+IVV-CSF Rev5-Specific Provider Responsibilities
---+IVV-CSF-AIA Annual Independent Assessments for Rev5
------+IVV-CSF-AIA Annual Independent Assessments for Rev5 – Class B
------+IVV-CSF-AIA Annual Independent Assessments for Rev5 – Class C
------+IVV-CSF-AIA Annual Independent Assessments for Rev5 – Class D
---+IVV-CSF-MCA Mandatory Control Assessment
---+IVV-CSF-ACF Assessment of Rev5 Controls with Findings
---+IVV-CSF-PCA Preferred Control Assessment

IVV-CSF Rev5-Specific Provider Responsibilities

These rules apply to providers for FedRAMP Rev5 Certifications.

  • Types: Rev5
  • Paths: Program, Agency
  • Classes: B, C, D
  • Affects: Providers

1. Panoramica

IVV-CSF-AIA Annual Independent Assessments for Rev5

Class B

Providers with Rev5 Class B Certifications MUST include the following Rev5 Controls in a FedRAMP independent assessment at least once per year:

Timeframe: 1 year

Class C

Providers with Rev5 Class C Certifications MUST include the following Rev5 Controls in a FedRAMP independent assessment at least once per year:

Timeframe: 1 year

Class D

Providers with Rev5 Class D Certifications MUST include the following Rev5 Controls in a FedRAMP independent assessment at least once per year:

Timeframe: 1 year

Defined terms: FedRAMP Independent Assessment
IVV-CSF-MCA Mandatory Control Assessment

Providers MUST have all applicable Rev5 Controls included in FedRAMP independent assessments every 3 years but are not required to have all Rev5 Controls included in the same FedRAMP independent assessment.

Note

Traditionally this has been done by reviewing a rotating selection of Rev5 Controls at each annual assessment, however this requirement is a ceiling and not a floor. See IVV-CSF-PCA (Preferred Control Assessment) for FedRAMP's recommended approach to Rev5 control assessments.

Timeframe: 3 years

Related rules: IVV-CSF-PCA

Defined terms: FedRAMP Independent Assessment
IVV-CSF-ACF Assessment of Rev5 Controls with Findings

Providers MUST have Rev5 Controls with negative findings from the previous FedRAMP independent assessment included in the next FedRAMP independent assessment.

Defined terms: FedRAMP Independent Assessment
IVV-CSF-PCA Preferred Control Assessment

Providers SHOULD include all applicable Rev5 Controls in each FedRAMP independent assessment.

Defined terms: FedRAMP Independent Assessment

1.1 Riferimenti

1.2 Requisiti identificati

1.3 Regolamentazioni correlate

2. Requisiti identificati

Requisiti

3. Regolamentazioni correlate

Regolamentazioni
  • FedRAMP Consolidated Rules -

    EN: FedRAMP® Consolidated Rules of the Federal Risk and Authorization Management Program, U.S. General Services Administration (GSA), https://www.fedramp.gov/, from their machine-readable version (FedRAMP/rules). Works of the U.S. Government are not subject to copyright protection in the United States (17 U.S.C. § 105; GSA website policies); GSA dedicated its machine-readable FedRAMP content to the public domain worldwide (CC0 1.0). FedRAMP® is a registered trademark of GSA; GRCA is not affiliated with, nor endorsed by, GSA or FedRAMP. Divided into sections and converted into the GRCA format, the wording unchanged, linked to the NIST SP 800-53 controls they name. Only the version published by FedRAMP is authoritative.

    DE: FedRAMP® Consolidated Rules des Federal Risk and Authorization Management Program, U.S. General Services Administration (GSA), https://www.fedramp.gov/, aus ihrer maschinenlesbaren Fassung (FedRAMP/rules). Werke der US-Regierung sind in den USA urheberrechtlich nicht geschützt (17 U.S.C. § 105; Website-Richtlinien der GSA); die GSA hat ihre maschinenlesbaren FedRAMP-Inhalte weltweit gemeinfrei gestellt (CC0 1.0). FedRAMP® ist eine eingetragene Marke der GSA; GRCA steht in keiner Verbindung zur GSA oder zu FedRAMP und wird von ihnen nicht unterstützt. In Abschnitte aufgeteilt und in das GRCA-Format umgewandelt, der Wortlaut unverändert, mit den genannten Controls aus NIST SP 800-53 verknüpft. Maßgeblich ist allein die von FedRAMP veröffentlichte Fassung.