FedRAMP Certification¶

Providers MUST identify a target FedRAMP Certification Profile and apply all relevant FedRAMP Practices to the cloud service offering.

Note: Information resources (including third-party information resources) MAY vary by security category as appropriate to the type of information handled by or impacted by the information resource.

Terms: Certification Profile, Cloud Service Offering, FedRAMP Practices, Handle, Information Resource, Security Category, Third-Party Information Resource

Providers seeking a Class B Certification MUST supply a complete FedRAMP Certification Package to FedRAMP for initial certification; the FedRAMP Certification Package MUST include at least the following information:

1. A Certification Package Overview
2. A Security Decision Record
3. A real or example Ongoing Certification Report following CCM-OCR-AVL (Report Availability)

Terms: Certification Package, FedRAMP Certification Report, Initial Certification, Ongoing Certification, Ongoing Certification Report (OCR), Security Decision Record (SDR)

Providers MUST supply machine-readable information in JSON documents that are valid against the corresponding JSON schema when a rule contains a FedRAMP JSON schema, UNLESS otherwise specified in the rule.

Note: FedRAMP JSON schemas are designed to be lightweight and flexible to establish a minimum set of structured information while allowing providers to improve on the format and structure of the information as needed to meet their needs and the needs of their customers.

Terms: Machine-Readable

Providers MUST maintain responsibility and accountability for the accuracy and completeness of all information in the FedRAMP Certification Package, especially when they engage a third party (such as an independent assessor, advisory service, or external tools) to supply information on their behalf.

Terms: Certification Package

Providers MUST NOT seek both FedRAMP Rev5 Program Certification and FedRAMP 20x Program Certification for the same cloud service offering; pick one type.

Note: This rule does not prevent a provider from seeking and maintaining a FedRAMP Rev5 Agency Certification and a FedRAMP 20x Program Certification for the same cloud service offering, however, doing so is strongly discouraged due to the increased complexity and risk of confusion for all parties.

Terms: Cloud Service Offering

Providers MUST be listed in the FedRAMP Marketplace before applying for FedRAMP Certification, including:

1. FedRAMP Marketplace: MKT-CSO-MLR (Marketplace Listing Requirements),
2. FedRAMP Marketplace: MKT-CSO-PML (Provider Marketplace Listing Requests)
3. FedRAMP Marketplace: MKT-IIP-AGU (Agency Use Cases)
4. FedRAMP Marketplace: MKT-IIP-DCP (Demonstrating Continuous Progress)

Providers MUST complete the FedRAMP Certification Application Form in full to request an initial assessment by FedRAMP.

Providers MUST supply a fresh initial FedRAMP Certification Package that shows the current status of the cloud service offering as verified and validated by the provider within the previous 7 days.

Terms: Certification Package, Cloud Service Offering, Validation, Verification

Terms: FedRAMP Independent Assessment, FedRAMP Recognized

Providers MUST NOT use a third party to apply for a FedRAMP Certification on their behalf; this includes independent assessment services.

Notes:

• FedRAMP previously allowed independent assessment services to submit applications on behalf of providers, but this caused confusion about who was responsible for the application and the information in it. Providers should apply directly to ensure clear accountability.
• Providers may use third parties to help them prepare their application and assessment materials for submission.

Providers MAY freshen a stale initial independent verification and validation assessment by having a FedRAMP Recognized independent assessment service review any changes between the original assessment and the current status of the cloud service offering in place of a full re-assessment, UNLESS the stale assessment is more than 9 months old.

Terms: Cloud Service Offering, FedRAMP Recognized, Validation, Verification

Providers seeking a FedRAMP Rev5 Agency Certification MUST have completed the Authorization to Operate (ATO) process with their agency sponsor for the cloud service offering, concluding with a formal signed ATO letter that the agency has sent over official government channels to FedRAMP.

Terms: Cloud Service Offering

Providers MUST apply for a new FedRAMP Certification to upgrade their Certification Class; all applicable requirements MUST be met in advance.

Notes:

• Upgrade paths include moving from A to B, C, or D; B to C or D; and C to D.
• The preferred path is to incrementally update the implementation and assurance commitments within the current Certification Class until the provider has met all requirements for the target Certification Class, then apply for the new Certification Class.

Terms: Certification Class

Providers MUST apply for a new FedRAMP Certification to downgrade their Certification Class.

Notes:

• Downgrade paths include moving from D to C, B, or A; C to B or A; or B to A.
• FRC-CCL-DNP (Downgrade Notification Period) applies - please DO NOT downgrade Certification Class with providing advance notification to all necessary parties!

Terms: All Necessary Parties, Certification Class

Providers SHOULD notify all necessary parties at least 120 days in advance of an intended downgrade or cancellation of FedRAMP Certification.

Note: Downgrading or canceling FedRAMP Certification will have severe negative consequences for the provider and their agency customers and should only be done after careful consideration and planning... but if it must be done, notify all necessary parties as soon as possible.

Terms: All Necessary Parties

Reference: NIST SP 800-53 Rev. 5, Security and Privacy Controls for Information Systems and Organizations

Terms: Security Decision Record (SDR)

Providers MUST assign all organization-defined control parameters, following FedRAMP Rev5 Controls Guidance, and ensure that all control parameter assignments are documented in the Security Decision Record (SDR).

Terms: Security Decision Record (SDR)

Providers MUST follow FedRAMP Rev5 Controls Guidance for the implementation and documentation of all applicable controls.

Providers with FedRAMP Rev5 Ready status MUST convert to a FedRAMP Certification by whichever of the follow dates is later: the expiration of their annual assessment or November 17, 2026 (the legacy FedRAMP Ready status will be entirely removed on December 31, 2027).

Notes:

• The simplest conversion in most cases would be to a FedRAMP 20x Class A Certification.
• Cloud services that do not wish to convert or do not meet conversion criteria will be renamed Legacy FedRAMP Ready and otherwise retired from FedRAMP Ready.