# FedRAMP Certification Package Overview - Class A

## FedRAMP Certification Package Overview — Data Entry Form (FRC-CSO-PKG)

Schema: FRC-CSO-PKG · v1.0.1

<!--
This form mirrors the FedRAMP 20x Certification Package Overview (CPO) data
entry form. Each numbered section maps to a specific object/array in the
underlying JSON schema (name shown under each field). Fill in the {{...}}
placeholders and delete rows/notes that don't apply. Keep the CDS-CSO-*,
MAS-CSO-*, CMU-CSO-*, IVV-CSO-*, CPO-CSO-* control codes in section headers —
they're stable identifiers used elsewhere in the FedRAMP package, not
descriptive text to be reworded.
-->

## 1. Service Identification (CDS-CSO-PUB)

Maps to `serviceIdentification` (required object).

| Field | Value |
|---|---|
| FedRAMP ID `fedRampPackageId` | FR2631258132 |
| UEI Number `ueiNumber` |  |
| Provider Name `providerName` | Harness, Inc. |
| Service Name `serviceName` | Harness for Government |
| Service Acronym `serviceAcronym` | HARG |
| Service Description `serviceDescription` | Harness.io Software-as-a-Service (SaaS) is a fully managed, cloud-native software delivery platform that provides continuous integration, continuous delivery, security testing, and related DevSecOps capabilities using a cloud computing environment. |
| Certification Type `certificationType` — enum: 20x / Rev5 | 20x |
| Website `website` | https://www.harness.io |

---

## 2. Service Properties (CDS-CSO-PUB, CDS-CSO-IRP, CDS-CSO-UTC)

Maps to `serviceProperties` (required object).
Trust Center, Secure Configuration Guidance, and Additional Repositories all use the same "repository" shape — see Section 3.

| Field | Value |
|---|---|
| Logo URL `logo` — must end in .png/.jpg/.gif/.svg/.webp/.ico/.bmp/.tiff | https://cdn.prod.website-files.com/69e786e187c925d08ee02b90/69e786e187c925d08ee02bda_6222d7526cc398da63a4f639_nav-logo.svg |
| Service Model `serviceType` — enum: SaaS / PaaS / IaaS | SaaS |
| Deployment Model `deploymentModel` — enum: Public Cloud / Government-Only Cloud / Hybrid Cloud / Community Cloud / Government Community Cloud | Government Community Cloud |
| Business Category (pipe-separated, up to 10) `businessCategory` | Collaboration\|Cybersecurity & Risk Management\|Development Tools |
| Next Ongoing Certification Report Date `nextOngoingCertificationReportDate` | 2027-02-01 |

### Repository-shaped fields (Trust Center / Secure Configuration Guidance)

| Repository Type(s) (pipe-sep) `repositoryType` | URL `url` | Description `repositoryDescription` | Auth Required? `authentication` | Access Instructions `accessRequestInstructions` |
|---|---|---|---|---|
| Trust Center `trustCenter` | https://trust.paramify.com/harness/harness-for-government | Harness Federal Trust Center | Yes | https://support.paramify.com/hc/en-us/articles/48690571994003-Trust-Center-Deliverables-in-Paramify-Cloud |
| Secure Configuration Guidance `secureConfigurationGuidance` | https://developer.harness.io/ | Harness Platform | No |  |

---

## 3. Additional Repositories (CDS-CSO-IRP)

Maps to `serviceProperties.additionalRepositories` (array). One row per repository.
Note: if Authentication Required = Yes, Access Instructions becomes required.

| # | Type(s) (pipe-sep) | URL | Description | Auth Required? | Access Instructions |
|---|---|---|---|---|---|
| 1 | Commercial Assessment Reports and Documents | https://trust.harness.io/ | Commercial Trust Center | Yes | https://help.drata.com/en/articles/16153632-safebase-trust-center-access-levels-training-video |

---

## 4. Contact Information

Maps to `contactInformation` (array, required). Must include at least one Security contact and one Sales contact.

| # | Contact Type `contactType` | Name `contactName` | Email `contactEmail` | Phone (###-###-####) `contactPhone` |
|---|---|---|---|---|
| 1 | Security | Kevin Moy | security@harnessgov.com | 310-775-7247 |
| 2 | Sales | David Clark | sales@harness.io | 000-000-0000 |
| 3 | Primary | Kevin Moy | kevin.moy@harness.io | 310-775-7247 |

---

## 5. Independent Assessor (IVV-CSO-ICP)

Maps to `assessor` (optional object).

| Field | Value |
|---|---|
| Assessor Name `name` | N/A |
| Assessor's FedRAMP ID (6 digits) `assessorID` | 000000 |

---

## 6. Certified Services (CDS-CSO-SVC)

Maps to `certifiedServices` (array, optional). One row per service.

| # | Service Name `serviceName` | Service Description `serviceDescription` | Date Available `dateAvailable` | Security Category |
|---|---|---|---|---|
| 1 | Harness Platform | Software Delivery Platform | 2026-08-03 | Class A |
| 2 | Harness CI (Continuous Integration) | Continuous Integration | 2026-08-03 | Class A |
| 3 | Harness CD (Continuous Delivery) | Continuous Delivery & GitOps | 2026-08-03 | Class A |
| 4 | Harness STO (Security Testing Orchestration) | Security Testing Orchestration | 2026-08-03 | Class A |
| 5 | Harness IaCM (Infrastructure as Code Management) | Infrastructure as Code Management | 2026-08-03 | Class A |
| 6 | Harness CODE (Code Repository) | Code Repository | 2026-08-03 | Class A |
| 7 | Harness SCS (Supply Chain Security) | Supply Chain Security | 2026-08-03 | Class A |
| 8 | Harness DB DevOps (DBD) | Database DevOps | 2026-08-03 | Class A |
| 9 | Harness Resilience Testing | Resilience Testing | 2026-08-03 | Class A |

---

## 7. Information Resources, Flows, and Security Categories (MAS-CSO-IIR and MSA-CSO-FLO)

<!--
Repeat this block once per Security Category. Categories should map to the
system's actual data/trust boundaries (e.g. primary data store, compute,
IAM, network edge, observability/audit, external/support SaaS). Add or
remove categories to match the real architecture — don't force it into
exactly N boundaries if the system has more or fewer.
-->

| Security Category | Information Resources Included | Handled Data Types | Risk / Sensitivity Classification |
|---|---|---|---|
| Category 1: Primary Customer Data & Storage Tier | AWS - RDS/Aurora/PostgreSQL, AWS - S3 | Federal Customer Data, Controlled Unclassified Information (CUI), PII, application backups, analytical event logs | High Sensitivity — High Impact / Federal Customer Data Boundary |
| Category 2: Core Workloads & In-Memory Compute | AWS - Elastic Kubernetes Service (EKS), Virtual Machines (EC2) | Microservice execution state, in-flight transaction payloads, temporary user session caches | High / Moderate Sensitivity — Core Workload & Processing Boundary |
| Category 3: Identity & Access Management (IAM) | AWS IAM, Okta, OIDC Providers, AWS Secrets Manager | User credentials, SAML/OIDC assertions, MFA secrets, RBAC rules, administrative tokens | High Sensitivity — Privileged Management & Authentication Boundary |
| Category 4: Network Perimeter & Ingress Defense | AWS - VPC, AWS - WAF, AWS - Elastic Load Balancing, AWS - Security Groups | Network routing tables, TLS-encrypted traffic, HTTP headers, public IP metadata, WAF inspection rules | Low to Moderate Sensitivity — Public Edge & Network Routing Boundary |
| Category 5: Observability, Security & Audit Logging | AWS - SecurityHub / GuardDuty, AWS - CloudTrail / CloudWatch, Google SecOps | System API call audits, runtime security alerts, infrastructure metrics, security telemetry, dashboard configs | Moderate Sensitivity — System Management & Audit Boundary |
| Category 6: External Enterprise & Support SaaS | Google Workspace, Zendesk | Support tickets, customer communication logs, internal documentation | Low to Moderate Sensitivity — Third-Party SaaS Service Boundary |

---

## 8. Third-Party Information Resources (MAS-CSO-TPR)

Maps to `thirdPartyInformationResources.certified` and `.nonCertified` (arrays, optional).

### FedRAMP-Certified Third Party

| # | FedRAMP-Certified Third Party `fedRampCertifiedThirdPartyInformationResource` | FedRAMP ID | Use Case `useCase` |
|---|---|---|---|
| 1 | AWS GovCloud | — | IaaS provider for all cloud resources — FedRAMP High certified infrastructure |

### Non-Certified

| # | Non-Certified Name `name` | Provider `provider` | Website `website` | Use Case `useCase` |
|---|---|---|---|---|
| 1 | Google Workspace | Google LLC | https://workspace.google.com | Corporate email and collaboration — internal business communications |
| 2 | Google SecOps | Google LLC | https://cloud.google.com/security-operations | SIEM for security monitoring — security logs and telemetry |
| 3 | Zendesk | Zendesk, Inc. | https://www.zendesk.com | Customer support ticketing — support request management |
| 4 | Okta | Okta, Inc. | https://www.okta.com | Identity Provider for SSO/MFA — federated authentication |

---

## 9. Cryptographic Module Documentation (CMU-CSO-CMD)

<!--
One row per distinct crypto-module-bearing resource class (KMS keys, S3,
EBS, RDS, EC2, EKS, ElastiCache, Secrets Manager, ACM certs, load
balancers, VPC flow logs, etc). Status enum: Compliant / Partial Compliant /
Non-Compliant (or equivalent). A resource using two crypto modules
(e.g. KMS at-rest + AWS-LC TLS in-transit) lists both in the same row,
slash-separated, matching the pattern in the sample rows.
-->

| # | Resource | Resource Type | Crypto Module | CMVP Cert # | FIPS Standard | Security Level | Sunset Date | Status |
|---|---|---|---|---|---|---|---|---|
| 1 | AWS KMS Keys | Key Management Service | AWS KMS HSM | #4523 | FIPS 140-3 | Level 3 | 2028-03-15 | Compliant |
| 2 | S3 Buckets | Object Storage | AWS KMS HSM (SSE) | #4523 | FIPS 140-3 | Level 3 | 2028-03-15 | Compliant |
| 3 | RDS Instances | Relational Database | AWS KMS HSM | #4523 | FIPS 140-3 | Level 3 | 2028-03-15 | Compliant |
| 4 | EBS Volumes | Block Storage | AWS KMS HSM | #4523 | FIPS 140-3 | Level 3 | 2028-03-15 | Compliant |
| 5 | AWS Secrets Manager | Secrets Management | AWS KMS HSM | #4523 | FIPS 140-3 | Level 3 | 2028-03-15 | Compliant |
| 6 | Elastic Load Balancers | Load Balancer / TLS Termination | AWS-LC Cryptographic Module (TLS) | #4631 | FIPS 140-3 | Level 1 | 2028-06-20 | Compliant |
| 7 | VPC FIPS Endpoints | VPC Endpoint | AWS-LC Cryptographic Module (FIPS endpoint) | #4631 | FIPS 140-3 | Level 1 | 2028-06-20 | Compliant |
| 8 | ACM Certificates | TLS Certificate Management | AWS-LC Cryptographic Module | #4631 | FIPS 140-3 | Level 1 | 2028-06-20 | Compliant |
| 9 | EKS Clusters (2) / EC2 Instances — in-transit TLS | Compute / Container Orchestration | AWS-LC Cryptographic Module | #4631 | FIPS 140-3 | Level 1 | 2028-06-20 | Compliant |

---

## 10. Certification Package Overview Metadata (CPO-CSO-MTD)

Form generated from schema `FRC-CSO-PKG`. Pair with the matching converter script to regenerate JSON from a filled-in copy of this page.

### Point of Contact

| # | Name | Title | Contact Information | Role |
|---|---|---|---|---|
| 1 | Kevin Moy | Director, GRC | kevin.moy@harness.io | Responsible and accountable for the FedRAMP Certification Package |

### Version History

| # | Version | Date and Time of Last Update | Source of Update |
|---|---|---|---|
| 1 | 4 | 2026-11-02T18:26:52Z | Automated |

---

*Generated against schema `FRC-CSO-PKG` · v1.0.1*