REC-IAS General Independent Assessor Responsibilities

Assessors MUST obtain and maintain accreditation through the American Association for Laboratory Accreditation (A2LA) Cybersecurity Inspection Body Program to qualify for FedRAMP Recognition.

Note

FedRAMP will remove FedRAMP Recognition immediately after the American Association for Laboratory Accreditation notifies FedRAMP that an assessor's accreditation has lapsed.

Defined terms: FedRAMP Recognized

Assessors MUST complete at least 2 initial or ongoing assessments for Class B, C, or D FedRAMP Certifications every 2 years to maintain FedRAMP Recognition.

Note

For a newly FedRAMP Recognized Assessor, this rule applies beginning on the initial date of FedRAMP Recognition if that date is later than 2026-06-01.

Timeframe: 2 years

Corrective actions

• FedRAMP will notify assessors when they are within 6 months of losing FedRAMP Recognition under this rule and request a corrective action plan.
• Assessors whose corrective action plan is not accepted will lose FedRAMP Recognition and must supply an alternative corrective action plan to move toward renewed FedRAMP Recognition.

Defined terms: FedRAMP Recognized

Assessors MUST maintain compliance with the latest American Association for Laboratory Accreditation (A2LA) R311 - Specific Requirements - Federal Risk and Authorization Management Program to maintain FedRAMP Recognition.

Reference: A2LA Public Documents

Defined terms: FedRAMP Recognized

Assessors MUST achieve a favorable annual surveillance assessment by the American Association for Laboratory Accreditation (A2LA) to maintain FedRAMP Recognition.

Timeframe: 1 year

Corrective actions

• Assessors have 75 days to complete corrective actions for nonconformances identified by the American Association for Laboratory Accreditation (A2LA)during a surveillance assessment. If an assessor exceeds the 75 day resolution timeframe, A2LA will supply FedRAMP with a narrative of the assessor's current status, the assessor will be designated as in Remediation in the FedRAMP Marketplace, and the assessor must supply a corrective action plan to FedRAMP.

Defined terms: FedRAMP Recognized

Assessors MUST achieve a favorable full reassessment by the American Association for Laboratory Accreditation (A2LA) at least once every 2 years to maintain FedRAMP Recognition.

Timeframe: 2 years

Corrective actions

• Assessors have 75 days to complete corrective actions for nonconformances identified by the American Association for Laboratory Accreditation during a reassessment. If an assessor exceeds the 75 day resolution timeframe, the American Association for Laboratory Accreditation will supply FedRAMP with a narrative of the assessor's current status, the assessor will be designated as In Remediation in the FedRAMP Marketplace, and the assessor must supply a corrective action plan to FedRAMP.

Defined terms: FedRAMP Recognized

Assessors MUST satisfy all American Association for Laboratory Accreditation (A2LA) re-entry conditions before regaining FedRAMP Recognition after revocation.

Note

A revocation may require extended time in revoked status while the assessor demonstrates acceptable performance in the A2LA Cybersecurity Inspection Body Program before seeking FedRAMP Recognition again.

Defined terms: FedRAMP Recognized

Assessors MUST staff FedRAMP assessments with all roles required by the American Association for Laboratory Accreditation (A2LA) R311, including personnel who meet the qualifications for each role, unless FedRAMP publishes a specific exception for a limited pilot or other explicitly scoped process.

Corrective actions

• FedRAMP may require a consultation meeting, corrective action plan, or revocation for failure to comply.

Assessors MUST report information relating to any foreign interest, foreign influence, or foreign control of the independent assessment service to FedRAMP annually.

Timeframe: 1 year

Notification

• FedRAMP via form – FedRAMP Foreign Ownership, Control, or Influence Declaration Form: https://help.fedramp.gov/hc/en-us/requests/new?ticket_form_id=52006681154587

Assessors MUST report updated information relating to any foreign interest, foreign influence, or foreign control of the independent assessment service within 48 hours of any change in foreign ownership or control.

Timeframe: 48 hours

Notification

• FedRAMP via form – FedRAMP Foreign Ownership, Control, or Influence Declaration Form: https://help.fedramp.gov/hc/en-us/requests/new?ticket_form_id=52006681154587

Assessors MUST meet FedRAMP performance standards for assessor deliverables to support independent, risk-based reviews by FedRAMP and federal agencies, including at least:

• Complete Assessment Packages: Supplies complete and thoroughly prepared documents on the first submission.
• Deliverable Quality: Ensures documentation content is clear, complete, concise, and consistent.
• Deliverable Format: Follows applicable FedRAMP rules.
• Timeliness and Responsiveness: Delivers documents on time according to the schedule agreed to by the federal government, provider, and assessor.
• Testing Accuracy and Completeness: Ensures accurate and complete testing of a cloud service offering in accordance with ISO 17020 and FedRAMP security rules.
• Assessment Integrity: Submits independent assessments of provider security implementations that are not influenced by provider demands.
• Chain of Custody: Preserves the integrity and chain of custody of assessor-authored documents and provider-supplied evidence used in FedRAMP assessments.

Defined terms: Cloud Service Offering

Assessors MUST supply a corrective action plan when FedRAMP requires one for performance standards deficiencies or organizational risks.

Assessors MUST treat deliverables prepared, performed, or submitted by personnel who do not meet required role qualifications as invalid for FedRAMP purposes.

Assessors MUST NOT perform a FedRAMP independent assessment of the same cloud service offering within 2 years after supplying advisory or consulting services for that offering, unless FedRAMP publishes a specific exception for a limited pilot or other explicitly scoped process.

Timeframe: 2 years

Corrective actions

• FedRAMP may require a consultation meeting, corrective action plan, or revocation for failure to comply.

Defined terms: Cloud Service Offering, FedRAMP Independent Assessment