CCM-QTR Quarterly Reviews

Class A

Providers with Class A Certifications MAY host a synchronous Quarterly Review every 3 months, open to all necessary parties, to review aspects of the most recent Ongoing Certification Reports that the provider determines are of the most relevance to agencies.

Timeframe: 3 months

Artifacts

• selected ordinal recurrence for the synchronous Quarterly Review cycle if applicable.

Class B

Providers with Class B Certifications SHOULD host a synchronous Quarterly Review every 3 months, open to all necessary parties, to review aspects of the most recent Ongoing Certification Reports that the provider determines are of the most relevance to agencies.

Timeframe: 3 months

Artifacts

• selected ordinal recurrence for the Ongoing Certification Report cycle if applicable OR explanation for why Ongoing Certification Reports are not being delivered.

Class C

Providers with Class C Certifications MUST host a synchronous Quarterly Review every 3 months, open to all necessary parties, to review aspects of the most recent Ongoing Certification Reports that the provider determines are of the most relevance to agencies.

Timeframe: 3 months

Artifacts

• selected ordinal recurrence for the Ongoing Certification Report cycle.

Class D

Providers with Class D Certifications MUST host a synchronous Quarterly Review every 3 months, open to all necessary parties, to review aspects of the most recent Ongoing Certification Reports that the provider determines are of the most relevance to agencies.

Timeframe: 3 months

Artifacts

• selected ordinal recurrence for the Ongoing Certification Report cycle.

NIST SP 800-53 Rev. 5 controls: CA-7

Defined terms: All Necessary Parties, Ongoing Certification, Quarterly Review

Providers MUST supply either a registration link or a downloadable calendar file with meeting information for Quarterly Reviews to all necessary parties.

Artifacts

• URL to the registration page or calendar file.

Defined terms: All Necessary Parties, Quarterly Review

Providers MUST publicly supply the target date for their next Quarterly Review with other public FedRAMP Certification Data.

Defined terms: Certification Data, Quarterly Review

Providers MUST NOT irresponsibly disclose sensitive information in a Quarterly Review that would likely have an adverse effect on the cloud service offering.

Defined terms: Cloud Service Offering, Likely, Quarterly Review

Providers SHOULD regularly schedule Quarterly Reviews to occur at least 3 business days after releasing an Ongoing Certification Report AND within 10 business days of such release.

Timeframe: 3 to 10 business days

Defined terms: FedRAMP Certification Report, Ongoing Certification, Ongoing Certification Report (OCR), Quarterly Review, Regularly

Providers SHOULD supply additional information in Quarterly Reviews that the provider determines is of interest, use, or otherwise relevant to agencies.

NIST SP 800-53 Rev. 5 controls: CA-7

Defined terms: Quarterly Review

Providers SHOULD record or transcribe Quarterly Reviews and supply them to all necessary parties.

Defined terms: All Necessary Parties, Quarterly Review

Providers SHOULD NOT invite third parties to attend Quarterly Reviews intended for agencies unless they have specific relevance.

Note

This is because agencies are less likely to actively participate in meetings with third parties; the cloud service provider's independent assessor should be considered relevant by default.

Defined terms: Likely, Quarterly Review

Providers MAY responsibly supply recordings or transcriptions of Quarterly Reviews to the public or other parties ONLY if the provider removes all agency information (comments, questions, names, etc.) AND determines doing so will NOT likely have an adverse effect on the cloud service offering.

Defined terms: Cloud Service Offering, Likely, Quarterly Review, Responsibly

Providers MAY responsibly supply content prepared for a Quarterly Review to the public or other parties if the provider determines doing so will NOT likely have an adverse effect on the cloud service offering.

Defined terms: Cloud Service Offering, Likely, Quarterly Review, Responsibly