Blog
This week, FedRAMP published one Q&A and one Tip for Cloud Service Providers(CSPs): Cloud Service Providers (CSPs) Q: Could you explain the purpose and process behind requiring a CSP to complete an incident response test and contingency plan test before their 3PAO assessment? A: It is important that the incident response test and the contingency plan...
This week, FedRAMP published two Q&A’s for Cloud Service Providers(CSPs): Cloud Service Providers (CSPs) Q: Do the FedRAMP security controls restrict data to reside only within the United States? A:There are no FedRAMP requirements restricting data to within the United States. There are multiple security controls that detail where data is stored, what the boundary...
This week, FedRAMP published two Q&A’s for Cloud Service Providers(CSPs): Cloud Service Providers (CSPs) Q: How can the CSP access the redline version of the New FedRAMP SSP template? A: Please email info@fedramp.gov to request the redlined version of the New SSP templates. We will send you zip file with all of the SSPs (including the LI-SaaS...
This week, FedRAMP published one Tip and one Q&A for Cloud Service Providers(CSPs): Cloud Service Providers (CSPs) TIP: CSP must prove to the Third Party Assessment Organization (3PAO) that Plan of Action and Milestones (POA&M) items are remediated as per the FedRAMP timeframe (Section 4.2.6 Configuration and Risk Management Item #10) High vulnerabilities are required to...
This week, FedRAMP published two Q&A’s for Cloud Service Providers(CSPs): Cloud Service Providers (CSPs) Q: Is the CSP responsible for ensuring the quality of the work performed by the Third Party Assessment Organization (3PAO)? A: While accredited 3PAOs perform security assessments of FedRAMP cloud services, the CSP is responsible for all 3PAO activities and deliverables related...
This week, FedRAMP published one Tip for Federal Agencies and one Q&A for Cloud Service Providers(CSPs): Federal Agencies TIP: During Continuous Monitoring, the Agency Authorizing Official (AO) is responsible for ensuring that the security posture of the cloud service their Agency is using continues to be acceptable. The responsibility for the AO (or his/her designated...
This week, FedRAMP published one Q&A and one Tip for Cloud Service Providers(CSPs): Cloud Service Providers (CSPs) Question: Does a CSP need to submit an Significant Change Request (SCR) for a system name change? Answer: CSPs are not required to submit an SCR for a system name change. However, CSPs are required to notify the FedRAMP...
This week, FedRAMP published two Tips for Cloud Service Providers(CSPs): Cloud Service Providers (CSPs) TIP: Submitting an Operational Requirement Deviation Request (DR) is typically acceptable when updating the host would break FIPS compliance. However, it is critical that CSPs continuously re-evaluate FIPS certification to determine when updates become FIPS compliant. Consequently, the Operational Requirements would no...
This week, FedRAMP published two Tips for Cloud Service Providers(CSPs): Cloud Service Providers (CSPs) TIP: A CSP is required to submit a Significant Change Request (SCR) when they intend to change their vulnerability scan tool. While the requirement for notification is a minimum of 30 days before implementing a significant change, in order to allow enough time...
This week, FedRAMP published two Tips for Cloud Service Providers(CSPs): Cloud Service Providers (CSPs) TIP: When possible, upload embedded documents as System Security Plan (SSP) attachments as an additional method for document retrieval. This is helpful for when embedded links are broken. For example, if a document is converted to PDF, embedded documents will no...