FRC-CLA-RFR Recommended FedRAMP Rules for Class A

Providers seeking a Class A FedRAMP Certification SHOULD address the following additional recommended FedRAMP Class A rules (if applicable):

• Certification Data Sharing: CDS-CSO-AVR (Availability Reporting)
• Certification Package Overview: CPO-CSX-CPM (Certification Package Maintenance for 20x)
• Incident Evaluation and Communication: IEC-CSO-IIR (Initial Incident Report)
• Incident Evaluation and Communication: IEC-CSO-OIR (Ongoing Incident Reports)
• Vulnerability Detection and Response: VDR-TFR-MVX (Persistent Machine Verification and Validation for 20x)
• Vulnerability Detection and Response: VDR-TFR-PCD (Persistently Complete Detection)
• Vulnerability Detection and Response: VDR-TFR-PDD (Persistent Drift Detection)
• Vulnerability Detection and Response: VDR-TFR-PSD (Persistent Sample Detection)
• Vulnerability Detection and Response: VDR-TFR-PVR (Mitigation and Remediation Expectations)
• Vulnerability Evaluation and Reporting: VER-TFR-EVU (Evaluate Vulnerabilities Quickly)

Related rules: CDS-CSO-AVR, CPO-CSX-CPM, IEC-CSO-IIR, IEC-CSO-OIR, VDR-TFR-MVX, VDR-TFR-PCD, VDR-TFR-PDD, VDR-TFR-PSD, VDR-TFR-PVR, VER-TFR-EVU

Defined terms: Certification Data, Certification Package, Drift, Incident, Initial Incident Report (IIR), Ongoing Incident Report (OIR), Persistently, Validation, Verification, Vulnerability, Vulnerability Detection, Vulnerability Response

1. Panoramica

1.1 Riferimenti

• CDS-CSO-AVR Availability Reporting
• CPO-CSX-CPM Certification Package Maintenance for 20x
• IEC-CSO-IIR Initial Incident Report
• IEC-CSO-OIR Ongoing Incident Reports
• VDR-TFR-MVX Persistent Machine Verification and Validation for 20x
• VDR-TFR-PCD Persistently Complete Detection
• VDR-TFR-PDD Persistent Drift Detection
• VDR-TFR-PSD Persistent Sample Detection
• VDR-TFR-PVR Mitigation and Remediation Expectations
• VER-TFR-EVU Evaluate Vulnerabilities Quickly
• FRD-CRD Certification Data
• FRD-CRP Certification Package
• FRD-DFT Drift
• FRD-INT Incident
• FRD-IIR Initial Incident Report (IIR)
• FRD-OIR Ongoing Incident Report (OIR)
• FRD-PER Persistently
• FRD-VLN Validation
• FRD-VRF Verification
• FRD-VUL Vulnerability
• FRD-VLD Vulnerability Detection
• FRD-VLR Vulnerability Response

1.2 Requisiti identificati

1.3 Regolamentazioni correlate

2. Requisiti identificati

3. Regolamentazioni correlate

• FedRAMP Consolidated Rules -

  EN: FedRAMP® Consolidated Rules of the Federal Risk and Authorization Management Program, U.S. General Services Administration (GSA), https://www.fedramp.gov/, from their machine-readable version (FedRAMP/rules). Works of the U.S. Government are not subject to copyright protection in the United States (17 U.S.C. § 105; GSA website policies); GSA dedicated its machine-readable FedRAMP content to the public domain worldwide (CC0 1.0). FedRAMP® is a registered trademark of GSA; GRCA is not affiliated with, nor endorsed by, GSA or FedRAMP. Divided into sections and converted into the GRCA format, the wording unchanged, linked to the NIST SP 800-53 controls they name. Only the version published by FedRAMP is authoritative.

  DE: FedRAMP® Consolidated Rules des Federal Risk and Authorization Management Program, U.S. General Services Administration (GSA), https://www.fedramp.gov/, aus ihrer maschinenlesbaren Fassung (FedRAMP/rules). Werke der US-Regierung sind in den USA urheberrechtlich nicht geschützt (17 U.S.C. § 105; Website-Richtlinien der GSA); die GSA hat ihre maschinenlesbaren FedRAMP-Inhalte weltweit gemeinfrei gestellt (CC0 1.0). FedRAMP® ist eine eingetragene Marke der GSA; GRCA steht in keiner Verbindung zur GSA oder zu FedRAMP und wird von ihnen nicht unterstützt. In Abschnitte aufgeteilt und in das GRCA-Format umgewandelt, der Wortlaut unverändert, mit den genannten Controls aus NIST SP 800-53 verknüpft. Maßgeblich ist allein die von FedRAMP veröffentlichte Fassung.