CCM-OCR-AVL Report Availability

Providers MUST supply an Ongoing Certification Report to all necessary parties every 3 months, covering the entire period since the previous summary, in a consistent format that is human readable; this report MUST include high-level summaries of at least the following information (if applicable):

• Changes to FedRAMP Certification Data
• Planned changes to FedRAMP Certification Data during at least the next 3 months
• Accepted vulnerabilities
• Transformative changes
• Updated recommendations or best practices for security, configuration, usage, or similar aspects of the cloud service offering
• A list of all agencies that are directly using the product
• FedRAMP Reportable Incidents or an attestation that no such incidents occurred
• Lessons learned and changes planned or made as a result of FedRAMP Reportable Incidents (if such occurred)

Timeframe: 3 months

Artifacts

• Most recent Ongoing Certification Report. If the report is not available, the provider MUST provide a sample report that includes all required information.
• How the report will be delivered

Schema: FedRAMP Ongoing Certification Report (CCM-OCR-AVL)

NIST SP 800-53 Rev. 5 controls: CA-7

Defined terms: Accepted Vulnerability, All Necessary Parties, Certification Data, Cloud Service Offering, FedRAMP Certification Report, FedRAMP Reportable Incident, Incident, Ongoing Certification, Ongoing Certification Report (OCR), Transformative Change, Vulnerability

1. Übersicht

1.1 Referenzen

• CA-07 Continuous Monitoring
• FRD-ACV Accepted Vulnerability
• FRD-ANP All Necessary Parties
• FRD-CRD Certification Data
• FRD-CSO Cloud Service Offering
• FRD-FCR FedRAMP Certification Report
• FRD-FRI FedRAMP Reportable Incident
• FRD-INT Incident
• FRD-ONC Ongoing Certification
• FRD-OCR Ongoing Certification Report (OCR)
• FRD-TRF Transformative Change
• FRD-VUL Vulnerability
• FRC-CSO-PKG FedRAMP Certification Package
• FRC-CLA-MFR Mandatory FedRAMP Rules for Class A

1.2 Identifizierte Anforderungen

1.3 Zugehörige Regulierungen

2. Identifizierte Anforderungen

3. Zugehörige Regulierungen

• FedRAMP Consolidated Rules -

  EN: FedRAMP® Consolidated Rules of the Federal Risk and Authorization Management Program, U.S. General Services Administration (GSA), https://www.fedramp.gov/, from their machine-readable version (FedRAMP/rules). Works of the U.S. Government are not subject to copyright protection in the United States (17 U.S.C. § 105; GSA website policies); GSA dedicated its machine-readable FedRAMP content to the public domain worldwide (CC0 1.0). FedRAMP® is a registered trademark of GSA; GRCA is not affiliated with, nor endorsed by, GSA or FedRAMP. Divided into sections and converted into the GRCA format, the wording unchanged, linked to the NIST SP 800-53 controls they name. Only the version published by FedRAMP is authoritative.

  DE: FedRAMP® Consolidated Rules des Federal Risk and Authorization Management Program, U.S. General Services Administration (GSA), https://www.fedramp.gov/, aus ihrer maschinenlesbaren Fassung (FedRAMP/rules). Werke der US-Regierung sind in den USA urheberrechtlich nicht geschützt (17 U.S.C. § 105; Website-Richtlinien der GSA); die GSA hat ihre maschinenlesbaren FedRAMP-Inhalte weltweit gemeinfrei gestellt (CC0 1.0). FedRAMP® ist eine eingetragene Marke der GSA; GRCA steht in keiner Verbindung zur GSA oder zu FedRAMP und wird von ihnen nicht unterstützt. In Abschnitte aufgeteilt und in das GRCA-Format umgewandelt, der Wortlaut unverändert, mit den genannten Controls aus NIST SP 800-53 verknüpft. Maßgeblich ist allein die von FedRAMP veröffentlichte Fassung.