Security Decision Record¶

Providers MUST supply a Security Decision Record, in both human-readable and JSON formats, that includes at least all of the following information for each applicable FedRAMP Rule:

1. Explanation of how the rule is followed, or an explanation of the reason and resulting risk to customers for not following the rule.
2. Verification that the implementation is appropriate for the rule, or that the reason for not implementing is accepted by a senior official.
3. Validation that the implementation is in place and working as intended, or that the reason for not implementing is accepted by a senior official.
4. Independent verification.
5. Independent validation.
6. Any responses or clarifications to the comments in the independent verification or validation.
7. Rule-specific artifacts (if applicable).

Terms: Artifacts, Validation, Verification

Providers MUST also include the following basic metadata in their Security Decision Record:

1. Version
2. Date and time of last update
3. Source of update

Providers MUST also include short and simple high-level summaries of at least the following for each applicable Key Security Indicator:

1. Explanation of measures (and their objectives) that demonstrate the Key Security Indicator, or an explanation of the reason and resulting risk to customers for not having measures available for that Key Security Indicator.
2. Explanation of the cycle for any measures that are implemented persistently (if applicable).
3. Verification that the measures demonstrate the Key Security Indicator, or that the reason for not having them is accepted.
4. Verification that the automation in place is accurate and sufficient to demonstrate appropriate measures for the Key Security Indicator, or that automation is not necessary for each measure.
5. Validation that the measures are accurately produced and are in place and working as intended, or that the reason for not having them is valid.

Terms: Persistently, Validation, Verification