Authorization Data Sharing¶

Providers MUST use a FedRAMP-compatible trust center to store and share authorization data with all necessary parties.

---

Notes:

• Requirements and recommendations for FedRAMP-compatible trust centers are explained in ADS-TRC.
• This requirement only applies to FedRAMP 20x.

---

Terms: All Necessary Parties, Authorization data, Trust Center

Providers MUST publicly share up-to-date information about the cloud service offering in both human-readable and machine-readable formats, including at least:

1. Direct link to the FedRAMP Marketplace for the offering

2. Service Model

3. Deployment Model

4. Business Category

5. UEI Number

6. Contact Information

7. Overall Service Description

8. Detailed list of specific services and their security objectives (see ADS-CSO-SVC)

9. Summary of customer responsibilities and secure configuration guidance (if applicable, see the FedRAMP Secure Configuration Guide process)

10. Process for accessing information in the trust center (if applicable)

11. Availability status and recent disruptions for the trust center (if applicable)

12. Customer support information for the trust center (if applicable)

13. Next Ongoing Authorization Report date (see CCM-OAR-NRD)

---

Note: Generally, this information should be available on a public webpage.

---

Terms: Cloud Service Offering, Machine-Readable, Ongoing Authorization Report (OAR), Trust Center

Providers MUST publicly share a detailed list of specific services and their security objectives that are included in the cloud service offering using clear feature or service names that align with standard public marketing materials; this list MUST be complete enough for a potential customer to determine which services are and are not included in the FedRAMP Minimum Assessment Scope without requesting access to underlying authorization data.

---

Terms: Authorization data, Cloud Service Offering

Providers MUST use automation to ensure information remains consistent between human-readable and machine-readable formats when authorization data is provided in both formats.

---

Terms: Authorization data, Machine-Readable

Providers MUST provide sufficient information in authorization data to support authorization decisions but SHOULD NOT include sensitive information that would likely enable a threat actor to gain unauthorized access, cause harm, disrupt operations, or otherwise have a negative adverse impact on the cloud service offering.

---

Note: This is not a license to exclude accurate risk information, but specifics that would likely lead to compromise should be abstracted. A breach of confidentiality with authorization data should be anticipated by a secure cloud service provider.

Tips on sensitive information in authorization data

Key Tests:

• Passwords, API keys, access credentials, etc.
• Excessive detail about methodology that exposes weaknesses
• Personally identifiable information about employees

Examples:

• DON'T: "In an emergency, an administrator with physical access to a system can log in using "secretadmin" with the password "pleasewutno""
• DO: "In an emergency, administrators with physical access can log in directly."
• DON'T: "All backup MFA credentials are stored in a SuperSafe Series 9000 safe in the CEOs office."
• DO: "All backup MFA credentials are stored in a UL Class 350 safe in a secure location with limited access."
• DON'T: "During an incident, the incident response team lead by Jim Smith (555-0505) will open a channel at the conference line (555-0101 #97808 passcode 99731)..."
• DO: "During an incident, the incident response team will coordinate over secure channels."

---

Terms: Authorization data, Cloud Service Offering, Likely

Providers MUST make historical versions of authorization data available for three years to all necessary parties UNLESS otherwise specified by applicable FedRAMP requirements; deltas between versions MAY be consolidated quarterly.

---

Terms: All Necessary Parties, Authorization data

Providers MUST publicly provide plain-language policies and guidance for all necessary parties that explains how they can obtain and manage access to authorization data stored in the trust center.

---

Terms: All Necessary Parties, Authorization data, Trust Center

Providers SHOULD share the authorization package with agencies upon request.

---

Terms: Agency, Authorization Package

Providers MUST notify FedRAMP by email to info@fedramp.gov within 5 business days of denying an agency access request for authorization data.

---

Terms: Agency, Authorization data

Trust centers MUST share authorization data with all necessary parties without interruption.

---

Note: "Without interruption" means that parties should not have to request manual approval each time they need to access authorization data or go through a complicated process. The preferred way of ensuring access without interruption is to use on-demand just-in-time access provisioning.

---

Terms: All Necessary Parties, Authorization data, Trust Center

Trust centers MUST provide documented programmatic access to all authorization data, including programmatic access to human-readable materials.

---

Terms: Authorization data, Trust Center

Trust centers MUST maintain an inventory and history of federal agency users or systems with access to authorization data and MUST make this information available to FedRAMP without interruption.

---

Terms: Agency, Authorization data, Trust Center

Trust centers MUST log access to authorization data and store summaries of access for at least six months; such information, as it pertains to specific parties, SHOULD be made available upon request by those parties.

---

Terms: Authorization data, Trust Center

Trust centers SHOULD make authorization data available to view and download in both human-readable and machine-readable formats.

---

Terms: Authorization data, Machine-Readable, Trust Center

Trust centers SHOULD include features that encourage all necessary parties to provision and manage access to authorization data for their users and services directly.

---

Terms: All Necessary Parties, Authorization data, Trust Center

Trust centers SHOULD deliver responsive performance during normal operating conditions and minimize service disruptions.

---

Terms: Trust Center