FRC-CLA-MFR Mandatory FedRAMP Rules for Class A

Providers seeking a Class A FedRAMP Certification MUST address all rules in this FedRAMP Class A Certification subset (FRC-CLA) AND the following additional FedRAMP Class A rules; the appropriate artifacts or information mapping for all rules MUST be supplied in the FedRAMP Certification Package.

• FedRAMP Certification: FRC-CSO-PKG (FedRAMP Certification Package)
• FedRAMP Certification: FRC-CSO-JSN (FedRAMP JSON Schemas)
• FedRAMP Certification: FRC-CSO-POP (Pick One Program Certification Type)
• Minimum Assessment Scope: MAS-CSO-IIR (Identify Information Resources)
• Certification Data Sharing: CDS-CSO-PUB (Public Information)
• Certification Data Sharing: CDS-CSO-UTC (Use Trust Centers)
• Certification Data Sharing: CDS-UTC-AAD (Agency Access Denial)
• Addressing FedRAMP Communication: AFC-CSO-INB (Maintain a FedRAMP Security Inbox)
• Addressing FedRAMP Communication: AFC-CSO-RCV (Receive Email Without Disruption)
• Addressing FedRAMP Communication: AFC-CSO-CRA (Complete Required Actions)
• Incident Evaluation and Communication: IEC-CSO-EFR (Evaluate FedRAMP Reportability)
• Incident Evaluation and Communication: IEC-CSO-FIR (Final Incident Report)
• Vulnerability Detection and Response: VDR-CSO-DET (Vulnerability Detection)
• Collaborative Continuous Monitoring: CCM-OCR-AVL (Report Availability)
• Collaborative Continuous Monitoring: CCM-OCR-NRD (Next Report Date)
• Independent Verification and Validation: IVV-CSX-AIA (Annual Independent Assessments for 20x)
• Security Decision Record: SDR-CSX-KSI (Key Security Indicators)
• Key Security Indicators: KSI-CMT-LMC (Logging Changes)
• Key Security Indicators: KSI-CNA-RNT (Restricting Network Traffic)
• Key Security Indicators: KSI-CED-RAT (Reviewing All Training)
• Key Security Indicators: KSI-IAM-AAM (Automating Account Management)
• Key Security Indicators: KSI-IAM-APM (Adopting Passwordless Methods)
• Key Security Indicators: KSI-INR-RIR (Reviewing Incident Response Procedures)
• Key Security Indicators: KSI-SVC-SIN (Securing Information)

Notes

Some of these specific FedRAMP rules may not have similar counterparts in external frameworks and providers will need to implement new processes to follow these rules.

In general, for each of these FedRAMP requirements, providers should include a sufficiently detailed summary that reviewers will not need to dig into the related security framework materials to understand the related decisions - just saying "see SOC 2 report" is not particularly helpful.

Information about how the provider addresses the included Key Security Indicators are required to receive a class A certification even if the provider intends to pursue a Rev 5 Program Certification path in the future.

Related rules: FRC-CSO-POP, MAS-CSO-IIR, CDS-CSO-PUB, CDS-CSO-UTC, CDS-UTC-AAD, AFC-CSO-INB, AFC-CSO-RCV, AFC-CSO-CRA, IEC-CSO-EFR, IEC-CSO-FIR, VDR-CSO-DET, CCM-OCR-AVL, CCM-OCR-NRD, IVV-CSX-AIA, FRC-CSO-PKG, FRC-CSO-JSN, SDR-CSX-KSI, KSI-CMT-LMC, KSI-CNA-RNT, KSI-CED-RAT, KSI-IAM-AAM, KSI-INR-RIR, KSI-SVC-SIN, KSI-IAM-APM

Defined terms: Artifacts, Certification Data, Certification Package, Certification Path, Certification Type, FedRAMP Security Inbox, Final Incident Report (FIR), Incident, Information Resource, Initial Incident Report (IIR), Minimum Assessment Scope, Ongoing Certification Report (OCR), Security Decision Record (SDR), Trust Center, Validation, Verification, Vulnerability, Vulnerability Detection, Vulnerability Response

1. Přehled

1.1 Odkazy

• FRC-CSO-POP Pick One Program Certification Type
• MAS-CSO-IIR Identify Information Resources
• CDS-CSO-PUB Public Information
• CDS-CSO-UTC Use Trust Centers
• CDS-UTC-AAD Agency Access Denial
• AFC-CSO-INB Maintain a FedRAMP Security Inbox
• AFC-CSO-RCV Receive Email Without Disruption
• AFC-CSO-CRA Complete Required Actions
• IEC-CSO-EFR Evaluate FedRAMP Reportability
• IEC-CSO-FIR Final Incident Report
• VDR-CSO-DET Vulnerability Detection
• CCM-OCR-AVL Report Availability
• CCM-OCR-NRD Next Report Date
• IVV-CSX-AIA Annual Independent Assessments for 20x
• FRC-CSO-PKG FedRAMP Certification Package
• FRC-CSO-JSN FedRAMP JSON Schemas
• SDR-CSX-KSI Key Security Indicators
• KSI-CMT-LMC Logging Changes
• KSI-CNA-RNT Restricting Network Traffic
• KSI-CED-RAT Reviewing All Training
• KSI-IAM-AAM Automating Account Management
• KSI-INR-RIR Reviewing Incident Response Procedures
• KSI-SVC-SIN Securing Information
• KSI-IAM-APM Adopting Passwordless Methods
• FRD-ART Artifacts
• FRD-CRD Certification Data
• FRD-CRP Certification Package
• FRD-CPH Certification Path
• FRD-CTY Certification Type
• FRD-FSI FedRAMP Security Inbox
• FRD-FIR Final Incident Report (FIR)
• FRD-INT Incident
• FRD-IRS Information Resource
• FRD-IIR Initial Incident Report (IIR)
• FRD-MAS Minimum Assessment Scope
• FRD-OCR Ongoing Certification Report (OCR)
• FRD-SDR Security Decision Record (SDR)
• FRD-TRC Trust Center
• FRD-VLN Validation
• FRD-VRF Verification
• FRD-VUL Vulnerability
• FRD-VLD Vulnerability Detection
• FRD-VLR Vulnerability Response

1.2 Identifikované požadavky

1.3 Související regulace

2. Identifikované požadavky

3. Související regulace

• FedRAMP Consolidated Rules -

  EN: FedRAMP® Consolidated Rules of the Federal Risk and Authorization Management Program, U.S. General Services Administration (GSA), https://www.fedramp.gov/, from their machine-readable version (FedRAMP/rules). Works of the U.S. Government are not subject to copyright protection in the United States (17 U.S.C. § 105; GSA website policies); GSA dedicated its machine-readable FedRAMP content to the public domain worldwide (CC0 1.0). FedRAMP® is a registered trademark of GSA; GRCA is not affiliated with, nor endorsed by, GSA or FedRAMP. Divided into sections and converted into the GRCA format, the wording unchanged, linked to the NIST SP 800-53 controls they name. Only the version published by FedRAMP is authoritative.

  DE: FedRAMP® Consolidated Rules des Federal Risk and Authorization Management Program, U.S. General Services Administration (GSA), https://www.fedramp.gov/, aus ihrer maschinenlesbaren Fassung (FedRAMP/rules). Werke der US-Regierung sind in den USA urheberrechtlich nicht geschützt (17 U.S.C. § 105; Website-Richtlinien der GSA); die GSA hat ihre maschinenlesbaren FedRAMP-Inhalte weltweit gemeinfrei gestellt (CC0 1.0). FedRAMP® ist eine eingetragene Marke der GSA; GRCA steht in keiner Verbindung zur GSA oder zu FedRAMP und wird von ihnen nicht unterstützt. In Abschnitte aufgeteilt und in das GRCA-Format umgewandelt, der Wortlaut unverändert, mit den genannten Controls aus NIST SP 800-53 verknüpft. Maßgeblich ist allein die von FedRAMP veröffentlichte Fassung.