Regulations and technologies that keep government agencies modernized

IT modernization has become imperative for government agencies. While agencies are tasked with continually adopting technologies to keep up with the public’s expectations, those same organizations need to outpace technology trends in certain areas, such as cybersecurity. This involves moving quickly to identify what works and what doesn’t, and course-correcting in real time. 

This effort includes the inauguration of regulations and technologies that agencies can adopt to augment their commitment to cutting-edge security measures. For example, a report published by the Cybersecurity and Infrastructure Security Agency (CISA) spotlights the adoption of Zero Trust, a modern, adaptive approach to cybersecurity that continually validates access based on users’ identity. 

This post takes a deep dive into cybersecurity regulations and the approaches agencies are adopting to amp up their organizational cybersecurity measures.

To modernize organizational security protocols and stay ahead of advanced cybersecurity attack methodologies, federal government agencies established The Federal Risk and Authorization Management Program (FedRAMP), which is a government-wide program that provides a standardized approach to conduct security assessments, certifications, and continuous monitoring of cloud services, helping to accelerate the adoption of secure cloud solutions. 

Cloud technologies have grown substantially since FedRAMP’s inception in 2011. Software as a service (SaaS) offerings have expanded to leverage cloud computing for most business units across the organizational spectrum, such as infrastructure as a service (IaaS) and platform as a service (PaaS). Government agencies continue to require more commercial SaaS products, so there is an ongoing effort to alleviate risk to the endeavors of government organizations, which means FedRAMP must be an expert program that continues to evolve.   

Why FedRAMP matters

FedRAMP enables federal agencies to use advanced cloud technologies designed to ensure data protection and security. Cloud service providers (CSPs) who want to sell their services to federal agencies achieve FedRAMP certification, so they can ensure their cloud-based tools and services meet the government agencies’ standards for protecting sensitive data.

Parallelling FedRAMP is its evolution to a continuously governed infrastructure. Companies cannot maintain a static compliance model with only periodic audits. Instead, they are obligated to integrate security measures into their day-to-day operations and foster an organizational environment that contributes to the security and compliance efforts. For example, CSPs under FedRAMP must continuously demonstrate strong security practices both with their technologies and in-office security protocols through standardized controls and ongoing oversight. 

Who should certify? 

Companies needing to certify include CSPs providing as-a-service hosting for government agencies. Once certified, these companies need to transition to Collaborative Continuous Monitoring with agencies, which involves reviewing FedRAMP Certification Data. They also need to maintain contact paths with agency personnel to ensure seamless communication in the event of staff turnover and role changes.

FedRAMP updates certification-level terminology

Initially, FedRAMP used terminology that applied to both federal agencies’ information systems and commercial cloud services. This led to people inside and outside of the federal government mistakenly viewing the different impact levels of FedRAMP authorization as an equal level of risk acceptance across the entire federal government.

To alleviate confusion, in 2026, FedRAMP transitioned from the impact-level terminology. Instead of using low, moderate, and high to describe the levels, it now uses Class A, Class B, Class C, and Class D.

A growing perception within the modernization era is that there is no longer a need for printing. Forms, contracts, and other documents have all gone digital, so office printers are simply taking up space. The reality is that printing is not going away anytime soon. Government offices in the city of Cerritos, California are one example. While the city offices are headlong into a digital transformation initiative, there are members of commissions and committees that still prefer to have hard copies of particular documents. 

The Seventh Judicial Circuit of Florida has transitioned a large portion of its documents to digital format. However, certain judges require hard copies of material submissions for hearings and will not accept emailed electronic copies.

Given the amount of documentation that still goes to print, reliability and security in printing are high priorities. The Internet Printing Protocol (IPP) is an application-level protocol that serves as a communication layer for cloud-based network printing. A print job sent from a client to an IPP printer is an authenticated HTTP transaction. Upon request, IPP also supports HTTPS, which becomes IPPS, adding a security component to the print protocol.

How IPP works

A current industry trend is companies are transitioning away from legacy print server-based architectures toward more simplified, driverless functionality. IPP is a driverless printing method where users send print jobs directly to a printer through an agent over the network. Acting on requests from end users, their client workstations can submit document files for printing, as well as subsequently cancel the print jobs. End users can use the technology to query printers about their capabilities, print job status, and current state (paper out, jammed, or low toner), and set up customized printing requests. It can also influence paper size and finishing options.

Why IPP is important

Printing is often an unaddressed function and even a security vulnerability in organizations. Printers retrieve sensitive data every day, such as proprietary business information, employee records, financial statements, customer information, and classified reports. Without proper controls, that data can be exposed through unsecured print jobs, device storage, or unauthorized access. 

Legacy printing infrastructures that are built around print servers that are loaded with third-party drivers are complex, high maintenance, and costly. They also conflict with current technology security mandates, such as Zero Trust. Because the components of a server-based printing environment are within the company’s network, they are automatically trusted. The Zero Trust security approach means that no person, device, or connection is inherently trusted. The security approach verifies each user, device, and print request. With IPPS, encryption protects print data by removing the default trust within the legacy systems.

In recent years, government offices have been issuing return to office mandates, citing the importance of employees being on site. However, some offices are granting exceptions for legitimate reasons for employees to continue working remotely. These same organizations are adding data security to their remote work policies because of the risks involved with sending data to locations outside of the organization’s control. According to the policies, employees and agencies must keep government property and information secure. Implementing IPPS is one way agencies can secure their printing environment.

A significant amount of sensitive information passes through and is stored on office printers. Unfortunately, cybersecurity risks are rampant. Whether it's malware, phishing, or ransomware, the attack methods are becoming more sophisticated. While external threats are on the radar and addressed, internal threats also pose security risks that are often overlooked. 

A few scenarios where printed documents become a security vulnerability include:

• Confidential documents are occasionally left sitting on a printer tray long enough to be retrieved by an unauthorized user.

• If multiple print jobs are sent to the same printer, one person might pick up all the pages unaware that some of the pages are from a different print job that contain confidential information.

• The printer jams and a confidential document is stuck in the printer, accessible to the person who clears the jam.

In addition, the organization might not have a protected audit trail or supervisory evidence that the user followed classified document printing guidelines. 

To alleviate these events, users print to a secure network, authenticate themselves and then retrieve jobs through secure release printing. This technology adds another layer of security to the print environment when users are printing sensitive content. The functionality holds print jobs on end users’ workstations until the user is ready to pick them up. 

How secure release printing works

The technology releases documents for printing only when an authorized user is physically present at the device. Users that send secure documents to a printer are prompted to hold or print the document. Documents are held until the user who sent the document releases it at the printer.

Users can release print jobs using one of several authentication methods:

• PIN pad. Users can release print jobs by entering their Active Directory credentials or a PIN authentication.

• Badge reader. Users can activate the print job using an ID badge. The functionality also supports Common Access Cards (CAC) and Personal Identity Verification (PIV) smart cards.

• Mobile app. Users can access the print release application on a mobile device.

• Web browser. Users can use any device with browser access.

Benefits of secure release printing

Every organization that gathers and prints sensitive information benefits from secure release printing technology. The functionality enables workers to get the documents they need while making sure confidential information remains secure throughout its lifecycle.

Prevent authentication workarounds

Sharing passwords as a workaround for staff to retrieve documents and information necessary to complete tasks or conduct maintenance is a common practice in many organizations. Using a shared password renders system security measures ineffective. The system is unable to distinguish one user from another. When the system cannot tie specific actions to specific users, it weakens system security and invalidates a company’s compliance status. Requiring individual user authentication, such as badge access or a PIN entry, alleviates workarounds and keeps security protocols and compliance intact. 

Remain audit-ready

Endpoint authenticity validation contributes to a secure printing infrastructure, helping regulated organizations remain audit ready. For example, when confidential information sits unattended on a printer, it can lead to a Health Insurance Portability and Accountability Act (HIPAA) violation. With secure release printing, the release of the print job is deliberate. That means the jobs people send by mistake, the duplicate print jobs, jobs sent to the wrong printer, or the reports users no longer need, never get printed.

Technology modernization continues on an upward trajectory, and many government entities will need to be in lock step with the advancements. One constant within all this forward momentum is printing and all of the security responsibilities that come along with it. Vasion alleviates security risks with innovative, end-to-end print security technology.

• FedRAMP. Vasion is FedRAMP Class D Certified, which is FedRAMP’s overall toughest level.

• Internet Printing Protocol. Vasion uses Internet Printing Protocol (IPP) as the foundation for compatibility with Microsoft’s Windows Protected Print (WPP).

• Secure Release Printing. Vasion provides secure release printing technology, which ensures documents are secure throughout their lifecycle, never left unattended, or picked up by the wrong person.

Because printing will always be a part of an organization's operations, there will always be a need for effective device oversight, security measures, and technologies for successfully maintaining a secure print infrastructure. Learn how Vasion ensures that your print environment remains secure, reliable, and compliant. Schedule a demo.