Blog
Last week, FedRAMP published one Tip and one Q&A for Cloud Service Providers(CSPs) : Cloud Service Providers (CSPs) TIP: Cloud Service Providers (CSPs) pursuing a JAB P-ATO have asked about how to implement new technologies. New technologies have a minimum control set in the significant change policy and procedures. The assumption is that all the...
This week, FedRAMP published one Tip and one Q&A for Cloud Service Providers(CSPs) : Cloud Service Providers (CSPs) Tip: Recently, we’ve received inquiries about the SAR review process for CSPs pursuing a JAB Provisional Authorization to Operate (P-ATO). There are a number of things that JAB Reviewers need in order to properly assess risks noted in...
This week, FedRAMP published several Q&A’s for Cloud Service Providers(CSPs) : Cloud Service Providers (CSPs) Here are some basic questions our FedRAMP SMEs get about FIPS 140-2 validation compliance for Multi Factor Authentication (MFA). Q: I hear FIPS-validation does not apply to One-Time-Password (OTP) authentication. Is this true or false? A: This is FALSE! You...
Last week, FedRAMP published one Q&A for Cloud Service Providers(CSPs) and one Q&A for Federal Agencies: Cloud Service Providers (CSPs) Q: What are FedRAMP baseline requirements for a Cloud Service Offering (CSO) to become a High Baseline System? 1) There should be no interconnections to systems or services lacking FedRAMP Authorization. For JAB P-ATOs, interconnections...
This week, FedRAMP published one Tip and one Q&A for Cloud Service Providers(CSPs) : Cloud Service Providers (CSPs) TIP: All FedRAMP Baselines require the CSP information system to accept and electronically verify Personal Identity Verification (PIV) and Common Access Card (CAC) credentials according to IA-2(12). Many CSP’s assign the responsibility of PIV/CAC implementation to the...
This week, FedRAMP published one Tip and one Q&A for Cloud Service Providers(CSPs) : Cloud Service Providers (CSPs) TIP: When submitting a Security Assessment Report (SAR) package to your 3PAO, a few simple quality checks will help ensure a timely review: Ensure the SAR Template text is unchanged, except for the removal of instructional text....
This week, FedRAMP published two Q&A’s for Cloud Service Providers(CSPs) : Cloud Service Providers (CSPs) Q: Can a CSP simply go from an Agency ATO to a JAB P-ATO without going through the JAB Authorization effort? A: A CSP interested in transitioning their Agency ATO to a JAB P-ATO must go through the JAB P-ATO process....
This week, FedRAMP published one Tip for Cloud Service Providers(CSPs) and one Q&A for Third Party Assessment Organizations(3PAOs): Cloud Service Providers (CSPs) TIP: Be sure that monthly Continuous Monitoring (ConMon) scans are submitted in the same format each month. Failure to submit in a consistent, approved format can lead to a Detailed Finding Review or...
This week, FedRAMP published one Tip one Q&A for Cloud Service Providers(CSPs): Cloud Service Providers (CSPs) TIP: At the FedRAMP briefing to discuss the SAR findings, the CSP may be called upon to provide a system overview/ architecture briefing. The CSP should also be prepared to discuss the status of the SAR findings, including: ○...
This week, FedRAMP published one Q&A for Federal Agencies and one Q&A for Cloud Service Providers(CSPs): Federal Agencies Q: Once a Deviation Request (DR) has been submitted for downgrading risk from High to Moderate, should CSP create a new POA&M ID and another separate DR for downgrading risk from Moderate to Low? A: The original...