+FRC-APP Applying for FedRAMP Certification
---+FRC-APP-MLF Marketplace Listing First
---+FRC-APP-AFC Applying for FedRAMP Certification
---+FRC-APP-FCP Fresh FedRAMP Certification Package
---+FRC-APP-FIA Fresh Independent Assessment
---+FRC-APP-NTP No Third-Party Applicants
---+FRC-APP-USA Updating Stale Assessments

FRC-APP Applying for FedRAMP Certification

These rules apply to cloud service providers who have met all other relevant rules and are ready to apply for any FedRAMP Certification.

  • Types: 20x, Rev5
  • Paths: Program, Agency
  • Classes: A, B, C, D
  • Affects: Providers

1. Overzicht

FRC-APP-MLF Marketplace Listing First

Providers MUST be listed in the FedRAMP Marketplace before applying for FedRAMP Certification, including:

  • FedRAMP Marketplace: MKT-CSO-MLR (Marketplace Listing Requirements),
  • FedRAMP Marketplace: MKT-CSO-PML (Provider Marketplace Listing Requests)
  • FedRAMP Marketplace: MKT-IIP-AGU (Agency Use Cases)
  • FedRAMP Marketplace: MKT-IIP-DCP (Demonstrating Continuous Progress)

Related rules: MKT-CSO-MLR, MKT-CSO-PML, MKT-IIP-AGU, MKT-IIP-DCP
FRC-APP-AFC Applying for FedRAMP Certification

Providers MUST complete the FedRAMP Certification Application Form in full to request an initial assessment by FedRAMP.

Notification
FRC-APP-FCP Fresh FedRAMP Certification Package

Providers MUST supply a fresh initial FedRAMP Certification Package that shows the current status of the cloud service offering as verified and validated by the provider within the previous 7 days.

Defined terms: Certification Package, Cloud Service Offering, Validation, Verification
FRC-APP-FIA Fresh Independent Assessment

Class A

Providers seeking Class A Certification MAY supply a fresh initial FedRAMP independent assessment that was completed by a FedRAMP Recognized independent assessment service within the previous 3 months.

Timeframe: 3 months

Class B

Providers seeking Class B Certification MUST supply a fresh initial FedRAMP independent assessment that was completed by a FedRAMP Recognized independent assessment service within the previous 3 months.

Timeframe: 3 months

Class C

Providers seeking Class C Certification MUST supply a fresh initial FedRAMP independent assessment that was completed by a FedRAMP Recognized independent assessment service within the previous 3 months.

Timeframe: 3 months

Class D

Providers seeking Class D Certification MUST supply a fresh initial FedRAMP independent assessment that was completed by a FedRAMP Recognized independent assessment service within the previous 3 months.

Timeframe: 3 months

Defined terms: FedRAMP Independent Assessment, FedRAMP Recognized
FRC-APP-NTP No Third-Party Applicants

Providers MUST NOT use a third party to apply for a FedRAMP Certification on their behalf; this includes independent assessment services.

Notes

FedRAMP previously allowed independent assessment services to submit applications on behalf of providers, but this caused confusion about who was responsible for the application and the information in it. Providers should apply directly to ensure clear accountability.

Providers may use third parties to help them prepare their application and assessment materials for submission.
FRC-APP-USA Updating Stale Assessments

Providers MAY freshen a stale initial independent verification and validation assessment by having a FedRAMP Recognized independent assessment service review any changes between the original assessment and the current status of the cloud service offering in place of a full re-assessment, UNLESS the stale assessment is more than 9 months old.

Defined terms: Cloud Service Offering, FedRAMP Recognized, Validation, Verification

1.1 Referenties

1.2 Geïdentificeerde eisen

1.3 Gerelateerde regelingen

2. Geïdentificeerde eisen

Eisen

3. Gerelateerde regelingen

Regelingen
  • FedRAMP Consolidated Rules -

    EN: FedRAMP® Consolidated Rules of the Federal Risk and Authorization Management Program, U.S. General Services Administration (GSA), https://www.fedramp.gov/, from their machine-readable version (FedRAMP/rules). Works of the U.S. Government are not subject to copyright protection in the United States (17 U.S.C. § 105; GSA website policies); GSA dedicated its machine-readable FedRAMP content to the public domain worldwide (CC0 1.0). FedRAMP® is a registered trademark of GSA; GRCA is not affiliated with, nor endorsed by, GSA or FedRAMP. Divided into sections and converted into the GRCA format, the wording unchanged, linked to the NIST SP 800-53 controls they name. Only the version published by FedRAMP is authoritative.

    DE: FedRAMP® Consolidated Rules des Federal Risk and Authorization Management Program, U.S. General Services Administration (GSA), https://www.fedramp.gov/, aus ihrer maschinenlesbaren Fassung (FedRAMP/rules). Werke der US-Regierung sind in den USA urheberrechtlich nicht geschützt (17 U.S.C. § 105; Website-Richtlinien der GSA); die GSA hat ihre maschinenlesbaren FedRAMP-Inhalte weltweit gemeinfrei gestellt (CC0 1.0). FedRAMP® ist eine eingetragene Marke der GSA; GRCA steht in keiner Verbindung zur GSA oder zu FedRAMP und wird von ihnen nicht unterstützt. In Abschnitte aufgeteilt und in das GRCA-Format umgewandelt, der Wortlaut unverändert, mit den genannten Controls aus NIST SP 800-53 verknüpft. Maßgeblich ist allein die von FedRAMP veröffentlichte Fassung.