated on your Device {Serial
Number}.
Scenario 2—You activated a commercial license on an NGFW and attempt to activate a FedRAMP High
license for the same NGFW:
Auth code {auth code} cannot be activated because there is already a
commercial license activated on your Device {Serial
Number}.
Scenario 3—You activated a FedRAMP Moderate license on
an NGFW and attempt to activate a FedRAMP High license for the same NGFW:
Auth code {auth code} cannot be activated because there is already a
FedRamp Moderate license activated on your Device {Serial
Number}.
Existing Customers
If you are an existing Palo Alto Networks customer transitioning to FedRAMP High,
contact your account team to initiate the migration process. The licensing paradigm
updates your existing licenses with the FedRAMP High classification during the order
fulfillment process.
