CDS-TRC FedRAMP-Compatible Trust Centers

Trust centers MUST share FedRAMP Certification Data with all necessary parties without interruption.

Note

"Without interruption" means that parties should not have to request manual approval each time they need to access FedRAMP Certification Data or go through a complicated process. The preferred way of ensuring access without interruption is to use on-demand just-in-time access provisioning.

Defined terms: All Necessary Parties, Certification Data, Trust Center

Trust centers MUST provide documented programmatic access to all FedRAMP Certification Data, including programmatic access to human-readable materials.

Artifacts

• URL to the documentation for programmatic access.

Defined terms: Certification Data, Trust Center

Trust centers MUST maintain an inventory and history of federal agency users or systems with access to FedRAMP Certification Data and MUST make this information available to FedRAMP upon request.

Artifacts

• Explanation of how FedRAMP can obtain this information.

Defined terms: Certification Data, Trust Center

Trust centers MUST log access to FedRAMP Certification Data and store summaries of access for at least six months; such information, as it pertains to specific parties, SHOULD be made available upon request by those parties.

Artifacts

• Explanation of how the appropriate parties can obtain this log information.

Defined terms: Certification Data, Trust Center

Trust centers SHOULD make FedRAMP Certification Data available to view and download in both human-readable and machine-readable formats.

Defined terms: Certification Data, Machine-Readable, Trust Center

Trust centers SHOULD include features that encourage all necessary parties to provision and manage access to FedRAMP Certification Data for their users and services directly.

Artifacts

• URL or explanation how to access documentation of these features and capabilities.

Defined terms: All Necessary Parties, Certification Data, Trust Center