+CPO-CSO General Provider Responsibilities
---+CPO-CSO-OVR Overview of the Cloud Service Offering
---+CPO-CSO-MTD Certification Package Overview Metadata
---+CPO-CSO-OSA Overall Summary of Assessment in Certification Package
|
CPO-CSO General Provider Responsibilities
These rules apply to providers for FedRAMP Certifications of any type. - Types: 20x, Rev5
- Paths: Program, Agency
- Classes: B, C, D
- Affects: Providers
1. Resumen
| Título |
Estándar |
|
CPO-CSO-OVR Overview of the Cloud Service Offering
|
Providers MUST supply a Certification Package Overview within their FedRAMP Certification Package, in both human-readable and JSON formats, that includes at least all of the information required by the following rules: - Certification Package Overview: CPO-CSO-MTD (Certification Package Overview Metadata)
- Certification Data Sharing: CDS-CSO-PUB (Public Information)
- Certification Data Sharing: CDS-CSO-SVC (Public Service List)
- Certification Data Sharing: CDS-CSO-IRP (Include Relevant Policies)
- Minimum Assessment Scope: MAS-CSO-IIR (Identify Information Resources)
- Minimum Assessment Scope: MAS-CSO-FLO (Information Flows and Security Categories)
- Minimum Assessment Scope: MAS-CSO-TPR (Third-Party Information Resources)
- Using Cryptographic Modules: CMU-CSO-CMD (Cryptographic Module Documentation)
- Independent Verification and Validation: IVV-CSO-ICP (Inclusion in Certification Package)
NotesFor FedRAMP Rev5, the Certification Package Overview replaces the historically required System Security Plan (not including appendices). This list of rules may not apply to all FedRAMP Certification Classes or Types - if a rule does not apply then the information is not required. Schema: FedRAMP Certification Package Overview Schema Related rules: CPO-CSO-MTD, CDS-CSO-PUB, CDS-CSO-SVC, MAS-CSO-IIR, MAS-CSO-FLO, MAS-CSO-TPR, CMU-CSO-CMD, CDS-CSO-IRP, IVV-CSO-ICP Defined terms: Certification Class, Certification Data, Certification Package, Information Resource, Initial Incident Report (IIR), Minimum Assessment Scope, Security Category, Third-Party Information Resource, Validation, Verification
|
|
CPO-CSO-MTD Certification Package Overview Metadata
|
Providers MUST also include the following basic metadata in their Certification Package Overview: - Name, title, and contact information of official that is responsible and accountable for the FedRAMP Certification Package
- Version
- Date and time of last update
- Source of update
Defined terms: Certification Package
|
|
CPO-CSO-OSA Overall Summary of Assessment in Certification Package
|
Class AProviders seeking Class A Certification MAY also include an overall summary of their FedRAMP independent assessment in their Certification Package Overview. Class BProviders seeking Class B Certification MUST also include the overall summary of their FedRAMP independent assessment, supplied by the assessor per IVV-IAS-OSA (Overall Summary of Assessment), in their Certification Package Overview. Class CProviders seeking Class C Certification MUST also include the overall summary of their FedRAMP independent assessment, supplied by the assessor per IVV-IAS-OSA (Overall Summary of Assessment), in their Certification Package Overview. Class DProviders seeking Class D Certification MUST also include the overall summary of their FedRAMP independent assessment, supplied by the assessor per IVV-IAS-OSA (Overall Summary of Assessment), in their Certification Package Overview. Related rules: IVV-IAS-OSA NIST SP 800-53 Rev. 5 controls: CA-2, CA-2(1), CA-2(2), CA-7(1) Defined terms: Certification Package, FedRAMP Independent Assessment
|
1.1 Referencias
1.2 Requisitos identificados
1.3 Regulaciones relacionadas
2. Requisitos identificados
Requisitos
| Fuente |
Requisito |
3. Regulaciones relacionadas
Regulaciones
| Fuente |
Regulación |
- FedRAMP Consolidated Rules -
EN: FedRAMP® Consolidated Rules of the Federal Risk and Authorization Management Program, U.S. General Services Administration (GSA), https://www.fedramp.gov/, from their machine-readable version (FedRAMP/rules). Works of the U.S. Government are not subject to copyright protection in the United States (17 U.S.C. § 105; GSA website policies); GSA dedicated its machine-readable FedRAMP content to the public domain worldwide (CC0 1.0). FedRAMP® is a registered trademark of GSA; GRCA is not affiliated with, nor endorsed by, GSA or FedRAMP. Divided into sections and converted into the GRCA format, the wording unchanged, linked to the NIST SP 800-53 controls they name. Only the version published by FedRAMP is authoritative.
DE: FedRAMP® Consolidated Rules des Federal Risk and Authorization Management Program, U.S. General Services Administration (GSA), https://www.fedramp.gov/, aus ihrer maschinenlesbaren Fassung (FedRAMP/rules). Werke der US-Regierung sind in den USA urheberrechtlich nicht geschützt (17 U.S.C. § 105; Website-Richtlinien der GSA); die GSA hat ihre maschinenlesbaren FedRAMP-Inhalte weltweit gemeinfrei gestellt (CC0 1.0). FedRAMP® ist eine eingetragene Marke der GSA; GRCA steht in keiner Verbindung zur GSA oder zu FedRAMP und wird von ihnen nicht unterstützt. In Abschnitte aufgeteilt und in das GRCA-Format umgewandelt, der Wortlaut unverändert, mit den genannten Controls aus NIST SP 800-53 verknüpft. Maßgeblich ist allein die von FedRAMP veröffentlichte Fassung.
|