Persistent Validation and Assessment¶

Providers MUST persistently perform validation of their Key Security Indicators; this process is called persistent validation and is part of vulnerability detection.

---

Terms: Persistent Validation, Persistently, Vulnerability, Vulnerability Detection

Providers MUST treat issues detected during persistent validation and failures of the persistent validation process as vulnerabilities, then follow the requirements and recommendations in the FedRAMP Vulnerability Detection and Response process for such findings.

---

Terms: Persistent Validation, Persistently, Vulnerability, Vulnerability Detection, Vulnerability Response

Providers MUST include persistent validation activity in the reports on vulnerability detection and response activity required by the FedRAMP Vulnerability Detection and Response process.

---

Terms: Persistent Validation, Persistently, Vulnerability, Vulnerability Detection, Vulnerability Response

Providers MUST have the implementation of their goals and validation processes assessed by a FedRAMP-recognized independent assessor OR by FedRAMP directly AND MUST include the results of this assessment in their authorization data without modification.

---

Notes:

• The option for assessment by FedRAMP directly is limited to cloud services that are explicitly prioritized by FedRAMP, in consultation with the FedRAMP Board and the federal Chief Information Officers Council. During 20x Phase Two this includes AI services that meet certain criteria as shown at https://fedramp.gov/ai.
• FedRAMP recognized assessors are listed on the FedRAMP Marketplace.

---

Terms: Authorization data, Persistent Validation

Providers MUST complete the validation processes for Key Security Indicators of non-machine-based information resources at least once every 3 months.

---

Terms: Information Resource, Machine-Based (information resources), Persistent Validation

---

Terms: Information Resource, Machine-Based (information resources), Persistent Validation

Providers SHOULD provide technical explanations, demonstrations, and other relevant supporting information to all necessary assessors for the technical capabilities they employ to meet Key Security Indicators and to provide validation.

---

Terms: All Necessary Assessors, Persistent Validation

Providers MAY ask for and accept advice from their assessor during assessment regarding techniques and procedures that will improve their security posture or the effectiveness, clarity, and accuracy of their validation and reporting procedures for Key Security Indicators, UNLESS doing so might compromise the objectivity and integrity of the assessment (see also PVA-TPX-SHA).

---

Note: The related A2LA requirements are waived for FedRAMP 20x Phase Two assessments.

---

Terms: Persistent Validation

Assessors MUST verify and validate the underlying processes (both machine-based and non-machine-based) that providers use to validate Key Security Indicators; this should include at least:

1. The effectiveness, completeness, and integrity of the automated processes that perform validation of the cloud service offering's security posture.

2. The effectiveness, completeness, and integrity of the human processes that perform validation of the cloud service offering's security posture

3. The coverage of these processes within the cloud service offering, including if all of the consolidated information resources listed are being validated.

---

Terms: Cloud Service Offering, Information Resource, Machine-Based (information resources), Persistent Validation

Assessors MUST verify and validate the implementation of processes derived from Key Security Indicators to determine whether or not the provider has accurately documented their process and goals.

---

Terms: Persistent Validation

Assessors MUST verify and validate whether or not the underlying processes are consistently creating the desired security outcome documented by the provider.

---

Terms: Persistent Validation

Assessors MUST perform evaluation using a combination of quantitative and expert qualitative assessment as appropriate AND document which is applied to which aspect of the assessment.

Assessors MUST assess whether or not procedures are consistently followed, including the processes in place to ensure this occurs, without relying solely on the existence of a procedure document for assessing if appropriate processes and procedures are in place.

---

Note: This includes evaluating tests or plans for activities that may occur in the future but have not yet occurred.

Assessors MUST deliver a high-level summary of their assessment process and findings for each Key Security Indicator; this summary will be included in the authorization data for the cloud service offering.

---

Terms: Authorization data, Cloud Service Offering

Assessors MUST NOT rely on screenshots, configuration dumps, or other static output as evidence EXCEPT when evaluating the accuracy and reliability of a process that generates such artifacts.

Assessors MUST NOT deliver an overall recommendation on whether or not the cloud service offering meets the requirements for FedRAMP authorization.

---

Note: FedRAMP will make the final authorization decision based on the assessor's findings and other relevant information.

---

Terms: Cloud Service Offering

Assessors SHOULD engage provider experts in discussion to understand the decisions made by the provider and inform expert qualitative assessment, and SHOULD perform independent research to test such information as part of the expert qualitative assessment process.

Assessors MAY share advice with providers they are assessing about techniques and procedures that will improve their security posture or the effectiveness, clarity, and accuracy of their validation and reporting procedures for Key Security Indicators, UNLESS doing so might compromise the objectivity and integrity of the assessment (see also PVA-CSX-RAD).

---

Terms: Persistent Validation