{ "dataset": "2026.10.13.01", "rules": [ { "family": "AFC", "family_name": "Addressing FedRAMP Communication", "force": "MUST", "frrID": "AFC-CSO-INB", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "Maintain a FedRAMP Security Inbox", "statement": "Providers MUST establish and maintain an email address to receive messages from FedRAMP; this inbox is a FedRAMP Security Inbox (FSI).", "status": "fail" }, { "family": "AFC", "family_name": "Addressing FedRAMP Communication", "force": "MUST", "frrID": "AFC-CSO-NOC", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "Notification of Changes", "statement": "Providers MUST immediately notify FedRAMP of any changes to the email address for their FedRAMP Security Inbox.", "status": "fail" }, { "family": "AFC", "family_name": "Addressing FedRAMP Communication", "force": "MUST", "frrID": "AFC-CSO-TFG", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "Trust @fedramp.gov and @gsa.gov", "statement": "Providers MUST treat any email originating from an @fedramp.gov or @gsa.gov email address as if it was sent from FedRAMP by default; if such a message is confirmed to originate from someone other than FedRAMP then the FedRAMP Security Inbox rules no longer apply.", "status": "fail" }, { "family": "AFC", "family_name": "Addressing FedRAMP Communication", "force": "MUST", "frrID": "AFC-CSO-RCV", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "Receive Email Without Disruption", "statement": "Providers MUST receive and react to email messages from FedRAMP without disruption and without requiring additional actions from FedRAMP.", "status": "fail" }, { "family": "AFC", "family_name": "Addressing FedRAMP Communication", "force": "MUST", "frrID": "AFC-CSO-CRA", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "Complete Required Actions", "statement": "Providers MUST complete the required actions in Emergency or Emergency Test designated messages sent by FedRAMP within the timeframe included in the message.", "status": "fail" }, { "family": "AFC", "family_name": "Addressing FedRAMP Communication", "force": "MUST", "frrID": "AFC-CSO-EMR", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "Emergency Message Routing", "statement": "Providers MUST route Emergency designated messages sent by FedRAMP to a senior security official for their awareness.", "status": "fail" }, { "family": "AFC", "family_name": "Addressing FedRAMP Communication", "force": "SHOULD", "frrID": "AFC-CSO-IMA", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "Important Message Actions", "statement": "Providers SHOULD complete the required actions in Important designated messages sent by FedRAMP within the timeframe specified in the message.", "status": "fail" }, { "family": "AFC", "family_name": "Addressing FedRAMP Communication", "force": "SHOULD", "frrID": "AFC-CSO-ACK", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "Acknowledge Receipt", "statement": "Providers SHOULD promptly and automatically acknowledge the receipt of messages received from FedRAMP in their FedRAMP Security Inbox.", "status": "fail" }, { "family": "CCM", "family_name": "Collaborative Continuous Monitoring", "force": "MUST", "frrID": "CCM-OCR-AVL", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "Report Availability", "statement": "Providers MUST supply an Ongoing Certification Report to all necessary parties every 3 months, covering the entire period since the previous summary, in a consistent format that is human readable; this report MUST include high-level summaries of at least the following information (if applicable):", "status": "fail" }, { "family": "CCM", "family_name": "Collaborative Continuous Monitoring", "force": "MUST", "frrID": "CCM-OCR-NRD", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "Next Report Date", "statement": "Providers MUST supply the target date for their next Ongoing Certification Report with other public FedRAMP Certification Data.", "status": "fail" }, { "family": "CCM", "family_name": "Collaborative Continuous Monitoring", "force": "MUST", "frrID": "CCM-OCR-FBM", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "Feedback Mechanism", "statement": "Providers MUST supply an asynchronous mechanism for all necessary parties to provide feedback or ask questions about each Ongoing Certification Report.", "status": "fail" }, { "family": "CCM", "family_name": "Collaborative Continuous Monitoring", "force": "MUST", "frrID": "CCM-OCR-AFS", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "Anonymized Feedback Summary", "statement": "Providers MUST supply an anonymized and desensitized summary of the feedback, questions, and answers about each Ongoing Certification Report as an addendum to the Ongoing Certification Report OR in the next Ongoing Certification Report.", "status": "fail" }, { "family": "CCM", "family_name": "Collaborative Continuous Monitoring", "force": "MUST NOT", "frrID": "CCM-OCR-LSI", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "Limit Sensitive Information", "statement": "Providers MUST NOT irresponsibly disclose sensitive information in an Ongoing Certification Report that would likely have an adverse effect on the cloud service offering.", "status": "fail" }, { "family": "CCM", "family_name": "Collaborative Continuous Monitoring", "force": "SHOULD", "frrID": "CCM-OCR-SOR", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "Spread Out Reports", "statement": "Providers SHOULD establish a regular 3 month cycle for Ongoing Certification Reports that is spread out from the beginning, middle, or end of each quarter.", "status": "fail" }, { "family": "CCM", "family_name": "Collaborative Continuous Monitoring", "force": "MAY", "frrID": "CCM-OCR-RPS", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "Responsible Public Certification Report Sharing", "statement": "Providers MAY responsibly supply some or all of the information an Ongoing Certification Report to the public or other parties if the provider determines doing so will NOT likely have an adverse effect on the cloud service offering.", "status": "fail" }, { "family": "CCM", "family_name": "Collaborative Continuous Monitoring", "force": "MUST", "frrID": "CCM-QTR-MTG", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "Quarterly Review Meeting", "statement": "Providers with Class C Certifications MUST host a synchronous Quarterly Review every 3 months, open to all necessary parties, to review aspects of the most recent Ongoing Certification Reports that the provider determines are of the most relevance to agencies.", "status": "fail" }, { "family": "CCM", "family_name": "Collaborative Continuous Monitoring", "force": "MUST", "frrID": "CCM-QTR-REG", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "Meeting Registration Info", "statement": "Providers MUST supply either a registration link or a downloadable calendar file with meeting information for Quarterly Reviews to all necessary parties.", "status": "fail" }, { "family": "CCM", "family_name": "Collaborative Continuous Monitoring", "force": "MUST", "frrID": "CCM-QTR-NRD", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "Next Review Date", "statement": "Providers MUST publicly supply the target date for their next Quarterly Review with other public FedRAMP Certification Data.", "status": "fail" }, { "family": "CCM", "family_name": "Collaborative Continuous Monitoring", "force": "MUST NOT", "frrID": "CCM-QTR-NID", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "No Irresponsible Disclosure", "statement": "Providers MUST NOT irresponsibly disclose sensitive information in a Quarterly Review that would likely have an adverse effect on the cloud service offering.", "status": "fail" }, { "family": "CCM", "family_name": "Collaborative Continuous Monitoring", "force": "SHOULD", "frrID": "CCM-QTR-SAR", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "Schedule Around Reports", "statement": "Providers SHOULD regularly schedule Quarterly Reviews to occur at least 3 business days after releasing an Ongoing Certification Report AND within 10 business days of such release.", "status": "fail" }, { "family": "CCM", "family_name": "Collaborative Continuous Monitoring", "force": "SHOULD", "frrID": "CCM-QTR-ACT", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "Additional Content", "statement": "Providers SHOULD supply additional information in Quarterly Reviews that the provider determines is of interest, use, or otherwise relevant to agencies.", "status": "fail" }, { "family": "CCM", "family_name": "Collaborative Continuous Monitoring", "force": "SHOULD", "frrID": "CCM-QTR-RTR", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "Record/Transcribe Reviews", "statement": "Providers SHOULD record or transcribe Quarterly Reviews and supply them to all necessary parties.", "status": "fail" }, { "family": "CCM", "family_name": "Collaborative Continuous Monitoring", "force": "SHOULD NOT", "frrID": "CCM-QTR-RTP", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "Restrict Third Parties", "statement": "Providers SHOULD NOT invite third parties to attend Quarterly Reviews intended for agencies unless they have specific relevance.", "status": "fail" }, { "family": "CCM", "family_name": "Collaborative Continuous Monitoring", "force": "MAY", "frrID": "CCM-QTR-SRR", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "Share Recordings Responsibly", "statement": "Providers MAY responsibly supply recordings or transcriptions of Quarterly Reviews to the public or other parties ONLY if the provider removes all agency information (comments, questions, names, etc.) AND determines doing so will NOT likely have an adverse effect on the cloud service offering.", "status": "fail" }, { "family": "CCM", "family_name": "Collaborative Continuous Monitoring", "force": "MAY", "frrID": "CCM-QTR-SCR", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "Share Content Responsibly", "statement": "Providers MAY responsibly supply content prepared for a Quarterly Review to the public or other parties if the provider determines doing so will NOT likely have an adverse effect on the cloud service offering.", "status": "fail" }, { "family": "CDS", "family_name": "Certification Data Sharing", "force": "MUST", "frrID": "CDS-CSO-PUB", "frrImplementation": [ "1. The public page and the certification package overview share the provider name, service name, description, service model, deployment model, website, logo, FedRAMP ID, security contact, trust center address, and the service list. An assessor, a next report date, a public secure configuration guide, and service security categories are not available.\n2. We compared this explanation with the rule. It matches what this tenant does.\n3. Opening the record rebuilds this text from the stored evidence, which is how we check that it still matches the result.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Partially Implemented", "name": "Public Information", "statement": "Providers MUST publicly share up-to-date information about the cloud service offering in both human-readable and JSON formats, including at least the following information that is available and applicable:", "status": "partial" }, { "family": "CDS", "family_name": "Certification Data Sharing", "force": "MUST", "frrID": "CDS-CSO-SVC", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "Public Service List", "statement": "Providers MUST publicly share a detailed list of specific services and their security categories that are included in the cloud service offering using clear feature or service names that align with standard public marketing materials; this list MUST be complete enough for a potential customer to determine which services are and are not included in the FedRAMP Minimum Assessment Scope without requesting access to underlying FedRAMP Certification Data.", "status": "fail" }, { "family": "CDS", "family_name": "Certification Data Sharing", "force": "MUST", "frrID": "CDS-CSO-FID", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "Always Include FedRAMP ID", "statement": "Providers MUST always include the FedRAMP ID of the related cloud service offering in all FedRAMP Certification Data once assigned, including all reports, notifications, and other communication that results from FedRAMP rules.", "status": "fail" }, { "family": "CDS", "family_name": "Certification Data Sharing", "force": "MUST", "frrID": "CDS-CSO-FRC", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "FedRAMP Certification Reports", "statement": "Providers MUST include FedRAMP Certification Reports with their FedRAMP Certification Data without inappropriate modifications, and make such reports available within 2 weeks of receiving the materials from FedRAMP.", "status": "fail" }, { "family": "CDS", "family_name": "Certification Data Sharing", "force": "MUST", "frrID": "CDS-CSO-AVR", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "Availability Reporting", "statement": "Providers with Class C Certifications MUST maintain a web service, available to all necessary parties, that indicates current and historical availability of core services within the cloud service offering over at least the past 30 days, including availability incidents, in both human-readable and machine-readable formats; this service MUST be available even if the primary cloud service offering is unavailable.", "status": "fail" }, { "family": "CDS", "family_name": "Certification Data Sharing", "force": "MUST", "frrID": "CDS-CSO-UTC", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "Use Trust Centers", "statement": "Providers MUST use a FedRAMP-compatible trust center to store and share FedRAMP Certification Data with all necessary parties.", "status": "fail" }, { "family": "CDS", "family_name": "Certification Data Sharing", "force": "MUST", "frrID": "CDS-CSO-CBF", "frrImplementation": [ "1. The public page and the public JSON files are produced by the same functions from the same stored evidence. There is no separate copy that can drift.\n2. We compared this explanation with the rule. It matches what this tenant does.\n3. Opening the record rebuilds this text from the stored evidence, which is how we check that it still matches the result.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Implemented", "name": "Consistency Between Formats", "statement": "Providers MUST use automation to ensure information remains consistent between human-readable and machine-readable formats when FedRAMP Certification Data is provided in both formats.", "status": "pass" }, { "family": "CDS", "family_name": "Certification Data Sharing", "force": "MUST", "frrID": "CDS-CSO-RIS", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "Responsible Information Sharing", "statement": "Providers MUST provide sufficient information in FedRAMP Certification Data to support agency authorization decisions but SHOULD NOT include sensitive information that would likely enable a threat actor to gain unauthorized access, cause harm, disrupt operations, or otherwise have a negative adverse impact on the cloud service offering.", "status": "fail" }, { "family": "CDS", "family_name": "Certification Data Sharing", "force": "MUST", "frrID": "CDS-CSO-IRP", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "Include Relevant Policies", "statement": "Providers MUST supply all relevant policies and procedures in the FedRAMP Certification Data, including a human-readable and machine-readable reference that explains at least the following about each included policy and procedure:", "status": "fail" }, { "family": "CDS", "family_name": "Certification Data Sharing", "force": "MUST", "frrID": "CDS-CSO-HAD", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "Historical FedRAMP Certification Data", "statement": "Providers MUST supply snapshots of FedRAMP Certification Data aligned to Ongoing Certification Reports to all necessary parties; these snapshots MUST be available for the duration of FedRAMP Certification.", "status": "fail" }, { "family": "CDS", "family_name": "Certification Data Sharing", "force": "MAY", "frrID": "CDS-CSO-PSM", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "Per-Service Certification Materials", "statement": "Providers with Class C Certifications MAY supply per-service FedRAMP Certification materials.", "status": "fail" }, { "family": "CDS", "family_name": "Certification Data Sharing", "force": "MAY", "frrID": "CDS-CSO-RPS", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "Responsible Public Package Sharing", "statement": "Providers MAY responsibly share some or all of the information in a FedRAMP Certification Package publicly or with other parties if the provider determines doing so will NOT likely have an adverse effect on the cloud service offering.", "status": "fail" }, { "family": "CDS", "family_name": "Certification Data Sharing", "force": "MUST", "frrID": "CDS-TRC-USH", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "Uninterrupted Sharing", "statement": "Trust centers MUST share FedRAMP Certification Data with all necessary parties without interruption.", "status": "fail" }, { "family": "CDS", "family_name": "Certification Data Sharing", "force": "MUST", "frrID": "CDS-TRC-PAC", "frrImplementation": [ "1. Every public certification file linked from this page is available with an unauthenticated GET. The HTML page is the human-readable form of the same data.\n2. We compared this explanation with the rule. It matches what this tenant does.\n3. Opening the record rebuilds this text from the stored evidence, which is how we check that it still matches the result.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Implemented", "name": "Programmatic Access", "statement": "Trust centers MUST provide documented programmatic access to all FedRAMP Certification Data, including programmatic access to human-readable materials.", "status": "pass" }, { "family": "CDS", "family_name": "Certification Data Sharing", "force": "MUST", "frrID": "CDS-TRC-AAI", "frrImplementation": [ "1. No federal agency user or system has been granted access to certification data. The current inventory and the history are published at /public/access.json. Public files do not require an agency account.\n2. We compared this explanation with the rule. It matches what this tenant does.\n3. Opening the record rebuilds this text from the stored evidence, which is how we check that it still matches the result.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Implemented", "name": "Agency Access Inventory", "statement": "Trust centers MUST maintain an inventory and history of federal agency users or systems with access to FedRAMP Certification Data and MUST make this information available to FedRAMP upon request.", "status": "pass" }, { "family": "CDS", "family_name": "Certification Data Sharing", "force": "MUST", "frrID": "CDS-TRC-ACL", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "Access Logging", "statement": "Trust centers MUST log access to FedRAMP Certification Data and store summaries of access for at least six months; such information, as it pertains to specific parties, SHOULD be made available upon request by those parties.", "status": "fail" }, { "family": "CDS", "family_name": "Certification Data Sharing", "force": "SHOULD", "frrID": "CDS-TRC-HMR", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "Human and Machine-Readable Certification Data", "statement": "Trust centers SHOULD make FedRAMP Certification Data available to view and download in both human-readable and machine-readable formats.", "status": "fail" }, { "family": "CDS", "family_name": "Certification Data Sharing", "force": "SHOULD", "frrID": "CDS-TRC-SSM", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "Self-Service Access Management", "statement": "Trust centers SHOULD include features that encourage all necessary parties to provision and manage access to FedRAMP Certification Data for their users and services directly.", "status": "fail" }, { "family": "CDS", "family_name": "Certification Data Sharing", "force": "MUST", "frrID": "CDS-UTC-AAD", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "Agency Access Denial", "statement": "Providers MUST notify FedRAMP within 5 business days of denying an agency access request for FedRAMP Certification Data.", "status": "fail" }, { "family": "CDS", "family_name": "Certification Data Sharing", "force": "SHOULD", "frrID": "CDS-UTC-AGA", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "Agency Access", "statement": "Providers SHOULD supply access to the FedRAMP Certification Package with agencies upon request.", "status": "fail" }, { "family": "CMU", "family_name": "Cryptographic Module Use", "force": "MUST", "frrID": "CMU-CSO-CMD", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "Cryptographic Module Documentation", "statement": "Providers MUST document the cryptographic modules used in each service (or groups of services that use the same modules) where cryptographic services are used to protect federal customer data, including whether these modules are validated under the NIST Cryptographic Module Validation Program or are update streams of such modules.", "status": "fail" }, { "family": "CMU", "family_name": "Cryptographic Module Use", "force": "SHOULD", "frrID": "CMU-CSO-UVM", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "Using Validated Cryptographic Modules", "statement": "Providers with Class C Certifications SHOULD use cryptographic modules or update streams of cryptographic modules with active validations under the NIST Cryptographic Module Validation Program when using cryptographic services to protect federal customer data.", "status": "fail" }, { "family": "CMU", "family_name": "Cryptographic Module Use", "force": "SHOULD", "frrID": "CMU-CSO-CAT", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "Configuration of Agency Tenants", "statement": "Providers SHOULD configure agency tenants by default to use cryptographic services that use cryptographic modules or update streams of cryptographic modules with active validations under the NIST Cryptographic Module Validation Program when such modules are available.", "status": "fail" }, { "family": "CPO", "family_name": "Certification Package Overview", "force": "MUST", "frrID": "CPO-CSO-OVR", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "Overview of the Cloud Service Offering", "statement": "Providers MUST supply a Certification Package Overview within their FedRAMP Certification Package, in both human-readable and JSON formats, that includes at least all of the information required by the following rules:", "status": "fail" }, { "family": "CPO", "family_name": "Certification Package Overview", "force": "MUST", "frrID": "CPO-CSO-MTD", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "Certification Package Overview Metadata", "statement": "Providers MUST also include the following basic metadata in their Certification Package Overview:", "status": "fail" }, { "family": "CPO", "family_name": "Certification Package Overview", "force": "MUST", "frrID": "CPO-CSO-OSA", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "Overall Summary of Assessment in Certification Package", "statement": "Providers seeking Class C Certification MUST also include the overall summary of their FedRAMP independent assessment, supplied by the assessor per IVV-IAS-OSA (Overall Summary of Assessment), in their Certification Package Overview.", "status": "fail" }, { "family": "CPO", "family_name": "Certification Package Overview", "force": "MUST", "frrID": "CPO-CSX-CPM", "frrImplementation": [ "1. Class C asks that the certification package stay current at least every two weeks. This record is built when the page is opened, from the latest stored evidence for the selected date. The rest of the package is not supplied with it. No senior official has accepted this gap.\n2. We compared this explanation with the rule. It matches what this tenant does.\n3. Opening the record rebuilds this text from the stored evidence, which is how we check that it still matches the result.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "Certification Package Maintenance for 20x", "statement": "Providers with 20x Class C Certifications MUST persistently maintain their FedRAMP Certification Package to ensure it is up to date and complete at least once every 2 weeks.", "status": "fail" }, { "family": "FRC", "family_name": "FedRAMP Certification", "force": "MUST", "frrID": "FRC-CSO-FCP", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "FedRAMP Certification Profile", "statement": "Providers MUST identify a target FedRAMP Certification Profile and apply all relevant FedRAMP Practices to the cloud service offering.", "status": "fail" }, { "family": "FRC", "family_name": "FedRAMP Certification", "force": "MUST", "frrID": "FRC-CSO-PKG", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "FedRAMP Certification Package", "statement": "Providers seeking a Certification MUST supply a complete FedRAMP Certification Package to FedRAMP for initial certification; the FedRAMP Certification Package MUST include at least the following information:", "status": "fail" }, { "family": "FRC", "family_name": "FedRAMP Certification", "force": "MUST", "frrID": "FRC-CSO-JSN", "frrImplementation": [ "1. Public JSON responses use Content-Type application/json, X-Content-Type-Options nosniff, and Cross-Origin Resource Sharing that allows another website to read them. The certification package overview and the security decision record validate against their FedRAMP schemas. The other package documents are not supplied.\n2. We compared this explanation with the rule. It matches what this tenant does.\n3. Opening the record rebuilds this text from the stored evidence, which is how we check that it still matches the result.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Partially Implemented", "name": "FedRAMP JSON Schemas", "statement": "Providers MUST supply machine-readable information in JSON documents that are valid against the corresponding JSON schema when a rule contains a FedRAMP JSON schema, UNLESS otherwise specified in the rule; public JSON data MUST be supplied in a manner compatible with modern web frameworks, including:", "status": "partial" }, { "family": "FRC", "family_name": "FedRAMP Certification", "force": "MUST", "frrID": "FRC-CSO-MRA", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "Maintain Responsibility and Accountability", "statement": "Providers MUST maintain responsibility and accountability for the accuracy and completeness of all information in the FedRAMP Certification Package, especially when they engage a third party (such as an independent assessor, advisory service, or external tools) to supply information on their behalf.", "status": "fail" }, { "family": "FRC", "family_name": "FedRAMP Certification", "force": "MUST NOT", "frrID": "FRC-CSO-POP", "frrImplementation": [ "1. This cloud service offering is not seeking a FedRAMP Rev5 program certification. The rules in use are the FedRAMP 20x set.\n2. We compared this explanation with the rule. It matches what this tenant does.\n3. Opening the record rebuilds this text from the stored evidence, which is how we check that it still matches the result.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Implemented", "name": "Pick One Program Certification Type", "statement": "Providers MUST NOT seek both FedRAMP Rev5 Program Certification and FedRAMP 20x Program Certification for the same cloud service offering; pick one type.", "status": "pass" }, { "family": "FRC", "family_name": "FedRAMP Certification", "force": "MUST", "frrID": "FRC-CLA-ASF", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "Approved Alternative Security Frameworks", "statement": "Providers seeking a FedRAMP Class A Certification MUST have completed a certification or equivalent process, including an independent assessment if applicable, from one of the following alternative security frameworks within the past 12 months:", "status": "fail" }, { "family": "FRC", "family_name": "FedRAMP Certification", "force": "MUST", "frrID": "FRC-CLA-EAM", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "External Assessment Materials", "statement": "Providers seeking a FedRAMP Class A Certification MUST supply the following materials from their alternative security framework assessment to all necessary parties:", "status": "fail" }, { "family": "FRC", "family_name": "FedRAMP Certification", "force": "MUST", "frrID": "FRC-CLA-MFR", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "Mandatory FedRAMP Rules for Class A", "statement": "Providers seeking a Class A FedRAMP Certification MUST address all rules in this FedRAMP Class A Certification subset (FRC-CLA) AND the following additional FedRAMP Class A rules; the appropriate artifacts or information mapping for all rules MUST be supplied in the FedRAMP Certification Package.", "status": "fail" }, { "family": "FRC", "family_name": "FedRAMP Certification", "force": "SHOULD", "frrID": "FRC-CLA-RFR", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "Recommended FedRAMP Rules for Class A", "statement": "Providers seeking a Class A FedRAMP Certification SHOULD address the following additional recommended FedRAMP Class A rules (if applicable):", "status": "fail" }, { "family": "FRC", "family_name": "FedRAMP Certification", "force": "MAY", "frrID": "FRC-CLA-OFR", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "Address Optional FedRAMP Rules for Class A", "statement": "Providers seeking a Class A FedRAMP Certification MAY address the following additional optional FedRAMP Class A rules (if applicable):", "status": "fail" }, { "family": "FRC", "family_name": "FedRAMP Certification", "force": "MAY", "frrID": "FRC-CLA-IVV", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "Optional Independent Verification and Validation", "statement": "Providers seeking a FedRAMP Class A Certification MAY have the FedRAMP Certification Package independently verified and validated by a FedRAMP Recognized assessor before submission to FedRAMP.", "status": "fail" }, { "family": "FRC", "family_name": "FedRAMP Certification", "force": "MUST", "frrID": "FRC-APP-MLF", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "Marketplace Listing First", "statement": "Providers MUST be listed in the FedRAMP Marketplace before applying for FedRAMP Certification, including:", "status": "fail" }, { "family": "FRC", "family_name": "FedRAMP Certification", "force": "MUST", "frrID": "FRC-APP-AFC", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "Applying for FedRAMP Certification", "statement": "Providers MUST complete the FedRAMP Certification Application Form in full to request an initial assessment by FedRAMP.", "status": "fail" }, { "family": "FRC", "family_name": "FedRAMP Certification", "force": "MUST", "frrID": "FRC-APP-FCP", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "Fresh FedRAMP Certification Package", "statement": "Providers MUST supply a fresh initial FedRAMP Certification Package that shows the current status of the cloud service offering as verified and validated by the provider within the previous 7 days.", "status": "fail" }, { "family": "FRC", "family_name": "FedRAMP Certification", "force": "MUST", "frrID": "FRC-APP-FIA", "frrImplementation": [ "1. Class C requires a fresh assessment by a FedRAMP-recognized independent assessor within the previous three months. There is no such assessment. No senior official has accepted this gap.\n2. We compared this explanation with the rule. It matches what this tenant does.\n3. Opening the record rebuilds this text from the stored evidence, which is how we check that it still matches the result.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "Fresh Independent Assessment", "statement": "Providers seeking Class C Certification MUST supply a fresh initial FedRAMP independent assessment that was completed by a FedRAMP Recognized independent assessment service within the previous 3 months.", "status": "fail" }, { "family": "FRC", "family_name": "FedRAMP Certification", "force": "MUST NOT", "frrID": "FRC-APP-NTP", "frrImplementation": [ "1. No FedRAMP certification application has been submitted. Mog Network LLC will submit any future application itself. No assessor or other third party is authorized to apply.\n2. We compared this explanation with the rule. It matches what this tenant does.\n3. Opening the record rebuilds this text from the stored evidence, which is how we check that it still matches the result.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Implemented", "name": "No Third-Party Applicants", "statement": "Providers MUST NOT use a third party to apply for a FedRAMP Certification on their behalf; this includes independent assessment services.", "status": "pass" }, { "family": "FRC", "family_name": "FedRAMP Certification", "force": "MAY", "frrID": "FRC-APP-USA", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "Updating Stale Assessments", "statement": "Providers MAY freshen a stale initial independent verification and validation assessment by having a FedRAMP Recognized independent assessment service review any changes between the original assessment and the current status of the cloud service offering in place of a full re-assessment, UNLESS the stale assessment is more than 9 months old.", "status": "fail" }, { "family": "FRC", "family_name": "FedRAMP Certification", "force": "MUST", "frrID": "FRC-APS-ATO", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "Agency Authorization to Operate", "statement": "Providers seeking a FedRAMP Rev5 Agency Certification MUST have completed the Authorization to Operate (ATO) process with their agency sponsor for the cloud service offering, concluding with a formal signed ATO letter that the agency has sent over official government channels to FedRAMP.", "status": "fail" }, { "family": "FRC", "family_name": "FedRAMP Certification", "force": "MUST", "frrID": "FRC-CCL-UCC", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "Upgrading Certification Class", "statement": "Providers MUST apply for a new FedRAMP Certification to upgrade their Certification Class; all applicable requirements MUST be met in advance.", "status": "fail" }, { "family": "FRC", "family_name": "FedRAMP Certification", "force": "MUST", "frrID": "FRC-CCL-DCC", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "Downgrading Certification Class", "statement": "Providers MUST apply for a new FedRAMP Certification to downgrade their Certification Class.", "status": "fail" }, { "family": "FRC", "family_name": "FedRAMP Certification", "force": "SHOULD", "frrID": "FRC-CCL-DNP", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "Downgrade Notification Period", "statement": "Providers SHOULD notify all necessary parties at least 120 days in advance of an intended downgrade or cancellation of FedRAMP Certification.", "status": "fail" }, { "family": "FRC", "family_name": "FedRAMP Certification", "force": "MUST", "frrID": "FRC-CSX-VVK", "frrImplementation": [ "1. Class C requires at least two automated checks for every Key Security Indicator. The record counts them from the catalog on each build and names every indicator whose count is under two. Those indicators are KSI-CED-RAT, KSI-CMT-RVP, KSI-CNA-OFA, KSI-CNA-RVP, KSI-INR-AAR, KSI-INR-RIR, KSI-INR-RPI, KSI-MLA-RVL, KSI-PIY-RES, KSI-PIY-RIS, KSI-PIY-RSD, KSI-PIY-RVD, KSI-RPL-ARP, KSI-RPL-RRO, KSI-RPL-TRC, KSI-SCR-MIT, KSI-SVC-EIS, KSI-SVC-PRR, KSI-SVC-RUD, KSI-SVC-VCM, KSI-SVC-VRI. This stays Not Implemented until every indicator has two automated checks that can actually complete. A second check that does nothing will not be added to change this status. No senior official has accepted this gap.\n2. We compared this explanation with the rule. It matches what this tenant does.\n3. Opening the record rebuilds this text from the stored evidence, which is how we check that it still matches the result.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "Automated Verification and Validation of Key Security Indicators", "statement": "Providers seeking 20x Class C Certification MUST implement automated methods to persistently verify and validate the accuracy and completeness of Key Security Indicators with at least 2 automated methods for each Key Security Indicator.", "status": "fail" }, { "family": "FRC", "family_name": "FedRAMP Certification", "force": "SHOULD", "frrID": "FRC-CSX-VVR", "frrImplementation": [ "1. This record is built from the evidence and the rule catalog when the page is opened. Most rules have no automated check.\n2. We compared this explanation with the rule. It matches what this tenant does.\n3. Opening the record rebuilds this text from the stored evidence, which is how we check that it still matches the result.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Partially Implemented", "name": "Automated Verification and Validation of FedRAMP Rules", "statement": "Providers seeking 20x Class C Certification SHOULD implement automated methods to persistently verify and validate the accuracy and completeness of the Security Decision Record for FedRAMP rules when applicable.", "status": "partial" }, { "family": "FRC", "family_name": "FedRAMP Certification", "force": "SHOULD", "frrID": "FRC-CSX-MAS", "frrImplementation": [ "1. These checks run in all four accounts, and one failed account fails the combined row. Many checks look only at roles and stacks this baseline deployed. There is no finished minimum-assessment-scope boundary. No senior official has accepted this gap.\n2. We compared this explanation with the rule. It matches what this tenant does.\n3. Opening the record rebuilds this text from the stored evidence, which is how we check that it still matches the result.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "Application within MAS", "statement": "Providers SHOULD apply ALL Key Security Indicators to ALL aspects of their cloud service offering that are within the FedRAMP Minimum Assessment Scope.", "status": "fail" }, { "family": "IEC", "family_name": "Incident Evaluation and Communication", "force": "MUST", "frrID": "IEC-CSO-EFR", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "Evaluate FedRAMP Reportability", "statement": "Providers MUST promptly evaluate incidents to determine if they affect confidentiality or integrity of federal customer data or are likely to affect confidentiality or integrity of federal customer data; such incidents are FedRAMP Reportable Incidents and must be reported following the FedRAMP Incident Evaluation and Communication rules.", "status": "fail" }, { "family": "IEC", "family_name": "Incident Evaluation and Communication", "force": "MUST", "frrID": "IEC-CSO-DPR", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "Default PAIN Rating", "statement": "Providers MUST treat FedRAMP Reportable Incidents as if they have a Potential Agency Impact N-rating (PAIN) of 5 UNLESS they promptly estimate the PAIN rating following the rule in IEC-CSO-EFI (Estimate Federal Impact).", "status": "fail" }, { "family": "IEC", "family_name": "Incident Evaluation and Communication", "force": "MUST", "frrID": "IEC-CSO-IIR", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "Initial Incident Report", "statement": "Providers with Class C Certifications MUST responsibly notify all affected parties after identifying FedRAMP Reportable Incidents by providing an Initial Incident Report with as much of the following information that is available at the time of reporting and/or the current relevant status for each item:", "status": "fail" }, { "family": "IEC", "family_name": "Incident Evaluation and Communication", "force": "MUST", "frrID": "IEC-CSO-OIR", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "Ongoing Incident Reports", "statement": "Providers with Class C Certifications MUST responsibly notify all affected parties of ongoing activity as new information becomes available during incident response for FedRAMP Reportable Incidents, including updates (or lack of updates) to all previously reported information and as much of the following additional information that is available and/or the current relevant status for each item:", "status": "fail" }, { "family": "IEC", "family_name": "Incident Evaluation and Communication", "force": "MUST", "frrID": "IEC-CSO-FIR", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "Final Incident Report", "statement": "Providers with Class C Certifications MUST responsibly notify all affected parties by providing a Final Incident Report once the incident has been resolved and recovery is complete, including final updates to all previously reported information.", "status": "fail" }, { "family": "IEC", "family_name": "Incident Evaluation and Communication", "force": "SHOULD", "frrID": "IEC-CSO-EFI", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "Estimate Federal Impact", "statement": "Providers SHOULD promptly estimate the likely adverse impact of an incident on agency customers to assign a Potential Agency Impact N-rating; this step is called Incident Rating.", "status": "fail" }, { "family": "IEC", "family_name": "Incident Evaluation and Communication", "force": "SHOULD", "frrID": "IEC-CSO-AIR", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "Automated Incident Reporting", "statement": "Providers SHOULD use automation to minimize human intervention in the process of reporting FedRAMP Reportable Incidents to all affected parties.", "status": "fail" }, { "family": "IVV", "family_name": "Independent Verification and Validation", "force": "MUST", "frrID": "IVV-CSO-FIA", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "FedRAMP Independent Assessments", "statement": "Providers with Class C Certifications MUST persistently complete an independent verification and validation assessment of all applicable FedRAMP rules with a FedRAMP Recognized independent assessment service OR FedRAMP at least once per year; this is a FedRAMP independent assessment.", "status": "fail" }, { "family": "IVV", "family_name": "Independent Verification and Validation", "force": "MUST", "frrID": "IVV-CSO-SEI", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "Supply Evidence of Implementation", "statement": "Providers MUST supply evidence to all necessary assessors of the implementation of the measures that have been documented to meet FedRAMP Practices; this evidence is the result of verification.", "status": "fail" }, { "family": "IVV", "family_name": "Independent Verification and Validation", "force": "MUST", "frrID": "IVV-CSO-SEE", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "Supply Evidence of Effectiveness", "statement": "Providers MUST supply evidence to all necessary assessors of the effectiveness of the measures that have been implemented to meet FedRAMP Practices; this evidence is the result of validation.", "status": "fail" }, { "family": "IVV", "family_name": "Independent Verification and Validation", "force": "MUST", "frrID": "IVV-CSO-ICP", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "Inclusion in Certification Package", "statement": "Providers MUST supply the results of FedRAMP independent assessments in their FedRAMP Certification Package without inappropriate modification.", "status": "fail" }, { "family": "IVV", "family_name": "Independent Verification and Validation", "force": "MUST", "frrID": "IVV-CSO-DUS", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "Document Use of Representative Samples", "statement": "Providers MUST document and explain the use of representative samples during verification and validation when using representative samples as allowed by IVV-CSO-USR (Use Representative Samples).", "status": "fail" }, { "family": "IVV", "family_name": "Independent Verification and Validation", "force": "SHOULD", "frrID": "IVV-CSO-STE", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "Supply Technical Explanations", "statement": "Providers SHOULD supply all necessary assessors with technical explanations, demonstrations, and other relevant supporting information about the technical capabilities they employ to address FedRAMP rules; this SHOULD be supplied as necessary to ensure the assessor can effectively complete verification and validation.", "status": "fail" }, { "family": "IVV", "family_name": "Independent Verification and Validation", "force": "MAY", "frrID": "IVV-CSO-USR", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "Use Representative Samples", "statement": "Providers MAY use representative samples as appropriate during verification and validation.", "status": "fail" }, { "family": "IVV", "family_name": "Independent Verification and Validation", "force": "MAY", "frrID": "IVV-CSO-RAA", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "Receiving Assessor Advice", "statement": "Providers MAY ask for and accept advice from their assessor during assessment regarding techniques and procedures that will improve their security posture or the effectiveness, clarity, and accuracy of their verification, validation and reporting procedures, UNLESS doing so is likely to compromise the objectivity and integrity of the assessment.", "status": "fail" }, { "family": "IVV", "family_name": "Independent Verification and Validation", "force": "MUST", "frrID": "IVV-CSX-AIA", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "Annual Independent Assessments for 20x", "statement": "Providers with 20x Class C Certifications MUST include all Key Security Indicators in a FedRAMP independent assessment at least once per year.", "status": "fail" }, { "family": "MAS", "family_name": "Minimum Assessment Scope", "force": "MUST", "frrID": "MAS-CSO-IIR", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "Identify Information Resources", "statement": "Providers MUST identify a set of information resources to assess for FedRAMP Certification that includes all information resources that are likely to handle federal customer data or likely to impact the confidentiality, integrity, or availability of federal customer data handled by the cloud service offering; this set of information resources is the cloud service offering.", "status": "fail" }, { "family": "MAS", "family_name": "Minimum Assessment Scope", "force": "MUST", "frrID": "MAS-CSO-FLO", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "Information Flows and Security Categories", "statement": "Providers MUST clearly identify, document, and explain information flows and security categories for ALL information resources or sets of information resources in the cloud service offering.", "status": "fail" }, { "family": "MAS", "family_name": "Minimum Assessment Scope", "force": "MUST", "frrID": "MAS-CSO-TPR", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "Third-Party Information Resources", "statement": "Providers MUST address the potential impact to federal customer data from third-party information resources used by the cloud service offering, ONLY IF MAS-CSO-IIR (Identify Information Resources) APPLIES, by documenting the following information about each applicable third-party information resource:", "status": "fail" }, { "family": "MAS", "family_name": "Minimum Assessment Scope", "force": "MUST", "frrID": "MAS-CSO-MDI", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "Metadata Inclusion", "statement": "Providers MUST include metadata (including metadata about federal customer data) in the Minimum Assessment Scope ONLY IF MAS-CSO-IIR (Identify Information Resources) APPLIES.", "status": "fail" }, { "family": "MAS", "family_name": "Minimum Assessment Scope", "force": "MAY", "frrID": "MAS-CSO-SUP", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "Supplemental Information", "statement": "Providers MAY include additional materials about other information resources that are not part of the cloud service offering in a FedRAMP Certification Package supplement; these resources will not be FedRAMP Certified and MUST be clearly marked and separated from the cloud service offering.", "status": "fail" }, { "family": "MKT", "family_name": "Marketplace Listing", "force": "MUST", "frrID": "MKT-CSO-MLR", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "Marketplace Listing Requirements", "statement": "Providers MUST address at least these FedRAMP rules to apply for a new FedRAMP Marketplace listing OR to request updates to an existing listing:", "status": "fail" }, { "family": "MKT", "family_name": "Marketplace Listing", "force": "MUST", "frrID": "MKT-CSO-PML", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "Provider Marketplace Listing Requests", "statement": "Providers MUST notify FedRAMP using the FedRAMP Marketplace Providing Listing Request Form to request a listing in the FedRAMP Marketplace.", "status": "fail" }, { "family": "MKT", "family_name": "Marketplace Listing", "force": "MUST", "frrID": "MKT-IIP-AGU", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "Agency Use Cases", "statement": "Providers MUST demonstrate that a cloud service offering is intended for one of the following use cases:", "status": "fail" }, { "family": "MKT", "family_name": "Marketplace Listing", "force": "MUST", "frrID": "MKT-IIP-DCP", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "Demonstrating Continuous Progress", "statement": "Providers MUST demonstrate continuous progress towards a FedRAMP Certification, documented in their Trust Center or website and updated at least quarterly; progress is measured by the provider against documented goals and milestones.", "status": "fail" }, { "family": "MKT", "family_name": "Marketplace Listing", "force": "MUST", "frrID": "MKT-IIP-DLA", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "Deadline for Assessment", "statement": "Providers MUST demonstrate that an assessment for a FedRAMP Certification Class B, C, or D has been scheduled within 2 years of initial listing in the Initial Implementation Phase.", "status": "fail" }, { "family": "SCG", "family_name": "Secure Configuration Guide", "force": "MUST", "frrID": "SCG-CSO-RSC", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "Recommended Secure Configuration", "statement": "Providers MUST create, maintain, and make available recommendations for securely configuring their cloud services (the Secure Configuration Guide) that includes at least the following information:", "status": "fail" }, { "family": "SCG", "family_name": "Secure Configuration Guide", "force": "MUST", "frrID": "SCG-CSO-AUP", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "Use Instructions", "statement": "Providers MUST include instructions in the FedRAMP Certification Package that explain how to obtain and use the Secure Configuration Guide.", "status": "fail" }, { "family": "SCG", "family_name": "Secure Configuration Guide", "force": "SHOULD", "frrID": "SCG-CSO-PUB", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "Public Secure Configuration Guidance", "statement": "Providers SHOULD make the Secure Configuration Guide available publicly.", "status": "fail" }, { "family": "SCG", "family_name": "Secure Configuration Guide", "force": "SHOULD", "frrID": "SCG-CSO-SDF", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "Secure Defaults", "statement": "Providers SHOULD set all settings to their recommended secure defaults for top-level administrative accounts and privileged accounts when initially provisioned.", "status": "fail" }, { "family": "SCG", "family_name": "Secure Configuration Guide", "force": "SHOULD", "frrID": "SCG-ENH-CMP", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "Comparison Capability", "statement": "Providers SHOULD offer the capability to compare all current settings for top-level administrative accounts and privileged accounts to the recommended secure defaults.", "status": "fail" }, { "family": "SCG", "family_name": "Secure Configuration Guide", "force": "SHOULD", "frrID": "SCG-ENH-EXP", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "Export Capability", "statement": "Providers SHOULD offer the capability to export all security settings in a machine-readable format.", "status": "fail" }, { "family": "SCG", "family_name": "Secure Configuration Guide", "force": "SHOULD", "frrID": "SCG-ENH-API", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "API Capability", "statement": "Providers SHOULD offer the capability to view and adjust security settings via an API or similar capability.", "status": "fail" }, { "family": "SCG", "family_name": "Secure Configuration Guide", "force": "SHOULD", "frrID": "SCG-ENH-MRG", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "Machine-Readable Guidance", "statement": "Providers SHOULD also provide the Secure Configuration Guide in a machine-readable format that can be used by customers or third-party tools to compare against current settings.", "status": "fail" }, { "family": "SCG", "family_name": "Secure Configuration Guide", "force": "SHOULD", "frrID": "SCG-ENH-VRH", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "Versioning and Release History", "statement": "Providers SHOULD provide versioning and a release history for recommended secure default settings for top-level administrative accounts and privileged accounts as they are adjusted over time.", "status": "fail" }, { "family": "SCN", "family_name": "Significant Change Notification", "force": "MUST", "frrID": "SCN-CSO-EVA", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "Evaluate Changes", "statement": "Providers MUST evaluate all potential significant changes to determine the type of significant change and follow the appropriate Significant Change Notification rules.", "status": "fail" }, { "family": "SCN", "family_name": "Significant Change Notification", "force": "MUST", "frrID": "SCN-CSO-MAR", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "Maintain Audit Records", "statement": "Providers MUST maintain auditable records of the significant change evaluation activities required by SCN-CSO-EVA (Evaluate Changes) and make them available to FedRAMP as requested.", "status": "fail" }, { "family": "SCN", "family_name": "Significant Change Notification", "force": "MUST", "frrID": "SCN-CSO-INF", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "Required Information", "statement": "Providers MUST include at least the following information in Significant Change Notifications:", "status": "fail" }, { "family": "SCN", "family_name": "Significant Change Notification", "force": "MUST", "frrID": "SCN-CSO-HIS", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "Historical Notifications", "statement": "Providers MUST keep 12 months of historical Significant Change Notifications available with their FedRAMP Certification Data.", "status": "fail" }, { "family": "SCN", "family_name": "Significant Change Notification", "force": "MUST", "frrID": "SCN-CSO-HRM", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "Human and Machine-Readable Notifications", "statement": "Providers MUST make ALL Significant Change Notifications and related audit records available in human-readable and JSON formats.", "status": "fail" }, { "family": "SCN", "family_name": "Significant Change Notification", "force": "MAY", "frrID": "SCN-CSO-ARI", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "Additional Relevant Information", "statement": "Providers MAY include additional relevant information in Significant Change Notifications.", "status": "fail" }, { "family": "SCN", "family_name": "Significant Change Notification", "force": "MAY", "frrID": "SCN-CSO-NOM", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "Notification Mechanisms", "statement": "Providers MAY notify necessary parties in a variety of ways as long as the mechanism for notification is clearly documented in the FedRAMP Certification Package and easily accessible.", "status": "fail" }, { "family": "SCN", "family_name": "Significant Change Notification", "force": "MAY", "frrID": "SCN-CSO-EMG", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "Emergency Changes", "statement": "Providers MAY execute significant changes (including transformative changes) during an emergency or incident without following the Significant Change Notification rules in advance. In such emergencies, providers MUST follow all relevant procedures, notify all necessary parties, retroactively provide all Significant Change Notification materials, and complete appropriate assessment after the incident.", "status": "fail" }, { "family": "SCN", "family_name": "Significant Change Notification", "force": "MUST", "frrID": "SCN-ADP-NTF", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "Notification Requirements", "statement": "Providers MUST notify all necessary parties within 10 business days after finishing adaptive changes, also including the following information:", "status": "fail" }, { "family": "SCN", "family_name": "Significant Change Notification", "force": "SHOULD NOT", "frrID": "SCN-RTR-NNR", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "No Notification Requirements", "statement": "Providers SHOULD NOT make formal Significant Change Notifications for routine recurring changes; this type of change is exempted from notification requirements.", "status": "fail" }, { "family": "SCN", "family_name": "Significant Change Notification", "force": "MUST", "frrID": "SCN-TRF-NIP", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "Notification of Initial Plans", "statement": "Providers MUST notify all necessary parties of initial plans for transformative changes at least 30 business days before starting transformative changes, including a summary of any likely security impacts or changes in risk.", "status": "fail" }, { "family": "SCN", "family_name": "Significant Change Notification", "force": "MUST", "frrID": "SCN-TRF-NFP", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "Notification of Final Plans", "statement": "Providers MUST notify all necessary parties of final plans for transformative changes at least 10 business days before starting transformative changes, including updates to all previously sent information.", "status": "fail" }, { "family": "SCN", "family_name": "Significant Change Notification", "force": "MUST", "frrID": "SCN-TRF-NAF", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "Notification After Finishing", "statement": "Providers MUST notify all necessary parties within 5 business days after finishing transformative changes, including updates to all previously sent information.", "status": "fail" }, { "family": "SCN", "family_name": "Significant Change Notification", "force": "MUST", "frrID": "SCN-TRF-NAV", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "Notification After Verification", "statement": "Providers MUST notify all necessary parties within 5 business days after completing the verification, assessment, and/or validation of transformative changes, also including the following information:", "status": "fail" }, { "family": "SCN", "family_name": "Significant Change Notification", "force": "MUST", "frrID": "SCN-TRF-UPD", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "Update Documentation", "statement": "Providers MUST publish updated service documentation and other materials to reflect transformative changes within 30 business days after finishing transformative changes.", "status": "fail" }, { "family": "SCN", "family_name": "Significant Change Notification", "force": "SHOULD", "frrID": "SCN-TRF-TPR", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "Third-Party Review", "statement": "Providers SHOULD engage a third-party assessor to review the scope and impact of the planned change before starting transformative changes if human validation is necessary; such reviews SHOULD be limited to security decisions that require human validation.", "status": "fail" }, { "family": "SDR", "family_name": "Security Decision Record", "force": "MUST", "frrID": "SDR-CSO-FRR", "frrImplementation": [ "1. For each rule, this record says how we follow it or why we do not, and how we check our own work. Nobody outside Mog Network has verified this record. No assessor has sent comments.\n2. We compared this explanation with the rule. It matches what this tenant does.\n3. Opening the record rebuilds this text from the stored evidence, which is how we check that it still matches the result.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Partially Implemented", "name": "FedRAMP Rules", "statement": "Providers MUST supply a Security Decision Record, in both human-readable and JSON formats, that includes at least all of the following information for each applicable FedRAMP rule:", "status": "partial" }, { "family": "SDR", "family_name": "Security Decision Record", "force": "MUST", "frrID": "SDR-CSO-MTD", "frrImplementation": [ "1. This record has a version, the time it was built, and the source of that update. The source is the scheduled AWS Lambda function.\n2. We compared this explanation with the rule. It matches what this tenant does.\n3. Opening the record rebuilds this text from the stored evidence, which is how we check that it still matches the result.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Implemented", "name": "Security Decision Record Metadata", "statement": "Providers MUST also include the following basic metadata in their Security Decision Record:", "status": "pass" }, { "family": "SDR", "family_name": "Security Decision Record", "force": "MUST", "frrID": "SDR-CSX-KSI", "frrImplementation": [ "1. Each indicator names its checks, how often they run, whether the automation is enough, and how we confirm the result is the one the job produced. A present explanation is not a claim that the indicator itself passed.\n2. We compared this explanation with the rule. It matches what this tenant does.\n3. Opening the record rebuilds this text from the stored evidence, which is how we check that it still matches the result.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Implemented", "name": "Key Security Indicators", "statement": "Providers MUST also include short and simple high-level summaries of at least the following for each applicable Key Security Indicator:", "status": "pass" }, { "family": "SDR", "family_name": "Security Decision Record", "force": "MUST", "frrID": "SDR-CSX-KMT", "frrImplementation": [ "1. Each indicator summarizes the past 30 days, summarizes the stored year, and lists every stored day with its result and whether validation finished. A full year is not available. No agreement to supply the missing history is invented.\n2. We compared this explanation with the rule. It matches what this tenant does.\n3. Opening the record rebuilds this text from the stored evidence, which is how we check that it still matches the result.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Partially Implemented", "name": "Key Security Indicator Metrics", "statement": "Providers with 20x Class C Certifications MUST also include historical metrics in their Security Decision Record, supplying at least the following information for each applicable Key Security Indicator:", "status": "partial" }, { "family": "VDR", "family_name": "Vulnerability Detection and Response", "force": "MUST", "frrID": "VDR-CSO-DET", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "Vulnerability Detection", "statement": "Providers MUST systematically, persistently, and promptly discover and identify vulnerabilities within their cloud service offering using appropriate techniques such as assessment, scanning, threat intelligence, vulnerability disclosure mechanisms, bug bounties, penetration testing, incident response, automated control testing, supply chain monitoring, and other relevant capabilities; this process is called vulnerability detection. Vulnerability detection includes persistently verifying and validating that information resources and processes are operating as intended and documented for FedRAMP Practices.", "status": "fail" }, { "family": "VDR", "family_name": "Vulnerability Detection and Response", "force": "MUST", "frrID": "VDR-CSO-RES", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "Vulnerability Response", "statement": "Providers MUST systematically, persistently, and promptly track, evaluate, monitor, mitigate, remediate, assess exploitation of, report, and otherwise manage all detected vulnerabilities within their cloud service offering; this process is called vulnerability response.", "status": "fail" }, { "family": "VDR", "family_name": "Vulnerability Detection and Response", "force": "MUST", "frrID": "VDR-CSO-FAV", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "Failures Are Vulnerabilities", "statement": "Providers MUST treat problems or failures with their vulnerability detection and response processes as vulnerabilities.", "status": "fail" }, { "family": "VDR", "family_name": "Vulnerability Detection and Response", "force": "SHOULD", "frrID": "VDR-CSO-DFR", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "Design For Resilience", "statement": "Providers SHOULD make design and architecture decisions for their cloud service offering that mitigate the risk of vulnerabilities by default AND decrease the risk and complexity of vulnerability detection and response.", "status": "fail" }, { "family": "VDR", "family_name": "Vulnerability Detection and Response", "force": "SHOULD", "frrID": "VDR-CSO-ADT", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "Automate Detection", "statement": "Providers SHOULD use automated services to improve and streamline vulnerability detection and response.", "status": "fail" }, { "family": "VDR", "family_name": "Vulnerability Detection and Response", "force": "SHOULD", "frrID": "VDR-CSO-DAC", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "Detect After Changes", "statement": "Providers SHOULD automatically perform vulnerability detection on representative samples of new or significantly changed information resources.", "status": "fail" }, { "family": "VDR", "family_name": "Vulnerability Detection and Response", "force": "SHOULD NOT", "frrID": "VDR-CSO-MSP", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "Maintain Security", "statement": "Providers SHOULD NOT weaken the security of information resources to facilitate vulnerability scanning, detection, or assessment activities.", "status": "fail" }, { "family": "VDR", "family_name": "Vulnerability Detection and Response", "force": "SHOULD NOT", "frrID": "VDR-CSO-AKE", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "Avoid KEVs", "statement": "Providers SHOULD NOT deploy or otherwise activate new machine-based information resources with Known Exploited Vulnerabilities.", "status": "fail" }, { "family": "VDR", "family_name": "Vulnerability Detection and Response", "force": "MAY", "frrID": "VDR-CSO-SIR", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "Sampling", "statement": "Providers MAY sample effectively identical information resources, especially machine-based information resources, when performing vulnerability detection UNLESS doing so would decrease the efficiency or effectiveness of vulnerability detection.", "status": "fail" }, { "family": "VDR", "family_name": "Vulnerability Detection and Response", "force": "MUST", "frrID": "VDR-TFR-NMV", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "Non-Machine Verification and Validation", "statement": "Providers MUST verify and validate the status of non-machine-based information resources at least once every 3 months.", "status": "fail" }, { "family": "VDR", "family_name": "Vulnerability Detection and Response", "force": "SHOULD", "frrID": "VDR-TFR-PDD", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "Persistent Drift Detection", "statement": "Providers with Class C Certifications SHOULD persistently perform vulnerability detection on all information resources that are likely to drift, at least once every 14 days.", "status": "fail" }, { "family": "VDR", "family_name": "Vulnerability Detection and Response", "force": "SHOULD", "frrID": "VDR-TFR-PCD", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "Persistently Complete Detection", "statement": "Providers with Class C Certifications SHOULD persistently perform vulnerability detection on all information resources that are NOT likely to drift, at least once every month.", "status": "fail" }, { "family": "VDR", "family_name": "Vulnerability Detection and Response", "force": "SHOULD", "frrID": "VDR-TFR-PVR", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "Mitigation and Remediation Expectations", "statement": "Providers with Class C Certifications SHOULD partially mitigate vulnerabilities, fully mitigate vulnerabilities, or remediate vulnerabilities to a lower Potential Agency Impact N-rating within the timeframes from evaluation shown below, factoring for the current Potential Agency Impact N-rating as defined in VER-EVA-EPA (Estimate Potential Agency Impact), internet reachability, and likely exploitability:", "status": "fail" }, { "family": "VDR", "family_name": "Vulnerability Detection and Response", "force": "SHOULD", "frrID": "VDR-TFR-RMN", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "Remaining Vulnerabilities", "statement": "Providers SHOULD mitigate or remediate remaining vulnerabilities during routine operations as determined necessary by the provider.", "status": "fail" }, { "family": "VDR", "family_name": "Vulnerability Detection and Response", "force": "SHOULD", "frrID": "VDR-TFR-KEV", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "Remediate KEVs", "statement": "Providers SHOULD remediate Known Exploited Vulnerabilities according to the due dates in the CISA Known Exploited Vulnerabilities Catalog (even if the vulnerability has been fully mitigated) as required by CISA Binding Operational Directive (BOD) 26-04 or any successor guidance from CISA.", "status": "fail" }, { "family": "VDR", "family_name": "Vulnerability Detection and Response", "force": "SHOULD", "frrID": "VDR-TFR-PSD", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "Persistent Sample Detection", "statement": "Providers with Class C Certifications SHOULD persistently perform vulnerability detection on representative samples of similar machine-based information resources, at least once every 3 days.", "status": "fail" }, { "family": "VDR", "family_name": "Vulnerability Detection and Response", "force": "MUST", "frrID": "VDR-TFR-MVX", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "Persistent Machine Verification and Validation for 20x", "statement": "Providers of FedRAMP 20x Class C offerings MUST verify and validate the status of machine-based information resources at least once every 3 days.", "status": "fail" }, { "family": "VER", "family_name": "Vulnerability Evaluation and Reporting", "force": "MUST", "frrID": "VER-EVA-ELX", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "Evaluate Exploitability", "statement": "Providers MUST evaluate detected vulnerabilities, considering the context of the cloud service offering, to determine if they are likely exploitable vulnerabilities.", "status": "fail" }, { "family": "VER", "family_name": "Vulnerability Evaluation and Reporting", "force": "MUST", "frrID": "VER-EVA-EIR", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "Evaluate Internet-Reachability", "statement": "Providers MUST evaluate detected vulnerabilities, considering the context of the cloud service offering, to determine if they are internet-reachable vulnerabilities.", "status": "fail" }, { "family": "VER", "family_name": "Vulnerability Evaluation and Reporting", "force": "MUST", "frrID": "VER-EVA-EPA", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "Estimate Potential Agency Impact", "statement": "Providers MUST evaluate detected vulnerabilities, considering the context of the cloud service offering, to estimate the likely potential agency impact of exploitation on government customers AND assign one of the following Potential Agency Impact N-ratings (PAIN):", "status": "fail" }, { "family": "VER", "family_name": "Vulnerability Evaluation and Reporting", "force": "MUST", "frrID": "VER-EVA-AIA", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "Assume It's Automatable", "statement": "Providers MUST assume the exploitation of vulnerabilities can be automated UNLESS they have evidence proving otherwise.", "status": "fail" }, { "family": "VER", "family_name": "Vulnerability Evaluation and Reporting", "force": "SHOULD", "frrID": "VER-EVA-GRV", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "Group Vulnerabilities", "statement": "Providers SHOULD evaluate detected vulnerabilities, considering the context of the cloud service offering, to identify logical groupings of affected information resources that may improve the efficiency and effectiveness of vulnerability response by consolidating further activity; FedRAMP Vulnerability Detection and Response rules are then applied to these consolidated groupings of vulnerabilities instead of each individual detected instance.", "status": "fail" }, { "family": "VER", "family_name": "Vulnerability Evaluation and Reporting", "force": "SHOULD", "frrID": "VER-EVA-EFP", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "Evaluate False Positives", "statement": "Providers SHOULD evaluate detected vulnerabilities, considering the context of the cloud service offering, to determine if they are false positive vulnerabilities.", "status": "fail" }, { "family": "VER", "family_name": "Vulnerability Evaluation and Reporting", "force": "SHOULD", "frrID": "VER-EVA-EFA", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "Evaluation Factors", "statement": "Providers SHOULD consider at least the following factors when considering the context of the cloud service offering to evaluate detected vulnerabilities:", "status": "fail" }, { "family": "VER", "family_name": "Vulnerability Evaluation and Reporting", "force": "MUST", "frrID": "VER-RPT-PER", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "Persistent Reporting", "statement": "Providers MUST report vulnerability detection and response activity (including persistent verification and validation) to all necessary parties persistently, summarizing ALL activity since the previous report; these reports are FedRAMP Certification Data and are subject to FedRAMP Certification Data Sharing rules.", "status": "fail" }, { "family": "VER", "family_name": "Vulnerability Evaluation and Reporting", "force": "MUST", "frrID": "VER-RPT-VDT", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "Vulnerability Details", "statement": "Providers MUST include the following information (if applicable) on detected vulnerabilities when reporting on vulnerability detection and response activity, UNLESS it is an accepted vulnerability:", "status": "fail" }, { "family": "VER", "family_name": "Vulnerability Evaluation and Reporting", "force": "MUST", "frrID": "VER-RPT-AVI", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "Accepted Vulnerability Info", "statement": "Providers MUST include the following information on accepted vulnerabilities when reporting on vulnerability detection and response activity:", "status": "fail" }, { "family": "VER", "family_name": "Vulnerability Evaluation and Reporting", "force": "MUST NOT", "frrID": "VER-RPT-NID", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "Responsible Disclosure", "statement": "Providers MUST NOT irresponsibly disclose specific sensitive information about vulnerabilities that would likely lead to exploitation, but MUST disclose sufficient information for informed risk-based decision-making to all necessary parties.", "status": "fail" }, { "family": "VER", "family_name": "Vulnerability Evaluation and Reporting", "force": "SHOULD", "frrID": "VER-RPT-HLO", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "High-Level Overviews", "statement": "Providers SHOULD include high-level overviews of ALL vulnerability detection and response activities conducted during this period for the cloud service offering; this includes vulnerability disclosure programs, bug bounty programs, penetration testing, assessments, etc.", "status": "fail" }, { "family": "VER", "family_name": "Vulnerability Evaluation and Reporting", "force": "MAY", "frrID": "VER-RPT-RPD", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "Responsible Public Disclosure", "statement": "Providers MAY responsibly disclose vulnerabilities publicly or with other parties if the provider determines doing so will NOT likely lead to exploitation.", "status": "fail" }, { "family": "VER", "family_name": "Vulnerability Evaluation and Reporting", "force": "MUST", "frrID": "VER-TFR-MHR", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "Monthly Activity Report", "statement": "Providers MUST report vulnerability detection and response activity to all necessary parties in a consistent format that is human readable at least monthly.", "status": "fail" }, { "family": "VER", "family_name": "Vulnerability Evaluation and Reporting", "force": "MUST", "frrID": "VER-TFR-MAV", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "Mark Accepted Vulnerabilities", "statement": "Providers MUST categorize any vulnerability that is not or will not be fully mitigated or remediated within 192 days of evaluation as an accepted vulnerability.", "status": "fail" }, { "family": "VER", "family_name": "Vulnerability Evaluation and Reporting", "force": "SHOULD", "frrID": "VER-TFR-MRH", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "Historical Activity", "statement": "Providers with Class C Certifications SHOULD make all recent historical vulnerability detection and response activity available in JSON format for automated retrieval by all necessary parties (e.g. using an API service or similar); this information SHOULD be updated persistently, at least once every 14 days.", "status": "fail" }, { "family": "VER", "family_name": "Vulnerability Evaluation and Reporting", "force": "SHOULD", "frrID": "VER-TFR-EVU", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "Evaluate Vulnerabilities Quickly", "statement": "Providers with Class C Certifications SHOULD evaluate ALL vulnerabilities as required by VER-EVA (Evaluation) within 5 days of detection.", "status": "fail" }, { "family": "VER", "family_name": "Vulnerability Evaluation and Reporting", "force": "SHOULD", "frrID": "VER-TFR-IRI", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "Internet-Reachable Incidents", "statement": "Providers with Class C Certifications SHOULD treat internet-reachable likely exploitable vulnerabilities where Potential Agency Impact N-rating > 3 as a FedRAMP Reportable Incident until they are partially mitigated vulnerabilities at N3 or below.", "status": "fail" }, { "family": "VER", "family_name": "Vulnerability Evaluation and Reporting", "force": "MAY", "frrID": "VER-TFR-NRI", "frrImplementation": [ "1. We do not follow this rule. A customer cannot rely on it. No senior official has accepted this gap.\n2. We looked through the checks. None of them covers this rule, so this is not a finished control.\n3. Nothing is running for this rule, so there is no result to confirm.\n4. Independent verification: none.\n5. Independent validation: none.\n6. Assessor comments: none.\n7. Rule-specific file: none." ], "frrImplementationStatus": "Not Implemented", "name": "Non-Internet-Reachable Incidents", "statement": "Providers with Class C Certifications MAY treat likely exploitable vulnerabilities that are NOT internet-reachable where Potential Agency Impact N-rating = 5 as a FedRAMP Reportable Incident until they are partially mitigated vulnerabilities at N4 or below.", "status": "fail" } ] }