Blog
This week, FedRAMP published two Q&A’s for Cloud Service Providers(CSPs) : Cloud Service Providers (CSPs) Q: Can a CSP simply go from an Agency ATO to a JAB P-ATO without going through the JAB Authorization effort? A: A CSP interested in transitioning their Agency ATO to a JAB P-ATO must go through the JAB P-ATO process....
This week, FedRAMP published one Tip one Q&A for Cloud Service Providers(CSPs): Cloud Service Providers (CSPs) TIP: At the FedRAMP briefing to discuss the SAR findings, the CSP may be called upon to provide a system overview/ architecture briefing. The CSP should also be prepared to discuss the status of the SAR findings, including: ○...
This week, FedRAMP published one Q&A for Federal Agencies and one Q&A for Cloud Service Providers(CSPs): Federal Agencies Q: Once a Deviation Request (DR) has been submitted for downgrading risk from High to Moderate, should CSP create a new POA&M ID and another separate DR for downgrading risk from Moderate to Low? A: The original...
This week, FedRAMP published one Q&A for Federal Agencies and one Tip for Cloud Service Providers(CSPs): Federal Agencies Q: What does FedRAMP Ready status mean? Is it a requirement for CSPs who would like to pursue an Agency authorization? A: FedRAMP Ready is a designation intended to demonstrate a CSP’s ability to complete the full...
This week, FedRAMP published two Q&A’s for Cloud Service Providers(CSPs): Cloud Service Providers (CSPs) Q: Do the FedRAMP security controls restrict data to reside only within the United States? A:There are no FedRAMP requirements restricting data to within the United States. There are multiple security controls that detail where data is stored, what the boundary...
This week, FedRAMP published one Tip and one Q&A for Cloud Service Providers(CSPs): Cloud Service Providers (CSPs) TIP: CSP must prove to the Third Party Assessment Organization (3PAO) that Plan of Action and Milestones (POA&M) items are remediated as per the FedRAMP timeframe (Section 4.2.6 Configuration and Risk Management Item #10) High vulnerabilities are required to...
This week, FedRAMP published two Q&A’s for Cloud Service Providers(CSPs): Cloud Service Providers (CSPs) Q: Is the CSP responsible for ensuring the quality of the work performed by the Third Party Assessment Organization (3PAO)? A: While accredited 3PAOs perform security assessments of FedRAMP cloud services, the CSP is responsible for all 3PAO activities and deliverables related...
What if your computer could recognize your mood and deliver everyday work content to you based on your feelings and emotions? Cognitive Services, now adds facial and emotion recognition features to its customers through the company’s cloud platform, Microsoft Azure Government. This was announced during the recent Tech Summit event in Washington, DC. But what...
One thing you can bet on with Azure Government is constant updates from Microsoft every month of the year. This year has some of the biggest updates in the history of this popular cloud software. In March, one new exciting add to Azure Government was Publish to Web, an inside feature through the recently added...
This week, FedRAMP published a weekly tip that discusses requirements for vulnerability scanning: Q: What are the FedRAMP requirements for vulnerability scanning? A: Vulnerability scanning must occur for Operating System (OS)/ infrastructure, databases, and web application components in the Cloud Service offering authorization boundary. The scanning parameters for the components must be defined in the Security...