FRC-CLA FedRAMP Class A Certification Rules

Providers seeking a FedRAMP Class A Certification MUST have completed a certification or equivalent process, including an independent assessment if applicable, from one of the following alternative security frameworks within the past 12 months:

• FedRAMP Rev5 (including FedRAMP Ready) at any historical Impact Level
• SOC 2 Type II
• GovRAMP at any Impact Level

Defined terms: Security Category

Providers seeking a FedRAMP Class A Certification MUST supply the following materials from their alternative security framework assessment to all necessary parties:

• SOC 2 Type II: Complete report, bridge or gap letter (if applicable), verified audit engagement documentation, estimated schedule for upcoming report, supplemental compliance evidence (if applicable)
• FedRAMP Ready: Readiness Assessment Report, Security Assessment Plan, and any other materials required by FedRAMP.
• GovRAMP: Readiness Assessment Report, Security Assessment Plan, and any other materials required by GovRAMP.

Defined terms: All Necessary Parties, Verification

Providers seeking a Class A FedRAMP Certification MUST address all rules in this FedRAMP Class A Certification subset (FRC-CLA) AND the following additional FedRAMP Class A rules; the appropriate artifacts or information mapping for all rules MUST be supplied in the FedRAMP Certification Package.

• FedRAMP Certification: FRC-CSO-PKG (FedRAMP Certification Package)
• FedRAMP Certification: FRC-CSO-JSN (FedRAMP JSON Schemas)
• FedRAMP Certification: FRC-CSO-POP (Pick One Program Certification Type)
• Minimum Assessment Scope: MAS-CSO-IIR (Identify Information Resources)
• Certification Data Sharing: CDS-CSO-PUB (Public Information)
• Certification Data Sharing: CDS-CSO-UTC (Use Trust Centers)
• Certification Data Sharing: CDS-UTC-AAD (Agency Access Denial)
• Addressing FedRAMP Communication: AFC-CSO-INB (Maintain a FedRAMP Security Inbox)
• Addressing FedRAMP Communication: AFC-CSO-RCV (Receive Email Without Disruption)
• Addressing FedRAMP Communication: AFC-CSO-CRA (Complete Required Actions)
• Incident Evaluation and Communication: IEC-CSO-EFR (Evaluate FedRAMP Reportability)
• Incident Evaluation and Communication: IEC-CSO-FIR (Final Incident Report)
• Vulnerability Detection and Response: VDR-CSO-DET (Vulnerability Detection)
• Collaborative Continuous Monitoring: CCM-OCR-AVL (Report Availability)
• Collaborative Continuous Monitoring: CCM-OCR-NRD (Next Report Date)
• Independent Verification and Validation: IVV-CSX-AIA (Annual Independent Assessments for 20x)
• Security Decision Record: SDR-CSX-KSI (Key Security Indicators)
• Key Security Indicators: KSI-CMT-LMC (Logging Changes)
• Key Security Indicators: KSI-CNA-RNT (Restricting Network Traffic)
• Key Security Indicators: KSI-CED-RAT (Reviewing All Training)
• Key Security Indicators: KSI-IAM-AAM (Automating Account Management)
• Key Security Indicators: KSI-IAM-APM (Adopting Passwordless Methods)
• Key Security Indicators: KSI-INR-RIR (Reviewing Incident Response Procedures)
• Key Security Indicators: KSI-SVC-SIN (Securing Information)

Notes

Some of these specific FedRAMP rules may not have similar counterparts in external frameworks and providers will need to implement new processes to follow these rules.

In general, for each of these FedRAMP requirements, providers should include a sufficiently detailed summary that reviewers will not need to dig into the related security framework materials to understand the related decisions - just saying "see SOC 2 report" is not particularly helpful.

Information about how the provider addresses the included Key Security Indicators are required to receive a class A certification even if the provider intends to pursue a Rev 5 Program Certification path in the future.

Related rules: FRC-CSO-POP, MAS-CSO-IIR, CDS-CSO-PUB, CDS-CSO-UTC, CDS-UTC-AAD, AFC-CSO-INB, AFC-CSO-RCV, AFC-CSO-CRA, IEC-CSO-EFR, IEC-CSO-FIR, VDR-CSO-DET, CCM-OCR-AVL, CCM-OCR-NRD, IVV-CSX-AIA, FRC-CSO-PKG, FRC-CSO-JSN, SDR-CSX-KSI, KSI-CMT-LMC, KSI-CNA-RNT, KSI-CED-RAT, KSI-IAM-AAM, KSI-INR-RIR, KSI-SVC-SIN, KSI-IAM-APM

Defined terms: Artifacts, Certification Data, Certification Package, Certification Path, Certification Type, FedRAMP Security Inbox, Final Incident Report (FIR), Incident, Information Resource, Initial Incident Report (IIR), Minimum Assessment Scope, Ongoing Certification Report (OCR), Security Decision Record (SDR), Trust Center, Validation, Verification, Vulnerability, Vulnerability Detection, Vulnerability Response

Providers seeking a Class A FedRAMP Certification SHOULD address the following additional recommended FedRAMP Class A rules (if applicable):

• Certification Data Sharing: CDS-CSO-AVR (Availability Reporting)
• Certification Package Overview: CPO-CSX-CPM (Certification Package Maintenance for 20x)
• Incident Evaluation and Communication: IEC-CSO-IIR (Initial Incident Report)
• Incident Evaluation and Communication: IEC-CSO-OIR (Ongoing Incident Reports)
• Vulnerability Detection and Response: VDR-TFR-MVX (Persistent Machine Verification and Validation for 20x)
• Vulnerability Detection and Response: VDR-TFR-PCD (Persistently Complete Detection)
• Vulnerability Detection and Response: VDR-TFR-PDD (Persistent Drift Detection)
• Vulnerability Detection and Response: VDR-TFR-PSD (Persistent Sample Detection)
• Vulnerability Detection and Response: VDR-TFR-PVR (Mitigation and Remediation Expectations)
• Vulnerability Evaluation and Reporting: VER-TFR-EVU (Evaluate Vulnerabilities Quickly)

Related rules: CDS-CSO-AVR, CPO-CSX-CPM, IEC-CSO-IIR, IEC-CSO-OIR, VDR-TFR-MVX, VDR-TFR-PCD, VDR-TFR-PDD, VDR-TFR-PSD, VDR-TFR-PVR, VER-TFR-EVU

Defined terms: Certification Data, Certification Package, Drift, Incident, Initial Incident Report (IIR), Ongoing Incident Report (OIR), Persistently, Validation, Verification, Vulnerability, Vulnerability Detection, Vulnerability Response

Providers seeking a Class A FedRAMP Certification MAY address the following additional optional FedRAMP Class A rules (if applicable):

• Collaborative Continuous Monitoring: CCM-QTR-MTG (Quarterly Review Meeting)
• Certification Data Sharing: CDS-CSO-PSM (Per-Service Certification Materials)
• Cryptographic Module Use: CMU-CSO-UVM (Using Validated Cryptographic Modules)
• FedRAMP Certification: FRC-APP-FIA (Fresh Independent Assessment)
• Independent Verification and Validation: IVV-CSO-FIA (FedRAMP Independent Assessments)
• Security Decision Record: SDR-CSX-KMT (Key Security Indicator Metrics)
• Vulnerability Evaluation and Reporting: VER-TFR-IRI (Internet-Reachable Incidents)
• Vulnerability Evaluation and Reporting: VER-TFR-MRH (Historical Activity)
• Vulnerability Evaluation and Reporting: VER-TFR-NRI (Non-Internet-Reachable Incidents)

Related rules: CCM-QTR-MTG, CDS-CSO-PSM, CMU-CSO-UVM, FRC-APP-FIA, IVV-CSO-FIA, SDR-CSX-KMT, VER-TFR-IRI, VER-TFR-MRH, VER-TFR-NRI

Defined terms: Certification Data, FedRAMP Independent Assessment, Incident, Quarterly Review, Security Decision Record (SDR), Validation, Verification, Vulnerability

Providers seeking a FedRAMP Class A Certification MAY have the FedRAMP Certification Package independently verified and validated by a FedRAMP Recognized assessor before submission to FedRAMP.

Defined terms: Certification Package, FedRAMP Recognized, Validation, Verification