+IVV-CSO-FIA FedRAMP Independent Assessments

IVV-CSO-FIA FedRAMP Independent Assessments

Notes

The first such completed assessment is typically called an "initial assessment" while following assessments are called "annual assessments."

The specific requirements for independent verification and validation assessments are documented by the FedRAMP Certification Class and Type.

The option for assessment by FedRAMP directly is limited to cloud services that are explicitly prioritized by FedRAMP, in consultation with the FedRAMP Board and the federal Chief Information Officers Council; this is _extremely_ rare.

FedRAMP Recognized independent assessment services are listed on the FedRAMP Marketplace.

Class A

Providers with Class A Certifications MAY persistently complete an independent verification and validation assessment of all applicable FedRAMP rules with a FedRAMP Recognized independent assessment service OR FedRAMP at least once per year; this is a FedRAMP independent assessment.

Timeframe: 1 year

Class B

Providers with Class B Certifications MUST persistently complete an independent verification and validation assessment of all applicable FedRAMP rules with a FedRAMP Recognized independent assessment service OR FedRAMP at least once per year; this is a FedRAMP independent assessment.

Timeframe: 1 year

Class C

Providers with Class C Certifications MUST persistently complete an independent verification and validation assessment of all applicable FedRAMP rules with a FedRAMP Recognized independent assessment service OR FedRAMP at least once per year; this is a FedRAMP independent assessment.

Timeframe: 1 year

Class D

Providers with Class D Certifications MUST persistently complete an independent verification and validation assessment of all applicable FedRAMP rules with a FedRAMP Recognized independent assessment service OR FedRAMP at least once per year; this is a FedRAMP independent assessment.

Timeframe: 1 year

NIST SP 800-53 Rev. 5 controls: CA-2, CA-2(1), CA-2(2), CA-7(1), CA-7(4)

Defined terms: Certification Class, FedRAMP Independent Assessment, FedRAMP Recognized, Persistently, Validation, Verification

1. Overview

1.1 References

1.2 Identified Requirements

1.3 Related Regulations

2. Identified Requirements

Requirements

3. Related Regulations

Regulations
  • FedRAMP Consolidated Rules -

    EN: FedRAMP® Consolidated Rules of the Federal Risk and Authorization Management Program, U.S. General Services Administration (GSA), https://www.fedramp.gov/, from their machine-readable version (FedRAMP/rules). Works of the U.S. Government are not subject to copyright protection in the United States (17 U.S.C. § 105; GSA website policies); GSA dedicated its machine-readable FedRAMP content to the public domain worldwide (CC0 1.0). FedRAMP® is a registered trademark of GSA; GRCA is not affiliated with, nor endorsed by, GSA or FedRAMP. Divided into sections and converted into the GRCA format, the wording unchanged, linked to the NIST SP 800-53 controls they name. Only the version published by FedRAMP is authoritative.

    DE: FedRAMP® Consolidated Rules des Federal Risk and Authorization Management Program, U.S. General Services Administration (GSA), https://www.fedramp.gov/, aus ihrer maschinenlesbaren Fassung (FedRAMP/rules). Werke der US-Regierung sind in den USA urheberrechtlich nicht geschützt (17 U.S.C. § 105; Website-Richtlinien der GSA); die GSA hat ihre maschinenlesbaren FedRAMP-Inhalte weltweit gemeinfrei gestellt (CC0 1.0). FedRAMP® ist eine eingetragene Marke der GSA; GRCA steht in keiner Verbindung zur GSA oder zu FedRAMP und wird von ihnen nicht unterstützt. In Abschnitte aufgeteilt und in das GRCA-Format umgewandelt, der Wortlaut unverändert, mit den genannten Controls aus NIST SP 800-53 verknüpft. Maßgeblich ist allein die von FedRAMP veröffentlichte Fassung.