FedRAMP Certification¶

Assessors MUST verify and validate the implementation of processes derived from FedRAMP requirements, including rules, controls and Key Security Indicators, to determine whether or not the provider has accurately documented their process and security goals for the cloud service offering.

Terms: Cloud Service Offering, Validation, Verification

Assessors MUST verify and validate whether or not the underlying processes are consistently creating the desired security outcome documented by the provider.

Terms: Validation, Verification

Assessors MUST assess whether or not procedures are consistently followed, including evaluating the processes in place to ensure this occurs, without relying solely on the existence of procedure documents.

Note: This includes evaluating tests or plans for activities that may occur in the future but have not yet occurred.

Assessors MUST perform verification and validation using a combination of quantitative and expert qualitative assessment as appropriate AND document which is applied to which aspect of the assessment.

Terms: Validation, Verification

Assessors MUST deliver a high-level summary of their assessment process and findings for each FedRAMP requirement, including rules, controls, and Key Security Indicators; this summary will be included in the FedRAMP Certification Data for the cloud service offering.

Terms: Certification Data, Cloud Service Offering

Assessors MUST supply an overall summary of the verification and validation assessment results, including any resulting failures or areas of dispute, to the provider and all necessary assessors.

Note: FedRAMP will make the final FedRAMP Certification decision based on the assessor's findings and other relevant information.

Terms: All Necessary Assessors, Validation, Verification

Assessors SHOULD engage provider experts in discussion to understand the decisions made by the provider and inform expert qualitative assessment, and SHOULD perform independent research to test such information as part of the expert qualitative assessment process.

Assessors MAY share advice with providers they are assessing about techniques and procedures that will improve the provider's security posture or the effectiveness, clarity, and accuracy of their verification, validation and reporting procedures, UNLESS doing so is likely to compromise the objectivity and integrity of the assessment.

Terms: Likely, Validation, Verification