+IVV Independent Verification and Validation
---+IVV-CSO General Provider Responsibilities
------+IVV-CSO-FIA FedRAMP Independent Assessments
------+IVV-CSO-SEI Supply Evidence of Implementation
------+IVV-CSO-SEE Supply Evidence of Effectiveness
------+IVV-CSO-ICP Inclusion in Certification Package
------+IVV-CSO-DUS Document Use of Representative Samples
------+IVV-CSO-STE Supply Technical Explanations
------+IVV-CSO-USR Use Representative Samples
------+IVV-CSO-RAA Receiving Assessor Advice
---+IVV-IAS General Independent Assessor Responsibilities
------+IVV-IAS-VIM Verify Implementation
------+IVV-IAS-VEF Validate Effectiveness
------+IVV-IAS-SUM Assessment Summary
------+IVV-IAS-OSA Overall Summary of Assessment
------+IVV-IAS-VIP Verify Inclusion in Certification Package
------+IVV-IAS-EPX Engage Provider Experts
------+IVV-IAS-SHA Sharing Advice
---+IVV-CSX 20x-Specific Provider Responsibilities
------+IVV-CSX-AIA Annual Independent Assessments for 20x
---+IVV-CSF Rev5-Specific Provider Responsibilities
------+IVV-CSF-AIA Annual Independent Assessments for Rev5
---------+IVV-CSF-AIA Annual Independent Assessments for Rev5 – Class B
---------+IVV-CSF-AIA Annual Independent Assessments for Rev5 – Class C
---------+IVV-CSF-AIA Annual Independent Assessments for Rev5 – Class D
------+IVV-CSF-MCA Mandatory Control Assessment
------+IVV-CSF-ACF Assessment of Rev5 Controls with Findings
------+IVV-CSF-PCA Preferred Control Assessment

IVV Independent Verification and Validation

This ruleset explains the expectations for independent verification and validation assessments.

Effective for 20x

  • Status: required
  • Current status: Consolidated Rules for 2026
  • Optional adoption from: 2026-07-04
  • Required for initial certification from: 2026-07-04
  • Required for ongoing certification from: 2027-01-01
  • Grace period ends: 2027-01-01 or at the next assessment

Effective for Rev5

  • Status: required
  • Current status: Consolidated Rules for 2026
  • Optional adoption from: 2026-07-04
  • Required for initial certification from: 2027-01-01
  • Required for ongoing certification from: 2027-01-01
  • Grace period ends: 2027-01-01 or at the next assessment

1. Visão geral

IVV-CSO General Provider Responsibilities

These rules apply to cloud service providers obtaining and maintaining any FedRAMP Certification.

  • Types: 20x, Rev5
  • Paths: Program, Agency
  • Classes: B, C, D
  • Affects: Providers
IVV-IAS General Independent Assessor Responsibilities

These rules apply to independent assessment services supporting all FedRAMP Certification types.

  • Types: 20x, Rev5
  • Paths: Program, Agency
  • Classes: B, C, D
  • Affects: Assessors
IVV-CSX 20x-Specific Provider Responsibilities

These rules apply to providers for FedRAMP 20x Certifications.

  • Types: 20x
  • Paths: Program
  • Classes: B, C, D
  • Affects: Providers
IVV-CSF Rev5-Specific Provider Responsibilities

These rules apply to providers for FedRAMP Rev5 Certifications.

  • Types: Rev5
  • Paths: Program, Agency
  • Classes: B, C, D
  • Affects: Providers

1.1 Referências

1.2 Requisitos identificados

1.3 Regulamentos relacionados

2. Requisitos identificados

Requisitos

3. Regulamentos relacionados

Regulamentos
  • FedRAMP Consolidated Rules -

    EN: FedRAMP® Consolidated Rules of the Federal Risk and Authorization Management Program, U.S. General Services Administration (GSA), https://www.fedramp.gov/, from their machine-readable version (FedRAMP/rules). Works of the U.S. Government are not subject to copyright protection in the United States (17 U.S.C. § 105; GSA website policies); GSA dedicated its machine-readable FedRAMP content to the public domain worldwide (CC0 1.0). FedRAMP® is a registered trademark of GSA; GRCA is not affiliated with, nor endorsed by, GSA or FedRAMP. Divided into sections and converted into the GRCA format, the wording unchanged, linked to the NIST SP 800-53 controls they name. Only the version published by FedRAMP is authoritative.

    DE: FedRAMP® Consolidated Rules des Federal Risk and Authorization Management Program, U.S. General Services Administration (GSA), https://www.fedramp.gov/, aus ihrer maschinenlesbaren Fassung (FedRAMP/rules). Werke der US-Regierung sind in den USA urheberrechtlich nicht geschützt (17 U.S.C. § 105; Website-Richtlinien der GSA); die GSA hat ihre maschinenlesbaren FedRAMP-Inhalte weltweit gemeinfrei gestellt (CC0 1.0). FedRAMP® ist eine eingetragene Marke der GSA; GRCA steht in keiner Verbindung zur GSA oder zu FedRAMP und wird von ihnen nicht unterstützt. In Abschnitte aufgeteilt und in das GRCA-Format umgewandelt, der Wortlaut unverändert, mit den genannten Controls aus NIST SP 800-53 verknüpft. Maßgeblich ist allein die von FedRAMP veröffentlichte Fassung.