Who is this article for?

Ideagen EHSQ Enterprise or Decani authorizing officials or IT security teams.

FedRAMP environments require strict access.

CONTROLLED DOCUMENT NOTICE
This document contains security-relevant configuration guidance for Ideagen Government Cloud (IGC), a FedRAMP Moderate Authorized cloud service (Package ID: FR2429166928). Distribution is limited to agency Authorizing Officials, System Owners, ISSOs, and authorized administrators. Do not reproduce.

1. Introduction

1.1 Purpose

This Secure Configuration Guide (SCG) provides Federal agency customers with clear, actionable instructions for securely configuring Ideagen Government Cloud (IGC), the EHS Enterprise platform. It is published in accordance with FedRAMP Rev5 Balance Improvement Release requirement SCG-CSO-RSC (effective March 1, 2026) and is grounded in the IGC System Security Plan (SSP) v1.1 (FedRAMP Package ID: FR2429166928).

The guide explains the security implications of common settings, identifies required configurations for top level administrative and privileged accounts, and empowers agency ISSOs, System Owners, and administrators to configure IGC in alignment with their FedRAMP compliance obligations.

1.2 How to Obtain and Use This Guide

FedRAMP Requirement – SCG-CSO-AUP: 

Providers MUST include instructions in the FedRAMP authorization package that explain how to obtain and use the Secure Configuration Guide. This section fulfils that requirement.

• This guide is made available to authorized agency personnel through the following channels:
  FedRAMP Marketplace / Authorization Package: Referenced within the IGC FedRAMP authorization package (Package ID: FR2429166928) at https://www.fedramp.gov/marketplace/products/FR2429166928. Agency ISSOs and System Owners are directed to this document as part of the authorization package.
• Ideagen Customer Support: The current version is available to agency customers through Ideagen's customer support channels under the FedRAMP / Compliance documentation category. Contact your 
  Ideagen account representative for access.
• Direct Request: Agencies may request the latest version by contacting security@ideagen.com or their Ideagen Customer Success Manager.
• Public Version: In accordance with FedRAMP SCG-CSO-PUB, a version of this guide is made publicly available through the FedRAMP Marketplace listing for Package FR2429166928.

How to use this guide:

• Before Initial Provisioning: Review Sections 3, 4, and 5 in full before creating accounts or configuring SSO. This establishes the required security baseline.
• Initial Configuration Verification: Complete the checklist in Section 8 immediately after SSO configuration and initial account provisioning. Retain as evidence for SSP Appendix J (CRM).
• Annual FedRAMP Review: Re-verify all required items in the Section 8 checklist as part of each annual FedRAMP assessment cycle.
• Privileged Account Changes: Consult Section 3 (Application Administrator) or Section 4 (Product Administrator, Module Developer, Ideagen personnel access) before any changes to privileged accounts.
• ISSO Compliance Documentation: The Section 8 checklist serves as structured evidence for agency AC-2, IA-2, AU-2, and related control implementations. Document the verifying official and date for each line item.

1.3 Scope

This guide applies to all FedRAMP Moderate authorized deployments of Ideagen Government Cloud – EHS Enterprise (Package ID: FR2429166928). It covers:

• Top-level administrative account provisioning, configuration, and decommissioning
• Privileged account roles and security-relevant settings
• Identity and authentication configuration – including mandatory SSO integration with the agency Identity Provider (IdP)
• Audit logging and monitoring settings
• User and access management including deprovisioning
• Secure decommissioning procedures

Infrastructure-level controls – cloud hosting configuration, vulnerability scanning, EDR, and SIEM ingestion – are Ideagen-managed, documented in the SSP, and are not customer-configurable.

1.4 Audience

• Authorizing Officials (AOs) – to understand the overall security posture achievable through correct 
  configuration
• ISSOs – to verify and document configuration compliance against SSP controls and the Customer Responsibility Matrix (CRM)
• System Owners – to understand customer responsibilities in the IGC CRM
• Application Administrators (individuals holding the UACA role) – to implement and maintain secure configuration settings

1.5 Mandatory SSO Compliance Requirement

MANDATORY FedRAMP COMPLIANCE REQUIREMENT – Agency SSO Integration Required For FedRAMP compliance, ALL agency users of Ideagen Government Cloud MUST authenticate via Single Sign-On (SSO).

 

IGC uses Okta (FedRAMP Package ID: F1512167750), managed entirely by Ideagen, as its authentication platform. Agencies do not configure Okta directly. Instead, agencies connect their own Identity Provider (IdP) to the Ideagen Okta instance via SAML 2.0 or OIDC. Direct username/password authentication to IGC is NOT compliant with the IGC FedRAMP Moderate authorization.

 

The system's Digital Identity Level is IAL2/AAL2/FAL2, which requires multi-factor authentication via FIPS 140-validated cryptography. AAL2 MFA must be enforced by the agency IdP for all users accessing IGC. Agencies that have not yet configured SSO must treat this as a Priority 1 remediation action and document the gap in their POA&M with a target completion date.

See Section 5 for complete SSO integration instructions.

1.6 Relationship to Other FedRAMP Documentation

This guide supplements but does not replace the following IGC FedRAMP documentation:

• SSP v1.1 (FedDoc-201, January 6, 2026) – the authoritative security blueprint for IGC (FedRAMP Package FR2429166928)
• SSP Appendix J – CIS and CRM Workbook – defines shared control responsibilities between Ideagen and agency customers
• SSP Appendix F – Rules of Behavior – governs acceptable use by agency personnel
• SSP Appendix I – Incident Response Plan
• SSP Appendix N – Continuous Monitoring Plan

NOTE:

Where this guide conflicts with agency-specific policies, the more restrictive control applies. Document any deviations from recommended settings in the agency POA&M

Download a full copy of the Ideagen Government Cloud FedRAMP Secure Configuration Guide: