FedRamp Secure Configuration Guide

The guide describes how to  configure and administer AMP securely, with a focus on privileged/admin account usage, security-relevant settings, and operational practices for ongoing secure use.

On this page: 

• Terminology and AMP role model 
  • Core AMP terms
  • Top-level administrative / privileged accounts in AMP terms
  • Role matrix
• Multi-Factor Authentication (MFA) and Single Sign-On (SSO)
• Secure Administration Lifecycle for Top-Level Admin Accounts
  • Secure account setup 
  • Secure configuration
  • Secure operation
  • Secure decommissioning
  • Security settings catalog
• Document details

Terminology and role model 

This section introduces the core AMP terms, top level administrative and privileged accounts, and the role matrix.  and

Core AMP terms

AMP defines several structural concepts that matter for secure administration. The following table lists the basic terms. 

Full more details, go to AMP key concepts.

Top-level administrative / privileged accounts in AMP terms

In this guide, top-level administrative accounts are the following AMP roles with privileged administrative capabilities:

• Organization Administrator: Manage users, create assets/tests, modify reports within their organization, and change organization-level settings (including Organization Testing Control)

• System Administrator: Have full AMP-wide access and can modify all organizations and system content

Role matrix

AMP includes a variety of user types based on access and licenses. Users without licenses can log in to AMP and have limited access to view and edit certain features. Licensed AMP users have full access to AMP and are divided in to users and administrators. 

• Implicit permissions:  For example., Organization Administrators can access reports/assets in their organization 

• Explicit permissions: Direct report access assigned via the report permissions user interface. This matters for secure access review and for Access Assistant behavior.

For details, go to AMP user types and permissions.

The following table describes the user types in AMP.

Note the following guidelines: 

• Multi-Factor Authentication (MFA) is configured by Level Access, at the organizational level. 

• You can't complete the MFA configuration independently. Contact Support to request the MFA setup or any changes to your current MFA settings.

To use Single Sign-On (SSO), configuration is required on both sides: 

• Setup steps within your identity provider (IdP)

• Configuration work performed by Level Access team

Our team will guide you through the required procedures, and complete the necessary configuration on our end. Once the organization-side configuration is in place, you can finalize the IdP setup, and then validate the end-to-end sign-in flow.

Secure administration lifecycle for top-level admin accounts

This section covers secure access, secure configuration, secure operation, and secure decommissioning of privileged AMP accounts.

Secure account setup 

To create or obtain a top-level admin account:

1. Select Administration.

2. Choose Create User.

3. Fill in the user's information: 

   • First name 

   • Last name 

   • Email 

4. Choose the user's role from the dropdown. 

Note: Regardless of what is selected, any user who doesn't already have a license, will be given the  Viewer role (until a license is added). 

5. Enter a temporary password for the user. 

   • Advise the user to reset their password once they've logged in.

6. Confirm optional settings:

   • Automatically create license: Select this checkbox to creates a license for the user. Licensed users have the view and edit access to all non-admin functionality in AMP. Learn more about user types and licenses. You can also assign an unmapped license.

   • Grant access to all assets: This permission gives a user access to all current assets in the organization. If the user has a license, this permission grants them edit access to all assets. For users without a license, this permission grants them the ability to view all assets.

7. Select Submit.

Perform the configuration procedure after an administrative account is created.

Note: Role assignment determines the scope of the account’s administrative access. 

To assign roles through the Administration tab:

1. Select Administration.

2. In the User Name field, search for the user you want to edit and choose their name.

3. Select Edit User.

4. Choose the user's role from the dropdown (If not specified during the initial account setup).

5. Select Submit.

Changes take effect immediately.

Secure operation

Ongoing operational practices for administrative accounts include the following activities:

• Recurring reviews of the AMP administrative accounts: Privileged access should be revalidated regularly, especially for Organization Administrators and any users with broad cross-organization visibility. Changes in job responsibilities, reorganizations, contractor transitions, and support escalations can all create permission drift if access is not periodically reviewed.

  AMP provides administrator workflows to edit, move, delete, and reset users, and the Transaction Log allows Organization/System Admins to review user-related events such as user creation time, login times, password set/reset events, and edit timestamps. This makes the Transaction Log a key operational review artifact for privileged access monitoring and account lifecycle verification.

• Secure handling of API tokens: The tokens are another ongoing admin concern. We recommend storing the token securely, for example in a password manager or secure file. To rotate a token, create a new token with the same permissions, update the consuming system to use the new token, and then delete the old token.

Secure decommissioning

Privileged access should be removed or downgraded as soon as it is no longer needed. AMP supports user deletion through the Administration area, and the Delete User workflow includes an option to transfer write privileges and report ownership to another user. This allows you to preserve continuity while removing access.

To delete a user:

1. Select Administration.

2. In the User Name field, search for the user you want to delete and choose their name.

3. Select Delete User.

4. Optional: Choose a user to transfer write privileges and report ownership to from the dropdown.

5. Select Submit. 

4. Security settings catalog

This section presents a  catalog of security-relevant AMP settings and administrative decisions, rather than a generic feature list. It documents which controls can be configured by administrators, identifies the recommended secure values or practices, and explains the security risk introduced when weaker configurations are used.

Note: AMP customers do not have direct access to the Instance Configuration page or these underlying instance settings. These controls are managed by Level Access Root Administrators on your behalf. However, you can request that specific settings be reviewed or updated for your instance, by contacting your Level Access Success representative or Support.

Use this catalog to:

• Understand which security-relevant instance-level controls exist for AMP

• Identify which values are recommended for secure deployments

• Know what to ask for when coordinating configuration changes with Level Access.