CCM-OCR Ongoing Certification Reports

Providers MUST supply an Ongoing Certification Report to all necessary parties every 3 months, covering the entire period since the previous summary, in a consistent format that is human readable; this report MUST include high-level summaries of at least the following information (if applicable):

• Changes to FedRAMP Certification Data
• Planned changes to FedRAMP Certification Data during at least the next 3 months
• Accepted vulnerabilities
• Transformative changes
• Updated recommendations or best practices for security, configuration, usage, or similar aspects of the cloud service offering
• A list of all agencies that are directly using the product
• FedRAMP Reportable Incidents or an attestation that no such incidents occurred
• Lessons learned and changes planned or made as a result of FedRAMP Reportable Incidents (if such occurred)

Timeframe: 3 months

Artifacts

• Most recent Ongoing Certification Report. If the report is not available, the provider MUST provide a sample report that includes all required information.
• How the report will be delivered

Schema: FedRAMP Ongoing Certification Report (CCM-OCR-AVL)

NIST SP 800-53 Rev. 5 controls: CA-7

Defined terms: Accepted Vulnerability, All Necessary Parties, Certification Data, Cloud Service Offering, FedRAMP Certification Report, FedRAMP Reportable Incident, Incident, Ongoing Certification, Ongoing Certification Report (OCR), Transformative Change, Vulnerability

Providers MUST supply the target date for their next Ongoing Certification Report with other public FedRAMP Certification Data.

Defined terms: Certification Data, FedRAMP Certification Report, Ongoing Certification, Ongoing Certification Report (OCR)

Providers MUST supply an asynchronous mechanism for all necessary parties to provide feedback or ask questions about each Ongoing Certification Report.

Note

This could be email by default but providers are encouraged to consider something more interactive as appropriate.

Artifacts

• How to access the feedback mechanism.

Defined terms: All Necessary Parties, FedRAMP Certification Report, Ongoing Certification, Ongoing Certification Report (OCR)

Providers MUST supply an anonymized and desensitized summary of the feedback, questions, and answers about each Ongoing Certification Report as an addendum to the Ongoing Certification Report OR in the next Ongoing Certification Report.

Note

This is intended to encourage sharing of information and decrease the burden on the cloud service provider - providing this summary will reduce duplicate questions from agencies and ensure FedRAMP has access to this information. It is generally in the provider's interest to update this addendum frequently throughout the quarter.

Artifacts

• How the summary will be delivered

Defined terms: FedRAMP Certification Report, Ongoing Certification, Ongoing Certification Report (OCR)

Providers MUST NOT irresponsibly disclose sensitive information in an Ongoing Certification Report that would likely have an adverse effect on the cloud service offering.

Defined terms: Cloud Service Offering, FedRAMP Certification Report, Likely, Ongoing Certification, Ongoing Certification Report (OCR)

Providers SHOULD establish a regular 3 month cycle for Ongoing Certification Reports that is spread out from the beginning, middle, or end of each quarter.

Note

This recommendation is intended to discourage hundreds of cloud service providers from releasing their Ongoing Certification Reports during the first or last week of each quarter because that is the easiest way for a single provider to track this deliverable; the result would overwhelm agencies with many cloud services. Widely used cloud service providers are encouraged to work with their customers to identify ideal timeframes for this cycle.

Defined terms: Ongoing Certification, Regularly

Providers MAY responsibly supply some or all of the information an Ongoing Certification Report to the public or other parties if the provider determines doing so will NOT likely have an adverse effect on the cloud service offering.

Defined terms: Cloud Service Offering, FedRAMP Certification Report, Likely, Ongoing Certification, Ongoing Certification Report (OCR), Responsibly