MAS-CSO General Provider Responsibilities

Providers MUST identify a set of information resources to assess for FedRAMP Certification that includes all information resources that are likely to handle federal customer data or likely to impact the confidentiality, integrity, or availability of federal customer data handled by the cloud service offering; this set of information resources is the cloud service offering.

Notes

Certain categories of cloud computing products and services are specified as entirely outside the scope of FedRAMP by the Director of the Office of Management and Budget. All such products and services are therefore not included in the cloud service offering for FedRAMP. For more, see https://fedramp.gov/scope.

Software produced by cloud service providers that is delivered separately for installation on agency systems and not operated in a shared responsibility model (typically including agents, application clients, mobile applications, etc. that are not fully managed by the cloud service provider) is not a cloud computing product or service and is entirely outside the scope of FedRAMP under the FedRAMP Certification Act. All such software is therefore not included in the cloud service offering for FedRAMP. For more, see https://fedramp.gov/scope.

All aspects of the cloud service offering are determined and maintained by the cloud service provider in accordance with related FedRAMP Certification rules and documented by the cloud service provider in their FedRAMP Certification Package.

Artifacts

• A machine readable output containing all required data of the components of the cloud service offering that are likely to handle federal customer data or likely to impact the confidentiality, integrity, or availability of federal customer data handled by the cloud service offering.
• A human readable explanation of how the machine readable output is derived.
• The code for the automated process used to generate the machine readable output.

NIST SP 800-53 Rev. 5 controls: CM-8(4), RA-3, SI-4(19)

Defined terms: Certification Package, Cloud Service Offering, Federal Customer Data, Handle, Information Resource, Likely

Providers MUST clearly identify, document, and explain information flows and security categories for ALL information resources or sets of information resources in the cloud service offering.

Note

Information resources (including third-party information resources) MAY vary by security category as appropriate to the type of information handled by or impacted by the information resource.

Artifacts

• A machine readable output containing all required data of the permitted connections between components of the cloud service offering that are likely to handle federal customer data or likely to impact the confidentiality, integrity, or availability of federal customer data handled by the cloud service offering.
• A human readable explanation of how the machine readable output is derived.
• The code for the automated process used to generate the machine readable output.

NIST SP 800-53 Rev. 5 controls: AC-4, CM-12, CM-12(1), RA-3, SI-4(19)

Defined terms: Cloud Service Offering, Handle, Information Resource, Security Category, Third-Party Information Resource

Providers MUST address the potential impact to federal customer data from third-party information resources used by the cloud service offering, ONLY IF MAS-CSO-IIR (Identify Information Resources) APPLIES, by documenting the following information about each applicable third-party information resource:

• General usage and configuration
• Explanation or justification for use
• Mitigation measures in place to reduce the potential impact to federal customer data
• Compensating controls in place to reduce the potential impact to federal customer data

Artifacts

• A machine readable output containing all required data of the third-party information resources of the cloud service offering that are likely to handle federal customer data or likely to impact the confidentiality, integrity, or availability of federal customer data handled by the cloud service offering.
• A human readable explanation of how the machine readable output is derived.
• The code for the automated process used to generate the machine readable output.

Schema: FedRAMP Certification Package Overview (FRC-CSO-PKG)

Related rules: MAS-CSO-IIR

NIST SP 800-53 Rev. 5 controls: RA-3

Defined terms: Cloud Service Offering, Federal Customer Data, Information Resource, Initial Incident Report (IIR), Minimum Assessment Scope, Third-Party Information Resource

Providers MUST include metadata (including metadata about federal customer data) in the Minimum Assessment Scope ONLY IF MAS-CSO-IIR (Identify Information Resources) APPLIES.

Artifacts

• A machine readable output containing all required data of the metadata collected or maintained by the cloud service offering that are likely to handle federal customer data or likely to impact the confidentiality, integrity, or availability of federal customer data handled by the cloud service offering.
• A human readable explanation of how the machine readable output is derived.
• The code for the automated process used to generate the machine readable output.

Related rules: MAS-CSO-IIR

Defined terms: Federal Customer Data, Information Resource, Initial Incident Report (IIR), Minimum Assessment Scope

Providers MAY include additional materials about other information resources that are not part of the cloud service offering in a FedRAMP Certification Package supplement; these resources will not be FedRAMP Certified and MUST be clearly marked and separated from the cloud service offering.

Note

This is intended to allow inclusion of things like security materials for apps, supplemental marketing collateral, and other information that is not part of the cloud service offering but may be useful to agencies.

Defined terms: Certification Package, Cloud Service Offering, FedRAMP Certified, Information Resource