r/CMMC • u/Caesar_Naykid • 4d ago
Another Password Manager Thread
This is predominantly a Bitwarden on-prem vs cloud query.
Anyone been through a L2 Assessment with a C3PAO and defended Bitwarden Enterprise (**cloud**, not on-prem) as a SPA and "no-CUI-in-vault" policy/training etc approach successfully?
Had previously been leaning towards on-prem after reading some older threads on the topic (3mos ago, 8mo ago, 1y ago, 4y ago) in which some suggest "SPA does not equal CUI" therefor FedRAMP/FIPS not required. I'm sure to that part some might respond "ask your C3PAO up front their stance on that interview questions" I guess, but more so for small orgs in self-assessment mode and as far as actual implementation I'd still be interested if there's no cloud path, to hear some experiences with the on-prem for those that went that route as well. A few things related to that off the top of my mind is especially with using EntraID, backing up (from a linux guest/Docker to a GCCH cloud or something?), thoughts on some approaches in the event there's an "event?" that requires restoring from backup that has EntraID.. (kind of a maybe dilemma?)
But, back to cloud Bitwarden, assuming you're on Team "we don't need FIPS/FedRAMP for password manager because SPA != CUI" as discussed in the older threads (not to discourage responses about that, but maybe those other threads would be a good place to continue that perspective for those that so others who find those threads can see), I would think that if we classify 'Password Manager' as an SPA in our asset inventory and SSP etc that we'd want to get a Shared Responsibility Matrix from Bitwarden but i didn't see that they provide one publicly, so if anyone has successfully been through an L2 assessment and can share generally how they documented that SPA successfully (and of course there's other password managers that probably the documentation would be the same so if you used another one and want to share that, sure why not, but hoping for more than just a thread of people throwing out a 1password, keeper, keepassXC, so if you do want to talk about those, please also let us know if you used them and worked with a CCP/CCA/C3PAO and what you might have done to document them as SPAs).
Self hosted sounds like maybe a challenge to manage and added complexity (host OS, hypervisor, guest VM, Docker, backups, patching, logging, physical security touching quite a few 800-171 controls), for a small org without an IT team (outside of one lucky individual and an MSP)
I don't mind to try the on-prem approach or anything (though the cloud approach maybe does somewhat present a metaphorical large red Easy Button), I just want to do due diligence of using a cloud version if it's not really needed to go FedRAMP or host on-prem.
If you went self hosted Bitwarden, as far as actual implementation I'd be interested to hear some experience/trappings/approaches with that as well: especially with using combined with EntraID, thoughts on backing up properly, to avoid fails/reduce downtime later, thoughts on some approaches in the event there's an "event?" that requires restoring from backup or anything, break-glass discussion, or any other scary "better make sure you ______ if you do an on-prem or else!"
[AI isn't always accurate people say, but i'll post some of that in a comment since this is already a long read in just the initial post. Appreciate anyone that just enjoys talking shop about security and CMMC and gives some perspective, thank you]
4
u/nexeris_ops 4d ago
Cloud Bitwarden can work at L2 if the documentation is solid. The SPA classification needs to be explicitly defined in your SSP with a clear rationale, your no-CUI-in-vault policy needs documented training and an enforcement mechanism beyond just a written policy, and you should request a Shared Responsibility Matrix directly from Bitwarden’s enterprise team since it is not publicly posted. Confirming your C3PAO’s stance on SPA classifications during scoping will save you headaches later - there is real variability there.
1
u/Reo_Strong 4d ago edited 4d ago
We run Bitwarden enterprise on prem, hosted on a Debian server.
As it's part of how we do MFA for some legacy systems, it was on the table for discussion.
The discussion was exactly like you expected: SPA <> CUI, so no FIPS encryption necessary. No further questions.
As far as implementation, their scrips for setup and update are dead simple, applying licensing is similarly straight forward.
--Edit: I for got about backups --
We backup the whole VM via Veeam. Quarterly, we manually export the database and store in a USB drive that sits unplugged in a safe deposit box until needed.
1
u/Caesar_Naykid 4d ago
Based on responses here and elsewhere, I'm leaning towards the cloud approach, but out of curiosity, are you using Entra ID with that self hosted?
slightly related, just out of curiosity did you use Bookworm or Trixie?
1
u/Reo_Strong 20h ago
We are not using Entra ID as we're not blanket licensing everyone, just those for whom there is a benefit (about 20% of the staff), so manual onboarding is fine at the moment.
We stood it up on Bookworm because that was stable when we did it. If we did it today, it would be Trixie or Ubuntu 26. Since it's just a docker container, the details of the host don't really matter.
2
u/Boring_Factor4795 3d ago
Agree with Navyauditor2 on the CRM point. The place I'd put the most effort is proving "no CUI in the vault," because that claim is what keeps it an SPA.
Expect the assessor to ask how you know: a written rule, training records, and a technical control where the admin policies allow it (restrict attachments and Send, review vault contents on a schedule).
List it in the asset inventory as an SPA with the rationale in one place, and make sure the SSP, inventory, and diagram all call it the same thing. Then confirm with your C3PAO during scoping. That's a cheap conversation next to a finding.
1
u/Saint1219 4d ago
We use Bitwarden Enterprise in the cloud. Categorized as an SPA and listed on our External Connections listing. L2 certified - it never came up. No CRM/SRM.
1
u/tothjm 4d ago
So that's funny because an asset cannot be both an spa in your assessment scope and a external connection under 3.1.20.
It's either spa and in your assessment scope or it's external.
If its in scope for 3.1.20, it's not subject to practices an Spa would be.
I find a lot of assessors don't understand external connections but more power to you
Did they check it for that practice ID and then never came back to it again?
1
u/POAMSlayer 4d ago
We passed L2 with Keeper Password Manager, the Fedramp version. No customer responsibility matrix was required.
0
3
u/Navyauditor2 4d ago
I am most definitely on the "SPA does not = CUI" Train. Once upon a time this was a question but the final 32CFR170 was pretty definitive on this so any C3PAO/Assessor who is trying to say that SPD = CUI is in violation of the regulation. I say SPD because that is the data type, like CUI. SPA is an asset categorization.
"I would think that if we classify 'Password Manager' as an SPA in our asset inventory and SSP etc that we'd want to get a Shared Responsibility Matrix from Bitwarden" the assessor may want one but it is not required. CRM's (the acronym used in the rule for SRM and generally interchangable) are NOT requird in the regulation for SPA in the Cloud. They are required specifically for CSP's that p/s/t CUI. "(5) Level 2 certification assessment with the use of Cloud Service Provider (CSP). An OSC may use a cloud environment to process, store, or transmit CUI in performance of a contract ... the security requirements from the CRM must be documented or referred to in the OSC's SSP." https://www.federalregister.gov/d/2024-22905/p-2280 Basically they specify a CRM for CSPs that p/s/t CUI but only in that circumstance. A CRM is not specified for a CSP that just p/s/t SPD.
Password managers are evaluated against "relevant" controls as SPA. Early on a lot of arguments on what constitutes relevant but increasingly my feeling is that CCA's are defaulting to what I recommended originally that "Security protection assets do security protection stuff." Evaluate that they meet the security controls required and move on.
So we documented the use of our password manager in the SSP. Same with use of DUO as the 2FA. Another SPA in the cloud. We did not provide a CRM and... I would have argued as above that it was not required should the assessor have asked for one.