Agency Use of FedRAMP Certified Cloud Services (Needs Review)¶

Agencies MUST maintain agency-wide policy that aligns with the requirements in OMB Memorandum M-24-15.

Agencies MUST supply FedRAMP the following information upon authorizing the use of a cloud service within the scope of FedRAMP:

1. A copy of the Authorization to Operate letter
2. All other supplementary information outlined at https://help.fedramp.gov/ato

Agencies MUST ensure that internal governance, risk, compliance, and inventory tools can produce and ingest machine-readable artifacts using formats identified by FedRAMP, including at least:

1. Open Security Controls Assessment Language (OSCAL)
2. JSON

Terms: Artifacts, Machine-Readable

Agencies MUST NOT require additional information or materials from FedRAMP Certified cloud service offerings beyond those required by FedRAMP UNLESS the head of the agency or an authorized delegate determines there is a demonstrable need; this does not apply to seeking clarification or asking general questions about FedRAMP Certification Data.

Note: This is related to the Presumption of Adequacy for a FedRAMP Certification.

Terms: Certification Data, Cloud Service Offering, FedRAMP Certified

Agencies MUST notify FedRAMP after requesting any additional information or materials from a FedRAMP Certified cloud service offering beyond those FedRAMP requires.

Note: Agencies are expected to notify FedRAMP under OMB Memorandum M-24-15 section IV (a).

Terms: Cloud Service Offering, FedRAMP Certified

Agencies SHOULD participate in FedRAMP working groups, communities of practice, and stakeholder engagements to supply feedback and align practices across government.

Agencies SHOULD assign at least 1 federal employee to be an active participant in the FedRAMP Agency Liaison program.

Reference: Agency Liaison Program

Agencies SHOULD establish and maintain a dedicated shared FedRAMP agency inbox to serve as the official point of contact for communications between FedRAMP and the agency.

Note: A shared FedRAMP agency inbox may follow an agency-specific format such as agency-fedramp@agency.gov.

Agencies MUST complete the Authorization to Operate process for federal information systems that use FedRAMP Certified cloud service offerings.

Note: FedRAMP provides technical assistance to help agencies navigate this process.

Reference: Using a FedRAMP Certified Cloud Service Offering

Terms: Cloud Service Offering, FedRAMP Certified

Agencies MUST collaborate with FedRAMP when discrepancies or conflicts arise between agency-specific security determinations and the baseline FedRAMP Certification package.

Terms: Certification Package

Agencies MUST review the Secure Configuration Guides supplied by Providers and configure relevant security settings.

Agencies MUST allow FedRAMP Certified cloud service offerings to follow FedRAMP rules.

Terms: Cloud Service Offering, FedRAMP Certified

Agencies SHOULD review each Ongoing Authorization Report to understand how changes to the cloud service offering may impact the risk tolerance documented in the agency Authorization to Operate for the federal information system that includes the cloud service offering in its boundary.

Note: This agency review supports agency responsibilities under 44 USC § 35, OMB Circular A-130, FIPS-200, and OMB Memorandum M-24-15.

Terms: Cloud Service Offering

Agencies MUST notify FedRAMP if information presented in an Ongoing Authorization Report, Quarterly Review, or other FedRAMP Certification Data causes significant concerns for the authorizing official that would likely result in rescission of their Authorization to Operate.

Note: Agencies are expected to notify FedRAMP under OMB Memorandum M-24-15 section IV (a).

Terms: Certification Data, Likely, Quarterly Review

Agencies SHOULD designate a federal senior information security official to review Ongoing Authorization Reports and represent the agency at Quarterly Reviews for cloud service offerings included in agency information systems.

Terms: Cloud Service Offering, Quarterly Review

Agencies SHOULD formally notify the Provider if information presented in an Ongoing Authorization Report, Quarterly Review, or other FedRAMP Certification Data causes significant concerns for the authorizing official that would likely result in rescission of their Authorization to Operate.

Terms: Certification Data, Likely, Quarterly Review

Agencies SHOULD consider third-party information resources used by the cloud service offering during initial and ongoing authorization activities.

Terms: Cloud Service Offering, Information Resource, Third-Party Information Resource

Agencies MUST follow the most recent FedRAMP Consolidated Rules when initiating agency-sponsored FedRAMP Certification.