FRC-CSO General Provider Responsibilities

Providers MUST identify a target FedRAMP Certification Profile and apply all relevant FedRAMP Practices to the cloud service offering.

Note

Information resources (including third-party information resources) MAY vary by security category as appropriate to the type of information handled by or impacted by the information resource.

Defined terms: Certification Profile, Cloud Service Offering, FedRAMP Practices, Handle, Information Resource, Security Category, Third-Party Information Resource

Providers seeking a Certification MUST supply a complete FedRAMP Certification Package to FedRAMP for initial certification; the FedRAMP Certification Package MUST include at least the following information:

• Information about the Cloud Service Offering following CPO-CSO-OVR (Overview of the Cloud Service Offering)
• Implementation, Validation, and Assessment information for each relevant FedRAMP requirement/control/ksi as defined in SDR-CSO-FRR (FedRAMP Rules)
• A real or example Ongoing Certification Report following CCM-OCR-AVL (Report Availability)

Schema: FedRAMP Certification Package Overview (FRC-CSO-PKG)

Related rules: CPO-CSO-OVR, SDR-CSO-FRR, CCM-OCR-AVL

Defined terms: Certification Package, Cloud Service Offering, FedRAMP Certification Report, Initial Certification, Ongoing Certification, Ongoing Certification Report (OCR), Security Decision Record (SDR), Validation

Providers MUST supply machine-readable information in JSON documents that are valid against the corresponding JSON schema when a rule contains a FedRAMP JSON schema, UNLESS otherwise specified in the rule; public JSON data MUST be supplied in a manner compatible with modern web frameworks, including:

• Cross-Origin Resource Sharing (CORS) should allow web applications running on a different domain to access the public JSON data directly.
• Proper web application headers should be supplied for public JSON data, including at least setting Content-Type to application/json and X-Content-Type-Options: nosniff.

Notes

FedRAMP JSON schemas are designed to be lightweight and flexible to establish a minimum set of structured information while allowing providers to improve on the format and structure of the information as needed to meet their needs and the needs of their customers.

Public JSON data is intended to be consumed by FedRAMP, agency GRC tools, and more - it should be available in a way that enables standard web-application use following standard web frameworks. Generally, if you can't write a web app to parse this data without configuring a browser to bypass security defaults then there has likely been a problem.

The Schema Validator available at fedramp.gov will not work properly if Cross-Origin Resource Sharing is not properly configured.

Defined terms: Likely, Machine-Readable

Providers MUST maintain responsibility and accountability for the accuracy and completeness of all information in the FedRAMP Certification Package, especially when they engage a third party (such as an independent assessor, advisory service, or external tools) to supply information on their behalf.

Defined terms: Certification Package

Providers MUST NOT seek both FedRAMP Rev5 Program Certification and FedRAMP 20x Program Certification for the same cloud service offering; pick one type.

Note

This rule does not prevent a provider from seeking and maintaining a FedRAMP Rev5 Agency Certification and a FedRAMP 20x Program Certification for the same cloud service offering, however, doing so is strongly discouraged due to the increased complexity and risk of confusion for all parties.

Defined terms: Cloud Service Offering