FedRAMP Moderate Support
Focus
Focus
Prisma AIRS

FedRAMP Moderate Support

Table of Contents

FedRAMP Moderate Support

Deploy Prisma AIRS AI Runtime Security API Intercept inside a FedRAMP Moderate cloud boundary for U.S. federal agencies and regulated organizations.
Where Can I Use This?What Do I Need?
  • Prisma AIRS - AI Runtime Security API Intercept

Overview

Prisma AIRS AI Runtime Security now supports FedRAMP Moderate environments for API Intercept mode. This enhancement provides federal agencies, government contractors, and regulated enterprise organizations with the full spectrum of inline AI threat detection and guardrail capabilities while operating strictly inside a certified, compliance-isolated cloud boundary. By delivering parity with commercial AI security engines within a government-authorized infrastructure, public sector users can safely accelerate the adoption of Large Language Models (LLMs), generative AI apps, and agentic workflows without requiring net-new security audits.
The feature extends complete threat inspection across API deployment models. Supported AI-specific guardrails include real-time detection and mitigation of prompt injections, sensitive data leakage (DLP), toxic content, malicious URLs, SQL CRUD violations, malicious code extraction, contextual grounding failures, and custom topic restrictions. Inspection, management, and log storage occur within a FedRAMP Moderate boundary, except for URL filtering, which runs outside the boundary.
Activating FedRAMP Moderate support is integrated directly into existing administrative workflows within the Customer Support Portal (CSP) and HUB. When you create or update a deployment profile for AI Runtime Security API Intercept, you can toggle an explicit FedRAMP Moderate environment setting. Choosing this option automatically adjusts the required Flex Credit pool allocation with a standard 15% surcharge to cover the operational overhead of the compliance boundary. Once activated, the remaining onboarding, policy configuration, and log streaming steps mirror standard commercial procedures, ensuring a seamless setup for security administrators.

Onboarding and Provisioning of FedRAMP Moderate Support

  1. Create Deployment Profile in CSP.
    1. Log in to the Palo Alto Networks Customer Support Portal (CSP) or HUB.
    2. Go to ProductSoftware/Cloud NGFW Credits.
    3. Click Create Deployment Profile.
    4. Select your product line: AI Runtime Security (API).
    5. Under FedRAMP Compliance, change the dropdown from Commercial (default) to Moderate.
    6. Enter the Profile Name, token counts, and click Calculate Estimated Cost.
      Validation: Confirm that the credit allocation total reflects the 15% increase over standard commercial rates.
    7. Click Create Deployment Profile.
  2. Associate your tenant and select the dedicated region in HUB.
    1. In the CSP / HUB Deployment Profile list, locate your newly created profile and click Finish Setup.
    2. Select your Customer Support Account and specify the Recipient.
    3. Under Select Region, choose the dedicated government cloud region: United States - Government.
    4. Associate or create your Tenant within the United States - Government region.
    5. Review additional subservice bindings (e.g., Enterprise DLP, Cloud Identity Engine) and click Activate.
  3. Connect your deployment to your Strata Cloud Manager inside the FedRAMP Moderate tenant.
    Update your application or API gateway configuration to route AI prompt and completion traffic through the designated FedRAMP Moderate API proxy endpoint. For more information see Protect Agents using API Intercept.