FedRAMP security configuration for top-level admin accounts

Configure FedRAMP administrative roles, privileged access, and security controls in Cortex Gateway.

It is important to understand how to securely configure your top-level accounts and manage privileged settings to ensure FedRAMP compliance.

Cortex uses a tiered administrative model to ensure clear separation of duties and to enforce the principle of least privilege.

Roles

• Account Administrator: This role is the highest level of administrative authority. It provides cross-instance visibility and control.

  • This role is primarily managed through Cortex. When a user is designated as a Super User within the Customer Support Portal (CSP), Cortex automatically grants them Account Administrator privileges. Through CSP, they can activate serials. Cortex automatically grants Account Administrator privileges during provisioning only if the account does not already have an existing Account Administrator.

  • To oversee all activated instances, Account Administrators access the Cortex global management console. General user access to specific tenants occurs through the Cortex Gateway based on assigned privileges. The Account Administrator role inherently grants Administrator privileges across all existing and newly provisioned tenants residing within the same CSP account.

  • Key responsibilities: Instance lifecycle (activation/decommissioning), global user governance, and account-wide security configurations.

• Instance Administrator: This role is scoped to a specific application instance (tenant).

  • The Instance Administrator can promote a standard user to an Instance Administrator for a specific environment.

  • Key responsibilities: Day-to-day security operations, local RBAC, endpoint protection profiles, and alert rule management.

Managing administrative roles

• Centralized management: Global management of tenants, users, roles, and user groups across all deployments occurs primarily through the Cortex Gateway. These centralized management capabilities are exclusively available to the Account Administrator role.

• Tenant management: The Account Administrator role enables the activation of new tenants and the creation of child tenants within MSSP environments.

• User assignment: The Account Administrator role enables assigning the Instance Administrator role to specific tenants, facilitating delegation of day-to-day operations while maintaining top-level control.

Security and access controls

This section details the management of administrative access across the platform. It covers the security requirements for active administrator roles and the specific procedures for revoking access.

Securing administrative roles

Enforce the following security measures and configurations to protect high-privilege administrative accounts from unauthorized access and compromise.

• Scope isolation: Strict logical isolation prevents an Instance Administrator from escalating privileges to other tenants.

• API key security: Account Administrator permissions require Global Management keys and cannot be applied to standard API keys.

• Audit logging: All administrative actions are recorded in an audit trail for compliance and forensic analysis.

• Enforce IP restrictions: Limit administrative console access exclusively to trusted corporate network ranges.

• Centralized identity: Integrate Single Sign-On (SSO) to enforce corporate Multi-Factor Authentication (Federal MFA) across all accounts.

• Minimize privileged accounts: Limit the total number of Account Administrators to reduce the potential impact of a compromised account.

Decommissioning roles

The following conditions govern the revocation of administrative privileges and the offboarding of users.

• Account Administrator: An Account Administrator cannot be deactivated directly. Another Account Administrator must first revoke the Account Administrator role within the Cortex Gateway before deactivating the user.

• Instance Administrator: Access is revoked when an Account Administrator or a peer Instance Administrator demotes the user or removes the user from the instance's authorized user list.

• User deactivation: Once administrative roles are removed, the user account can be deactivated within the Cortex Gateway.

• CSP removal: If Single Sign-On (SSO) is not configured, permanently revoking access requires removing the user from the Customer Support Portal (CSP) account, as the CSP globally synchronizes with Cortex environments.

Administrative settings and security implications

Account Administrator privileged settings

Account Administrators manage global settings that impact the entire organization across all tenants, including the authority to assign the Account Administrator role to other users. The following table outlines these privileged settings and their associated security implications.

Setting	Description	Security implications
Instance activation	Grants the ability to create and deploy new application instances (tenants) within the account.	High: Prevents the creation of unauthorized workspaces, which stops unexpected costs and unmonitored data usage.
Delegating admin access	Allows assigning Account Administrators or Instance Administrator roles to other users.	Critical: Secures top-level system control. Misuse grants unauthorized users full administrative power across the organization's account.
Approved IP ranges	Restricts administrative access to specific, approved network locations (such as a corporate VPN or main office network).	Critical: Acts as the primary defense against stolen passwords. Disabling this permits administrative login from any location globally.
Identity Provider (IDP) setup	Connects the platform to a corporate Single Sign-On (SSO) system for unified user logins.	Critical: Manages user logins. Enabling this enforces corporate security policies like multi-factor authentication, while disabling it forces reliance on less secure, platform-specific passwords.
Global distribution lists	Manages shared email contact lists for system-wide alerts and notifications.	Medium: Ensures important security alerts reach the correct team members across all active instances.
External IP monitoring	Enables/disables tracking of login attempts from outside the approved corporate network.	High: Disabling this limits the ability to detect repeated, unauthorized login attempts from external sources.

Instance Administrator privileged settings

Instance Administrators have full authority over a single, specific application instance, ensuring their actions cannot impact other tenants within the organization. The following table outlines these instance-level privileged settings and their associated security implications.

Setting	Description	Security implications
Local RBAC management	Creates, updates, and deletes custom roles within the specific instance.	High: Controls what users can see and do. Incorrectly set permissions can allow unauthorized users to access sensitive data or change system rules.
Job management	Controls scheduled tasks, data cleanup jobs, and automated maintenance.	Medium: Ensures the instance's operational health. Disabling critical jobs can lead to data retention issues or stale security intelligence.
Endpoint protection policies	Manages the security rules that defend devices (endpoints) against threats.	Critical: Protects devices across the network. Incorrectly configured rules can leave devices vulnerable to attacks or accidentally block legitimate business tasks.
Response and Remediation	Executes high-privilege actions such as Isolate Endpoint, Live Terminal, or File Destruction.	Critical: While essential for stopping active threats, these powerful tools can cause significant business disruption if used improperly.
Data Collection and Ingestion	Configures log sources, parsing rules, and data management for the tenant.	High: Determines what the security team can actually monitor. Disabling ingestion creates blind spots, making it much harder to detect active threats.

Administrative actions and required privileges from the Cortex Gateway

Key administrative actions managed in the Cortex Gateway, such as tenant lifecycle management, permissions, and system configurations, are detailed below with the role privileges required to complete each task.

Action	Description	Required privileges
Tenant activation	–	CSP Super User and Account Administrator
XSOAR On-Prem related	Download license/image	CSP Super User and Account Administrator
Egress configurations	–	Instance Administrator and Account Administrator
Permissions management	Manage user permissions, roles, and user groups on the account level	Account Administrator
Manage BYOK	Rotate/cancel rotation/disable keys and deactivate tenant	Account Administrator
Add child tenant	–	Account Administrator
Delete child tenant	–	Account Administrator
Add dev tenant	–	Account Administrator
Change tenant subdomain	–	Instance Administrator and Account Administrator
Change tenant name	–	Instance Administrator and Account Administrator