FedRAMP Compliance

[D-Gutierrez]

When will the BIM 360 Platform acquire the FedRAMP Compliance? We work heavily on government projects and would love to use the BIM 360 platform on all our projects but we are very limited without FedRAMP complaince.

Thanks,

David

[dtpeter2901]

So did Carla provide you an answer you can share?  Is Autodesk still looking for to gain compliance?  Or are they providing lip service saying "They're Looking into it" and "Trying to Comply"?

I've asked this question in every BIM360 Webcast I've attended and have yet to receive and answer other than "See the Security White paper". 

So any additional insight that you've gotten from Carla would be great to share.  Unless that insight is just that Carla has said she's escalated the issue.

[Anonymous]

Below is the text of my most recent email to Autodesk:

-------------------------------------------------------------------------------------

I received and reviewed the “Panda Docs” from Katy.  Thanks for the effort… Nothing new here.  Mostly background information, your BIM 360 Security White paper and audits to support your claims for SOC2 and ISO compliance.

Let me make this perfectly clear.  I DON’T CARE.

Please take the effort to read my messages.

Does anybody at Autodesk know what NIST 800-171 or CMMC is?  Please find me that person.

This is such a waste of my time and increases my level of frustration.

I have to decide what direction I need to move our daily business operations based on NO information from Autodesk.

If I find another system that is compliant, I will move all of our assets immediately.

========================================================================

Still frustrated.  I am waiting for a call to be scheduled with Autodesk's Security team... I don't know when.

[spear_kevin_pe]

I feel your frustration. As a reseller, we re privy to information under an NDA. As a member of the beta program, you also gain access to additional forward looking technology. On this matter of FEDRAMP application, we have nothing to report. Although, I suppose if anything were available under NDA, I couldn't tell you... Just know I hear your frustration. At some point you do have to make business decisions that are contrary to what you prefer. Good luck...

[Anonymous]

I have executed an NDA with Autodesk. The information they provided just related to the audits and compliance with systems I do no care about.
They are going to lose a lot of business if they do not get it together.
I need to source another option for BIM 360, any ideas?

[dtpeter2901]

Have you looked at Panzura.  It meets it if you're using a FedRamp Cloud according to their site.

Not so good if you're trying to play nice in the sandbox with others, but it's an option.

[Anonymous]

Thanks! I'll look into it.

[Anonymous]

We had to switch to Solidworks PDM with our own managed server to meet the NIST 800-171 and CMMC requirements.

[Anonymous]

I agree, a good solution for Solidworks. Autodesk's PDM does not give us the features we need for our users and customers. Our hope is that Autodesk continues on the road to FEDRAMP moderate for BIM 360. Hopefully, I will find out more details in our meeting with Autodesk in early March.

[tnieves]

autodesk continues to add so many things to bim 360. They even have rebranded it to construction cloud and combined many of the features people wanted. (finally clash detection and design in one...) yet, we can't use it on most of our projects so our company won't invest in it... So many features that would save time and streamline things. The integrated sheets would make weekly uploads a breeze and the ability to see when objects change in consultant models would be so helpful. We spend so much time reviewing consultant models to FIND what's changed or if they did changes we asked for. We have this great platform, yet the largest architecture software company in the world, can't supply architects with government required security? Embassies and government structures are getting updated all around the world. These can be giant projects with multiple buildings. the PERFECT use of a product like this. 

I honestly do not feel like Autodesk takes the need for the seriously. I've been hearing about them trying to do this for several years now. If it takes this long to even GET FEDRAMP, how long is it going to take to get to the SBU level (I believe they call it FEDRAMP grade 2 or something) I wasn't aware there were stages until recently which makes me even less hopeful.

[Anonymous]

I agree completely! After 3 months of badgering I had a meeting with Autodesk's cyber-security group.
It was a good first step and I think Autodesk is finally aware that they cannot ignore the US Government Security requirements. I am scheduled to meet again in March 2021 to discuss progress & plans toward FEDRAMP status. I will make additional posts as I receive information that I can release.

[spear_kevin_pe]

Just to be clear, BIM360 and the Construction Cloud actually are two different platforms. Current B360 Design licenses are being "rebranded" to provide access to both platforms. That allows current workflows to continue as companies come online with the new tech. Really, the point of the fedramp approval is to allow multiple parties safe & secure access to common data. B360 was the needed step for design. It didn't provide scalability for construction, O&M, and back to planning. ACC will do that.

I am hopeful that with this platform in place, the fedramp applications should now make sense.

#waittosee

[spear_kevin_pe]

duplicate posting deleted... sorry.

[Anonymous]

Bump, any status updates on this. I work for USBR and we've been requesting FEDRAMP compliance from Autodesk for years, had a meeting with them last year around this time and got the "we're working on it". If anyone has any updates it would be appreciated. 

[dtpeter2901]

The last Tidbit I heard was in an Adesk Webinare on the new Autodesk Construction Cloud.  They were listing that new/redesigned product as another step that was required to be in place in order to FedRamp.  

So no they aren't there yet, but they may have gotten one step closer.  So they're "Working" on it.

[spear_kevin_pe]

Another step forward it seems. They are hiring for fedramp purposes!

[kboruss]

I work for USACE.  I ask USACE HQ and Autodesk constantly and I can never get a clear time table on FEDRAMP certification.  We have a retired Army Col. as our Autodesk Sales Rep, and still cannot get an answer.  The response from my HQ is to make sure our USACE contractors are effectively putting the pressure on Autodesk in this is something that is needed by USACE, and those who do work for us.  So tell a friend, tell another AE, tell your subcontractors or anyone with an Autodesk contract to reach out to Autodesk and indicate 'I need you to get FEDRAMP certified'.  If the whole industry is collectively one voice to Autodesk, this can eventually get done.

[McCoy87]

It has been a while since some one posted on this thread and even longer since a response from someone at Autodesk. Is there any movement on this? Inquiring minds want to know. Reading through Autodesk's White Paper document it seems there is a lot in place to meet FedRAMP it is just a matter of getting certified. 

Could someone explain to me how the new AC Cloud does not meet FedRAMP since it uses AWS for its server storage? Is it because the data is being sent first to Autodesk and THEN to AWS? Or if it goes strait to AWS, why would it not fall under that umbrella. I am just a little ignorant to how that part works. Any information in the right direction would be helpful. 

[spear_kevin_pe]

Hi, so each step in the stack has to be approved. If you look at the different applications that are on the approved Fedramp list, they are hosted on either AWS or Azure. The Autodesk construction cloud is no different. There was recent news that they are targeting mid 2022 for fedramp approval.
https://www.synergis.com/2021/09/08/autodesk-targets-fedramp-moderate/
Hope this helps! Kevin

[spear_kevin_pe]

One thing that came up in the above webinar is that the Fedramp technology will be a separate stack for government. No co-mingling of commercial and government tech in this case. This is likely due to the Autodesk Docs foundation to the platform. Fed. Govt will need its own storage I presume. They will be called something like Autodesk Docs for Government, etc.

It's unknown yet if your existing BIM Collaborate Pro will work with that stack. I am guessing that it will. But government project owners (whomever starts the project in the platform; architect, engineer or owner) will have to use a separate license to create the project so that its hosted in the Govt version. 

[McCoy87]

Kevin,

Based on what they said in the webinar (thank you for that link by the way, super helpful) Forge, BIM Collaborate Pro, and Doc will all be under a different stack as you show below. You will have to have two separate AC Cloud licenses (Commercial and Federal), but they did say you would only need one seat of the Revit software. You would just have to sign in and out of your two Autodesk accounts to access the different projects. This was a major take away from the webinar as it means our company will have to spend more $$$

The other big takeaway is that they will not be fully FedRAMP compliant until nearly the end of 2022, which basically means 2023. Additionally, they would ONLY have an ATO for GSA. They would then have to go after DoD ATOs (USACE, NAFAC, etc.), which they said could take an additional 6 months. 

All that being said, my current understanding is that you only need to use software that is FedRAMP compliant IF you are dealing with Controlled Unclassified Information (CUI). I am still trying to wrap my head around what constitutes CUI. 

Here is the definition: 

Unclassified information can only be characterized as CUI if there is a law, regulation, or government-wide policy prescribing safeguarding or dissemination control. Agencies must not cite the Freedom of Information Act (FOIA) as a CUI safeguarding or disseminating control authority for CUI.

It is my current understanding that ONLY the contracts marked with CUI properly are ones we are required to use FedRAMP on. However, this stuff is very confusing I am finding. I am here to learn.