+AFC-CSO General Provider Responsibilities
---+AFC-CSO-INB Maintain a FedRAMP Security Inbox
---+AFC-CSO-NOC Notification of Changes
---+AFC-CSO-TFG Trust @fedramp.gov and @gsa.gov
---+AFC-CSO-RCV Receive Email Without Disruption
---+AFC-CSO-CRA Complete Required Actions
---+AFC-CSO-EMR Emergency Message Routing
---+AFC-CSO-IMA Important Message Actions
---+AFC-CSO-ACK Acknowledge Receipt

AFC-CSO General Provider Responsibilities

These rules apply to providers with any type of FedRAMP Certification.

  • Types: 20x, Rev5
  • Paths: Program, Agency
  • Classes: B, C, D
  • Affects: Providers

1. Panoramica

AFC-CSO-INB Maintain a FedRAMP Security Inbox

Providers MUST establish and maintain an email address to receive messages from FedRAMP; this inbox is a FedRAMP Security Inbox (FSI).

Warning: Be careful using a personal email tied to an individual for this inbox due to the significant risk to future communications after a change in personnel!

Notes

Unless otherwise notified, FedRAMP will use the listed Security Email on the Marketplace for these notifications.

If a provider establishes a new inbox in reaction to this guidance that is different from the Security Email then they must follow the AFC-CSO-NOC (Notification of Changes) rules to notify FedRAMP.

Artifacts

  • Email address to receive messages from FedRAMP

Related rules: AFC-CSO-NOC

NIST SP 800-53 Rev. 5 controls: SI-5

Defined terms: FedRAMP Security Inbox
AFC-CSO-NOC Notification of Changes

Providers MUST immediately notify FedRAMP of any changes to the email address for their FedRAMP Security Inbox.

Notification

Artifacts

  • Process, manual or automated, to notify FedRAMP of changes in the FedRAMP Security Inbox

Defined terms: FedRAMP Security Inbox
AFC-CSO-TFG Trust @fedramp.gov and @gsa.gov

Providers MUST treat any email originating from an @fedramp.gov or @gsa.gov email address as if it was sent from FedRAMP by default; if such a message is confirmed to originate from someone other than FedRAMP then the FedRAMP Security Inbox rules no longer apply.

Artifacts

  • Configuration settings for FSI mailbox
  • Automated validation to check FSI mailbox configuration

Defined terms: FedRAMP Security Inbox
AFC-CSO-RCV Receive Email Without Disruption

Providers MUST receive and react to email messages from FedRAMP without disruption and without requiring additional actions from FedRAMP.

Note

This requirement is intended to prevent cloud service providers from requiring FedRAMP to complete a CAPTCHA, log into a customer portal, or otherwise take service-specific actions that might prevent the security team from receiving the message.
AFC-CSO-CRA Complete Required Actions

Providers MUST complete the required actions in Emergency or Emergency Test designated messages sent by FedRAMP within the timeframe included in the message.

Note

Timeframes may vary by FedRAMP Certification class.

Defined terms: Certification Class
AFC-CSO-EMR Emergency Message Routing

Providers MUST route Emergency designated messages sent by FedRAMP to a senior security official for their awareness.

Note

Senior security officials are determined by the provider.

Artifacts

  • Configuration settings for FSI mailbox
  • Automated validation to check FSI mailbox configuration
AFC-CSO-IMA Important Message Actions

Providers SHOULD complete the required actions in Important designated messages sent by FedRAMP within the timeframe specified in the message.

Note

Timeframes may vary by FedRAMP Certification class.

Defined terms: Certification Class
AFC-CSO-ACK Acknowledge Receipt

Providers SHOULD promptly and automatically acknowledge the receipt of messages received from FedRAMP in their FedRAMP Security Inbox.

Defined terms: FedRAMP Security Inbox, Promptly

1.1 Riferimenti

1.2 Requisiti identificati

1.3 Regolamentazioni correlate

2. Requisiti identificati

Requisiti

3. Regolamentazioni correlate

Regolamentazioni
  • FedRAMP Consolidated Rules -

    EN: FedRAMP® Consolidated Rules of the Federal Risk and Authorization Management Program, U.S. General Services Administration (GSA), https://www.fedramp.gov/, from their machine-readable version (FedRAMP/rules). Works of the U.S. Government are not subject to copyright protection in the United States (17 U.S.C. § 105; GSA website policies); GSA dedicated its machine-readable FedRAMP content to the public domain worldwide (CC0 1.0). FedRAMP® is a registered trademark of GSA; GRCA is not affiliated with, nor endorsed by, GSA or FedRAMP. Divided into sections and converted into the GRCA format, the wording unchanged, linked to the NIST SP 800-53 controls they name. Only the version published by FedRAMP is authoritative.

    DE: FedRAMP® Consolidated Rules des Federal Risk and Authorization Management Program, U.S. General Services Administration (GSA), https://www.fedramp.gov/, aus ihrer maschinenlesbaren Fassung (FedRAMP/rules). Werke der US-Regierung sind in den USA urheberrechtlich nicht geschützt (17 U.S.C. § 105; Website-Richtlinien der GSA); die GSA hat ihre maschinenlesbaren FedRAMP-Inhalte weltweit gemeinfrei gestellt (CC0 1.0). FedRAMP® ist eine eingetragene Marke der GSA; GRCA steht in keiner Verbindung zur GSA oder zu FedRAMP und wird von ihnen nicht unterstützt. In Abschnitte aufgeteilt und in das GRCA-Format umgewandelt, der Wortlaut unverändert, mit den genannten Controls aus NIST SP 800-53 verknüpft. Maßgeblich ist allein die von FedRAMP veröffentlichte Fassung.