AGU-AGC General Agency Responsibilities

Agencies MUST maintain agency-wide policy that aligns with the requirements in OMB Memorandum M-24-15.

Agencies MUST notify FedRAMP upon authorizing the use of a cloud service within the scope of FedRAMP, supplying at least the following information:

• A copy of the agency's Authorization to Operate letter for the information system leveraging the cloud service, following agency policy and templates.
• All other supplemental information requested in the Submit an ATO Letter form by FedRAMP.

Notification

• FedRAMP via form – Submit an ATO Letter: https://help.fedramp.gov/hc/en-us/requests/new?ticket_form_id=51447926193691

Agencies MUST ensure that internal governance, risk, compliance, and inventory tools can produce and ingest machine-readable artifacts using formats identified by FedRAMP, including at least:

• Open Security Controls Assessment Language (OSCAL)
• JSON

Defined terms: Artifacts, Machine-Readable

Agencies MUST notify FedRAMP after requesting any additional information or materials from a FedRAMP Certified cloud service offering beyond those required by FedRAMP.

Note

Agencies are expected to notify FedRAMP under OMB Memorandum M-24-15 section IV (a).

Notification

• FedRAMP via form – [For Agencies] Additional Information, Security Requirements, or Certification Change, or After Request Form: https://help.fedramp.gov/hc/en-us/requests/new?ticket_form_id=51822364715035

Defined terms: Cloud Service Offering, FedRAMP Certified

Agencies MUST NOT require additional information or materials from FedRAMP Certified cloud service offerings beyond those required by FedRAMP UNLESS the head of the agency or an authorized delegate determines there is a demonstrable need and notifies FedRAMP; this does not apply to seeking clarification or asking general questions about FedRAMP Certification Data.

Note

This is related to the Presumption of Adequacy for a FedRAMP Certification and notification is mandated by OMB Memorandum M-24-15 section IV (a).

Notification

• FedRAMP via email – info@fedramp.gov

Defined terms: Certification Data, Cloud Service Offering, FedRAMP Certified

Agencies MUST NOT require cloud service offerings to obtain or maintain a specific FedRAMP Certification Type or FedRAMP Certification Path, UNLESS the head of the agency or an authorized delegate determines there is a demonstrable need and notifies FedRAMP.

Note

This is related to the Presumption of Adequacy for a FedRAMP Certification and notification is mandated by OMB Memorandum M-24-15 section IV (a).

Notification

• FedRAMP via email – info@fedramp.gov

Defined terms: Certification Path, Certification Type, Cloud Service Offering, FedRAMP Certified

Agencies SHOULD participate in FedRAMP working groups, communities of practice, and stakeholder engagements to supply feedback and align practices across government.

Agencies SHOULD assign at least 1 federal employee to be an active participant in the FedRAMP Agency Liaison program.

Reference: Agency Liaison Program

Agencies SHOULD establish and maintain a dedicated shared FedRAMP agency inbox to serve as the official point of contact for communications between FedRAMP and the agency.

Note

A shared FedRAMP agency inbox may follow an agency-specific format such as agency-fedramp@agency.gov.