FedRAMP Rev 5 Secure Configuration guidance

Document version
Version: 1.0.0
Last Updated: 2026-02-26

This Secure Configuration Guidance document fulfills the FedRAMP Rev5 Recommended Secure Configuration (FRR-RSC) requirement for Cloud Service Providers (CSPs) to publish publicly accessible configuration guidance for customers and authorized users. Aurigo Masterworks Cloud is a FedRAMP-authorized SaaS platform for capital program management, serving public sector agencies across transportation, utilities, and federal infrastructure programs.

This document covers the Administration and Account Management domain of Masterworks Cloud, specifically addressing:

• User Account lifecycle management—creation, modification, and deactivation
• Security Role definition, assignment, and permission configuration
• Roles and Permissions matrix—granular module-level access control
• Administrative account protection, including System Admin and Customer Admin accounts
• Import/export controls and audit capabilities

This guidance applies to all Masterworks Cloud tenants operating in FedRAMP-authorized environments. Guidance covers both platform-level (Aurigo-managed) and tenant-level (customer-configurable) controls.

Masterworks Cloud defines two built-in top-level administrative account tiers that control enterprise-wide access to the platform. These are provisioned by Aurigo at tenant onboarding and cannot be deleted.

The following controls MUST be applied to all top-level administrative accounts:

• Multi-Factor Authentication (MFA): All Administrator and Customer Admin accounts have MFA enforced. Masterworks supports TOTP-based authenticator apps and hardware tokens via the platform’s authentication layer (Azure AD / SAML 2.0 federation).
• Federated Identity: Masterworks supports SSO via SAML 2.0/Azure AD with their agency Identity Provider (IdP), ensuring administrative accounts are governed by the agency’s MFA policy.
• No Shared Credentials: Administrative accounts must never be shared. Each administrator requires a uniquely identified account with individual audit traceability.
• Strong Password Policy: Where local authentication is used, passwords meet NIST SP 800-63B requirements — minimum 12 characters, no complexity rules, checked against compromised-password lists.
• Session Timeout: Administrative sessions must time out after 15 minutes of inactivity. This is configurable by the Customer Admin under Administration > Session Settings.

Only Administrators can configure additional administrators by adding users to an Administrator role.

The following steps must be followed upon administrative personnel separation or role change:

• Immediate Disable: Navigate to Administration > User Management > User Accounts. Locate the user, select Inactive Account. This immediately revokes all active sessions.
• Role Removal: Remove all Security Role assignments from the user record within 24 hours of separation.
• Audit Review: Export audit logs for the departing administrator covering the last 90 days and archive per agency records retention policy.
• Account Retention: Do not delete user accounts. Retain in disabled state for 3 years to preserve audit trail continuity. After 3 years, archive the record per data retention policy.
• Inactive user accounts will not be able to login to the application.

Security Roles are the foundational access control mechanism of Masterworks Cloud. They are the functional grouping of users based on their job function, analogous to job designations within the agency. All application-level permissions are derived from Security Role assignments.

Key characteristics of the Security Roles model:

• A single user can be assigned multiple Security Roles. Permissions from all assigned roles are combined (additive model — no role negation).
• Security Roles apply at the application module level. Project-level access is controlled separately through Project Team membership.
• The built-in ‘Administrator’ role grants all permissions and cannot be modified. It should be assigned only to personnel designated as system administrators.
• The built-in ‘User’ role has zero permissions and serves as the default assignment for all new users, implementing a deny-all provisioning baseline.
• Custom roles are created by Customer Admin users and can be scoped precisely to the modules and permissions required by each job function.
• Only Customer Admin or Administrators can define Security Roles and Permissions.

• Audit Log: All privileged actions including Security Role creation, permission changes, and user account modifications are logged to the Masterworks Audit Log.
• Export: At any point, current configurations of security roles and permissions can be exported to understand current configurations and make appropriate changes.

All newly created Masterworks Cloud user accounts are provisioned in a deny-all state by default, implementing a zero-trust access baseline:

• Built-in ‘Administrator’ role: All permissions enabled, cannot be modified or deleted. Assign only to designated system administrators.
• Built-in ‘User’ role: All permissions disabled, cannot be modified or deleted. This is the zero-trust baseline role for all new accounts.
• Custom roles: Created with zero permissions by default. Permissions are explicitly granted through the Permissions configuration page.
• New module deployment: When new modules are added to Masterworks (e.g., through a product update), the permissions for the new module are set to Disabled for all custom roles by default. Admins must explicitly enable permissions for each role.

• Session Timeout: 30 minutes (recommended baseline). Configure to 15 minutes for FedRAMP High environments.
• Audit Logging: Enabled by default for all events. Cannot be disabled by Customer Admins.
• Export/Import: Import validation is enabled by default, preventing malformed data from being injected via the Excel import mechanism.

Masterworks Cloud provides a full export of the Permissions configuration in Excel format. This export contains the complete role-permission matrix and serves as the primary mechanism for baseline comparison and drift detection.

The Security Roles list page also supports export, providing a snapshot of all defined roles and their descriptions.

All exports are available in Excel format only currently.

Masterworks supports bulk import for Security Roles and Permissions via Excel:

• Security Roles Bulk Import: Download the import template from the Import/Export menu. Populate with Role Name and Description. Import via the Upload option. Records are validated (alphanumeric, field length limits) before insertion.
• Permissions Bulk Import: Download the permissions template with existing data, modify Y/N values per module and role, and re-import. The system validates the format and applies the delta.

Currently Masterworks APIs are used for business processes with appropriate authentication mechanisms, however there are no APIs for accessing or updating system or security configurations as there has not been business use cases on the same and could have potential security implications.

All configurations are exportable to an excel format.