FedRAMP Certified. GovRAMP Authorized.
The Innovative Driven Government Cloud (IDGC) provides a governed cloud environment for sensitive government and regulated data. Maintaining these certifications requires continuous monitoring, recurring vulnerability testing and reporting, and independent assessment.
-
FedRAMP
Certification
since 2018 -
GovRAMP
Authorized
since 2022 -
1 PB
data capacity
Federal Agencies Authorized to Use IDGC
Department of the Treasury
Federal Housing Finance Agency
Federal Deposit Insurance Corporation
Office of the Comptroller of the Currency
FHFA Office of the Inspector General
More Than FedRAMP-Certified Software
FedRAMP certification goes beyond secure cloud software, encompassing the technology, infrastructure, security controls, personnel practices, documentation, and ongoing monitoring used to protect sensitive data. For law firms, that distinction matters: using a FedRAMP-certified application alone does not necessarily mean the provider or the surrounding eDiscovery workflow is FedRAMP-certified.
How Is FedRAMP Certification Maintained?
Independent Assessment + Documented Controls
Achieving certification requires providers to implement and document security controls across areas such as access management, encryption, vulnerability management, system configuration, physical security, incident response, and personnel security. Providers must also demonstrate through independent assessment that those controls are implemented and operating as intended.
Personnel + Matter Access
Evaluating where data is hosted is only part of the equation. Who can access it, and what controls govern that access, are just as important. In a certified environment, security extends to the people with access through personnel-security controls, access agreements, role-based access practices, and screening requirements appropriate to their responsibilities.
Continuous Monitoring
Certification is not a point-in-time exercise. Providers continuously monitor their systems, identify and remediate vulnerabilities, maintain current security documentation, and meet ongoing reporting requirements. For Rev5 environments like IDGC, that includes annual 3PAO assessments, recurring vulnerability scanning, and maintaining current Plans of Action and Milestones (POA&Ms), with security findings and remediation activities managed throughout the life of the certification.
Is FedRAMP Right for Your Data Needs?
Frequently Asked Questions About FedRAMP and GovRAMP
Using a FedRAMP-certified application is different from working with a provider that operates in a FedRAMP-certified eDiscovery environment.
A platform may offer a government-specific, FedRAMP-certified deployment. But, law firms should also understand the security posture of the provider configuring the environment, processing the data, administering user access, supporting review teams, and applying additional technologies such as generative AI.
The question isn’t: “Is the software FedRAMP certified?” It’s, “Is the environment and the way my matter will actually be handled, operating within the required FedRAMP controls?”
As an example, a highly popular FedRAMP-certified cloud service requires each of their service providers to manage 81 of the 688 security controls required for FedRAMP Class C certification. Do you want to be using an environment with a provider that isn’t audited by a certified FedRAMP auditor for those controls to ensure your data is secure? Where will the blame lie if a breach occurs?
Since 2018, Innovative Driven Government Cloud is FedRAMP Certified at Class C (Moderate), providing law firms with an eDiscovery environment in which the technology, security program, operational processes, and ongoing compliance requirements are managed as part of the broader certified offering.
No. Not every matter involving a government agency or government-related data requires FedRAMP, but it might be more than you think. If the data is Controlled Unclassified Information (CUI), then it must be held at an agency, a FedRAMP-certified provider or a CMMC certified contractor.
The requirement generally depends on how federal information is being handled and the specific agency use case. FedRAMP applies to cloud services used to create, collect, process, store, or maintain federal information on behalf of a federal agency, subject to defined exclusions.
For law firms, that means the need for a FedRAMP-certified environment may arise when litigation, investigations, regulatory responses, or other engagements involve non-public or sensitive federal information that must be processed or maintained in the cloud. Because the applicability can vary by agency, matter, and data type, counsel should confirm the applicable requirements before selecting the eDiscovery environment.
GenAI Within Our FedRAMP-Certified Environment
Forest AI brings generative AI into sensitive litigation, investigations, and regulatory matters. Client documents, prompts, and AI outputs aren’t used to train, fine-tune, or improve underlying AI models, and Forest uses enterprise model services subject to no-training protections. Client content remains within the matter-specific workflow, extending the security and governance of the FedRAMP-certified environment to AI-enabled legal work.
- Document Summarization
- Privilege Log Drafting
- Document review
- Internal Investigations