AGU-USE Use of FedRAMP Certifications

Agencies MUST complete the Authorization to Operate process for federal information systems that use FedRAMP Certified cloud service offerings.

Note

FedRAMP provides technical assistance to help agencies navigate this process.

Reference: Using a FedRAMP Certified Cloud Service Offering

Defined terms: Cloud Service Offering, FedRAMP Certified

Agencies MUST collaborate with FedRAMP when discrepancies or conflicts arise between agency-specific security determinations and the FedRAMP Certification Package.

Defined terms: Certification Package

Agencies MUST review the Secure Configuration Guides supplied by Providers and configure relevant security settings.

NIST SP 800-53 Rev. 5 controls: CM-10, CM-5, CM-6, IA-11

Agencies MUST allow FedRAMP Certified cloud service offerings to follow FedRAMP rules.

Defined terms: Cloud Service Offering, FedRAMP Certified

Agencies MUST notify FedRAMP if information presented in an Ongoing Certification Report, Quarterly Review, or other FedRAMP Certification Data causes significant concerns for the authorizing official that would likely result in rescission of their Authorization to Operate.

Note

Agencies are expected to notify FedRAMP under OMB Memorandum M-24-15 section IV (a).

Notification

• FedRAMP via form – Report Concerns on Ongoing Certifications: https://help.fedramp.gov/hc/en-us/requests/new?ticket_form_id=51821301979547

Defined terms: Certification Data, FedRAMP Certification Report, Likely, Ongoing Certification, Ongoing Certification Report (OCR), Quarterly Review

Agencies SHOULD review each Ongoing Certification Report to understand how changes to the cloud service offering may impact the risk tolerance documented in the agency Authorization to Operate for the federal information system that includes the cloud service offering in its boundary.

Note

This agency review supports agency responsibilities under 44 USC § 35, OMB Circular A-130, FIPS-200, and OMB Memorandum M-24-15.

Defined terms: Cloud Service Offering, FedRAMP Certification Report, Ongoing Certification, Ongoing Certification Report (OCR)

Agencies SHOULD designate a federal senior information security official to review Ongoing Certification Reports and represent the agency at Quarterly Reviews for cloud service offerings included in agency information systems.

Defined terms: Cloud Service Offering, Ongoing Certification, Quarterly Review

Agencies SHOULD formally notify the cloud service provider if information presented in an Ongoing Certification Report, Quarterly Review, or other FedRAMP Certification Data causes significant concerns for the authorizing official that would likely result in rescission of their Authorization to Operate.

Notification

• Provider via varies – The provider's security contact email or form.: varies by provider

Defined terms: Certification Data, FedRAMP Certification Report, Likely, Ongoing Certification, Ongoing Certification Report (OCR), Quarterly Review

Agencies SHOULD consider third-party information resources used by the cloud service offering during initial and ongoing authorization activities.

Defined terms: Cloud Service Offering, Information Resource, Third-Party Information Resource

Agencies SHOULD NOT authorize the use of a FedRAMP Class A Certified cloud service offering for more than 12 months UNLESS the cloud service offering is actively seeking a FedRAMP Class B, C, or D Certification.

Defined terms: Cloud Service Offering, FedRAMP Certified