Author
This week, FedRAMP published one Q&A for Federal Agencies and one Tip for Cloud Service Providers(CSPs): Federal Agencies Q: What does FedRAMP Ready status mean? Is it a requirement for CSPs who would like to pursue an Agency authorization? A: FedRAMP Ready is a designation intended to demonstrate a CSP’s ability to complete the full...
This week, FedRAMP published two Q&A’s, one for Federal Agencies and one for Cloud Service Providers(CSPs): Federal Agencies Q: If a FedRAMP Authorized service offers several multi-factor authentication (MFA) methods to remotely access that service, may I use any of those forms of multifactor authentication to access the service? A:Cryptographic functions are used in many...
This week, FedRAMP published one Q&A and one Tip for Cloud Service Providers(CSPs): Cloud Service Providers (CSPs) Q: Could you explain the purpose and process behind requiring a CSP to complete an incident response test and contingency plan test before their 3PAO assessment? A: It is important that the incident response test and the contingency plan...
This week, FedRAMP published two Q&A’s for Cloud Service Providers(CSPs): Cloud Service Providers (CSPs) Q: Do the FedRAMP security controls restrict data to reside only within the United States? A:There are no FedRAMP requirements restricting data to within the United States. There are multiple security controls that detail where data is stored, what the boundary...
This week, FedRAMP published two Tips for Cloud Service Providers(CSPs): Cloud Service Providers (CSPs) TIP: Using a graphic to depict a security authorization boundary is crucial for an assessor to fully understand the security enclave that is being addressed by the CSP. The Boundary Diagram is essential in that it provides a depiction and understanding...
This week, FedRAMP published two Tips for Cloud Service Providers(CSPs): Cloud Service Providers (CSPs) TIP: Per the FedRAMP Significant Change Policies and Procedures, every new code release is not automatically considered a significant change. The CSP must perform a security impact analysis (SIA) in compliance with FedRAMP control CM-4 on every new code release. This includes...
This week, FedRAMP published two Q&A’s for Cloud Service Providers(CSPs): Cloud Service Providers (CSPs) Q: How can the CSP access the redline version of the New FedRAMP SSP template? A: Please email info@fedramp.gov to request the redlined version of the New SSP templates. We will send you zip file with all of the SSPs (including the LI-SaaS...
This week, FedRAMP published one Tip and one Q&A for Cloud Service Providers(CSPs): Cloud Service Providers (CSPs) TIP: CSP must prove to the Third Party Assessment Organization (3PAO) that Plan of Action and Milestones (POA&M) items are remediated as per the FedRAMP timeframe (Section 4.2.6 Configuration and Risk Management Item #10) High vulnerabilities are required to...
This week, FedRAMP published two Q&A’s for Cloud Service Providers(CSPs): Cloud Service Providers (CSPs) Q: Is the CSP responsible for ensuring the quality of the work performed by the Third Party Assessment Organization (3PAO)? A: While accredited 3PAOs perform security assessments of FedRAMP cloud services, the CSP is responsible for all 3PAO activities and deliverables related...
This week, FedRAMP published two Q&A’s for Cloud Service Providers(CSPs): Cloud Service Providers (CSPs) Q: Do single-tenant cloud offerings have to comply with FedRAMP, or can an agency issue a FISMA authorization? A: This should be vetted with the sponsoring government agency. For private (single tenant) clouds, agencies have the final say on authorization; however, FedRAMP...