• Skip to primary navigation
  • Skip to main content
  • Skip to footer

Cisco Umbrella

Enterprise network security

  • Contact Sales
  • Login
    • Umbrella Login
    • Cloudlock Login
  • Search
Search
  • Why Us
    • Why Cisco Umbrella
      • Why Try Umbrella
      • Why DNS Security
      • Why Umbrella SASE
      • Our Customers
      • Customer Stories
      • Why Cisco Security
    • Fast Reliable Cloud
      • Global Cloud Architecture
      • Cloud Network Status
      • Global Cloud Network Activity
    • Unmatched Intelligence
      • A New Approach to Cybersecurity
      • Interactive Intelligence
      • Cyber Attack Prevention
      • Umbrella and Cisco Talos Threat Intelligence
    • Extensive Integrations
      • IT Security Integrations
      • Hardware Integrations
      • Meraki Integration
      • Cisco Security for Chromebook
  • Products
    • Cisco Umbrella Products
      • Cisco Umbrella Cloud Security Service
      • Recursive DNS Services
      • Cisco Umbrella SIG
      • Umbrella Investigate
      • What’s New
    • Product Packages
      • Cisco Umbrella and Cisco Secure Access Packages
      • – DNS Security Essentials Package
      • – DNS Security Advantage Package
      • – SIG Essentials Package
      • – SIG Advantage Package
      • Umbrella Support Packages
      • Cisco Umbrella for Government Packages
    • Functionality
      • DNS-Layer Security
      • Secure Web Gateway
      • Cloud Access Security Broker (CASB)
      • Cloud Data Loss Prevention (DLP)
      • Cloud-Delivered Firewall
      • Cloud Malware Protection
      • Remote Browser Isolation (RBI)
    • Man on a laptop with headphones on. He is attending a Cisco Umbrella Live Demo
  • Solutions
    • SASE & SSE Solutions
      • Your SSE journey with Cisco
      • Cisco Umbrella SASE
      • Secure Access Service Edge (SASE)
      • What is SASE
    • Functionality Solutions
      • Web Content Filtering
      • Secure Direct Internet Access
      • Shadow IT Discovery & App Blocking
      • Fast Incident Response
      • Unified Threat Management
      • Protect Mobile Users
      • Securing Remote and Roaming Users
      • Umbrella and Duo Layered Protection
    • Network Solutions
      • Guest Wi-Fi Security
      • SD-WAN Security
      • Off-Network Endpoint Security
    • Industry Solutions
      • Government and Public Sector Cybersecurity
      • Financial Services Security
        • – FTC Safeguards Rule Compliance 2023
      • Cybersecurity for Manufacturing
      • Higher Education Security
      • K-12 Schools Security
      • Healthcare, Retail and Hospitality Security
      • Enterprise Cloud Security
      • Small Business Cybersecurity
  • Resources
    • Content Library
      • Top Resources
      • Research Reports
      • Case Studies
      • Videos
      • Datasheets
      • eBooks
      • Solution Briefs
      • Cybersecurity Webinars
    • International Documents
      • Deutsch/German
      • Español/Spanish
      • Français/French
      • Italiano/Italian
      • 日本語/Japanese
    • Security Definitions
      • What is DNS Security
      • What is a Secure Web Gateway
      • What is a Cloud Access Security Broker (CASB)
      • What is Security Service Edge (SSE)
      • What is Secure Access Service Edge (SASE)
      • Cyber Threat Categories and Definitions
    • For Customers
      • Support
      • Customer Success Webinars
      • Free Trial Quick Start Guide
      • Free Trial Help and Tips
  • Trends & Threats
    • Market Trends
      • Generative AI Cybersecurity Risks and Rewards
      • Hybrid Workforce
      • Rise of Remote Workers
      • Secure Internet Gateway (SIG)
    • Security Threats
      • How to Stop Phishing Attacks
      • Malware Detection and Protection
      • Ransomware is on the Rise
      • Cryptomining Malware Protection
      • Cybersecurity Threat Landscape
      • Global Cyber Threat Intelligence
    •  
    • Woman connecting confidently to any device anywhere
  • Partners
    • Channel Partners
      • Partner Program
      • Become a Partner
    • Service Providers
      • Secure Connectivity
      • Managed Security for MSSPs
      • Managed IT for MSPs
    •  
    • Person looking down at laptop. They are connecting and working securely
  • Blog
    • News & Product Posts
      • Latest Posts
      • Products & Services
      • Customer Focus
      • Feature Spotlight
    • Cybersecurity Posts
      • Security
      • Threats
      • Cybersecurity Threat Spotlight
      • Research
    •  
    • Register for a webinar - with illustration of connecting securely to the cloud
  • Contact Us
  • Umbrella Login
  • Cloudlock Login
  • Free Trial
Clearing search keywords
Government Products & Services

Cisco Umbrella for Government: DNS Security Integrated With CISA Protective DNS

Author avatar of Christina HausmanAuthor avatar of Michael SikillianChristina Hausman and Michael Sikillian
August 29, 2024 • 4 minute read
View blog >

Cisco Umbrella for Government has achieved FedRAMP Moderate authorization*. Eligible customers can now leverage Cisco Umbrella for Government for robust DNS security and to meet the mandate for CISA’s Protective DNS with enhanced protection for on-premises and roaming client users.

Cisco Umbrella DNS-layer security proactively protects against malware and phishing attacks by blocking access to malicious websites before the browser connection is established. Umbrella for Government uniquely offers a differentiated recursive DNS-powered intelligence that quickly blocks threats, protecting users and devices, no matter where they are located, in the office or remote.  

Protective DNS is mandated by the U.S. Cybersecurity and Infrastructure Security Agency (CISA) to detect and prevent cyberattacks targeting Federal Civilian Executive Branch agencies (FCEB). U.S. Federal Civilian agencies must integrate with Protective DNS as part of the Department of Homeland Security’s mandate under Title 6 of the United States Code (USC) 663: Federal Intrusion Detection and Prevention System. It also aligns with DNS-related requirements and guidance contained in OMB M-21- 31 and M-22-09.

Cisco Umbrella for Government integrates directly with CISA Protective DNS. Developed in collaboration with CISA and Federal agencies, Umbrella supports both on-premises customers through our Virtual Appliance and hybrid/remote users running Windows, Mac, Chromebooks, iPhone and Android running the Cisco Secure Client. Umbrella customers benefit from Cisco’s industry-leading security that enhances and extends the benefits of Protective DNS while ensuring customers meet the Protective DNS mandate.

What are the benefits of the Umbrella for Government integration with Protective DNS?

The dual-protection model brings the following benefits, in addition to single-stage Protective DNS integration:

  • User-level granularity: Umbrella for Government identifies DNS traffic from individual users when they are on-premises and roaming anywhere in the world. By itself, Protective DNS can only enable policies for on-premises networks. Umbrella maintains that capability and extends it to allow fine-grained policies based on groups and individuals.
  • Policy creation: User-level granularity enables security personnel to create policies and pinpoint the source of suspicious behavior to the exact user and device anywhere in the world, enhancing Protective DNS beyond the capability to identify suspect behavior on individual on-premises networks.
  • Seamless mobile deployment: Every device running Cisco Secure Client (which includes Cisco AnyConnect VPN (Virtual Private Network)) can be integrated with Umbrella for Government, leveraging our Protective DNS integration without having to install a separate endpoint package. Protective DNS alone does not directly support mobile devices, which are required to be protected per the DHS mandate.
  • Enhanced policies, including AI (artificial intelligence): Umbrella for Government incorporates the full suite of Cisco’s commercial threat intelligence capabilities which provide a wider range of policy types than the Protective DNS service. These include AI-based policies to gate employee access to these new technologies — enhancing control while still enabling innovation.
  • Centralized reporting: The Umbrella for Government logging service has been updated to capture information on user access that was blocked by Protective DNS. These logs are available directly in the user interface (UI) and can be filtered for enhanced analysis and comparison.
  • Landing pages for blocked content: When user activity that is blocked by Umbrella for Government, users are redirected to a custom block page explaining the reason for restricting access, with a custom page built to identify Protective DNS-based policy restrictions.
Protective DNS reports in the Umbrella UI
Protective DNS reports in the Umbrella UI (underlined in red)

How does this help the customer enhance security?

Cisco Umbrella for Government simplifies the deployment, management and response to protecting on-premises and mobile devices through granular, user-based policies and reporting for security, content and application control. DNS-layer security offers proactive threat protection, reducing the number of infections and alerts seen from other security products by stopping threats at the earliest point. With threat intelligence backed by Cisco Talos, and features like resolver-native, machine learning-based and real-time DNS Tunneling protection, Umbrella for Government provides an integrated security platform.

Umbrella provides the security of encrypted DNS using DoH (DNS Over HTTPS), DoT (DNS over TLS) and DNSCrypt without added latency or the operational complexity of a VPN tunnel. Umbrella serves over 715 billion DNS requests per day to more than 30,000 enterprise customers and leverages experience of operating at scale, longevity and expertise in the DNS-layer security space since 2015.

How does the Cisco Umbrella-Protective DNS integration work?

Umbrella for Government’s approach to meet the CISA requirement uses a purpose-built integration mechanism that secures customer DNS traffic using the inspection capabilities of both Umbrella and Protective DNS.

Protective DNS-Umbrella integration flow
Umbrella-Protective DNS Integration Flow

How does the customer access the integration?

The integration with Protective DNS is a configuration option set both within the customer’s Protective DNS configuration and Umbrella’s cloud-based management. It is available at no additional charge for customers of Cisco Umbrella for Government (both DNS and the future SIG (Secure Internet Gateway) and Secure Access / Zero Trust offerings).

Selecting the Umbrella resolvers inside the PDNS page
Selecting Umbrella resolvers inside the Protective DNS page

Learn more about Cisco Umbrella for Government

Cisco Umbrella for Government reflects Cisco’s commitment to provide comprehensive, reliable cloud-native cybersecurity solutions to enable SASE (Secure Access Service Edge). In hyper-decentralized, hybrid work environments, Umbrella for Government is a crucial milestone in a long-term holistic cloud security strategy. Cisco has a full SSE (Security Services Edge) product family of Cisco Umbrella and Cisco Secure Access to address the challenging security reality of managing connectivity from anything to anywhere while simultaneously protecting against sophisticated, motivated threat actors.

Looking for more information? Check out the following resources:

  • Product Page — Cisco Umbrella: Cybersecurity for Government and Public Sector
  • Cisco Government Blog — Cisco Umbrella for Government® “Authority to Operate”
  • Product Page — Cisco FedRAMP Authorized Solutions

*Please Note: Cisco Umbrella for Government has been granted FedRAMP Moderate ATO (Authority to Operate) as of 8/1/2024.

Umbrella for Government uniquely offers a differentiated recursive DNS-powered intelligence that quickly blocks threats, protecting users and devices, no matter where they are located.

Post this quote

Additional Resources

  • Product Page — Cisco Umbrella for Government
  • Cisco Government Blog — Cisco Umbrella for Government Achieves FedRAMP Authority to Operate
  • Cisco Umbrella Free Trial

Suggested Blogs

  • Cisco Umbrella: A Leader in the GigaOm Radar for DNS Security June 26, 2024 3 minute read
  • Go Big & Go Chrome: Strengthen Cybersecurity in Education, the Enterprise & Beyond March 28, 2024 5 minute read
  • Millions of Cisco Umbrella Roaming Client Users to Benefit From Upgrading to Cisco Secure Client March 19, 2024 4 minute read

Share this blog

FacebookTweetLinkedIn
Subscribe to the Cisco Umbrella blog Subscribe

Follow Us

Facebook X LinkedIn Youtube

Footer Sections

What we make

  • Cloud Security Service
  • DNS-Layer Network Security
  • Secure Web Gateway
  • Security Packages

Who we are

  • Global Cloud Architecture
  • Cloud Network Status
  • Cloud Network Activity
  • OpenDNS is now Umbrella
  • Cisco Umbrella Blog

Learn more

  • Webinars
  • Careers
  • Support
  • Cisco Umbrella Live Demo
  • Contact Sales
Umbrella by Cisco
208.67.222.222+208.67.220.220
2620:119:35::35+2620:119:53::53
Sign up for a Free Trial
  • Cisco Online Privacy Statement
  • Terms of Service
  • Sitemap

© 2025 Cisco Umbrella