FedRAMP is seeking your feedback in the FedRAMP Annual Survey. FedRAMP is constantly looking for ways to improve stakeholder engagement and provide the tools and services that you need to be successful.
- -If you’ve interacted with FedRAMP at any point in the last year, please take a few minutes to respond to the survey by August 28th.
- -We will use the information gathered from the survey to gauge how we are doing and to identify changes the program can make in the future to better meet the needs of our customers.
- -Thank you in advance for your participation and insight.
-:ET \ No newline at end of file diff --git a/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/0c/5ae75c148c3913941901a08af1e5814f7a48087ba790ef376043bc679fbef8 b/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/0c/5ae75c148c3913941901a08af1e5814f7a48087ba790ef376043bc679fbef8 deleted file mode 100644 index c2b23e71..00000000 --- a/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/0c/5ae75c148c3913941901a08af1e5814f7a48087ba790ef376043bc679fbef8 +++ /dev/null @@ -1,12 +0,0 @@ -I"FedRAMP updated the Plan of Actions and Milestones (POA&M) template to include two new columns. The additional columns were added at the behest of agency partners to help them track Cybersecurity and Infrastructure Security Agency (CISA) Binding Operational Directive (BOD) 22-01 findings, and the associated Common Vulnerabilities and Exposures (CVEs).
- -These columns can be found at the end of the current template headers in Row Five.
- -For more guidance around the purpose and requirements of the POA&M, please review the FedRAMP Plan of Actions and Milestones Completion Guide.
-:ET \ No newline at end of file diff --git a/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/0c/cfb9d4993c8b3a977bdd3b6ab07d47974a49bad868a08c75e643fb97fc0b0c b/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/0c/cfb9d4993c8b3a977bdd3b6ab07d47974a49bad868a08c75e643fb97fc0b0c deleted file mode 100644 index 7e277bff..00000000 --- a/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/0c/cfb9d4993c8b3a977bdd3b6ab07d47974a49bad868a08c75e643fb97fc0b0c +++ /dev/null @@ -1,2 +0,0 @@ -I"FedRAMP updated the Threat-Based Methodology White Paper to reflect changes to our methodology behind the threat-based scoring approach and its potential applications. FedRAMP is also excited to share the accompanying dataset, located on our GitHub repository. We encourage you to read the white paper and dataset and provide feedback and/or questions to info@fedramp.gov. The FedRAMP PMO looks forward to receiving your comments and sharing progress.
-:ET \ No newline at end of file diff --git a/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/0e/dbdf8e6f892b33ac6afd047bbe66a644b25652a59ac662b72883ed5487dd2b b/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/0e/dbdf8e6f892b33ac6afd047bbe66a644b25652a59ac662b72883ed5487dd2b deleted file mode 100644 index 9153132f..00000000 --- a/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/0e/dbdf8e6f892b33ac6afd047bbe66a644b25652a59ac662b72883ed5487dd2b +++ /dev/null @@ -1,2 +0,0 @@ -I"FedRAMP is seeking your feedback in the FedRAMP Annual Survey. FedRAMP is constantly looking for ways to improve stakeholder engagement and provide the tools and services that you need to be successful.
-:ET \ No newline at end of file diff --git a/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/33/f740d4f0418a04dea6f42cc8a1c67bb7d4d9d39dfbac149c99a4ff2f92bed1 b/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/33/f740d4f0418a04dea6f42cc8a1c67bb7d4d9d39dfbac149c99a4ff2f92bed1 deleted file mode 100644 index d8178c1f..00000000 --- a/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/33/f740d4f0418a04dea6f42cc8a1c67bb7d4d9d39dfbac149c99a4ff2f92bed1 +++ /dev/null @@ -1,8 +0,0 @@ -I"VThe Federal Risk and Authorization Management Program (FedRAMP) provides standardized security requirements for the authorization and ongoing cybersecurity of cloud services. Cloud technology and the security landscape are dynamic and change over time. As a result, it’s important that the program reviews and regularly updates the FedRAMP security authorization requirements in order to keep pace with technology advancements and new security threats.
- -Per the FedRAMP Policy Memo, the Joint Authorization Board (JAB) is required to “Define and regularly update the FedRAMP security authorization requirements in accordance with the Federal Information Security Management Act of 2002 (FISMA) and DHS guidance.” The JAB recently updated the SA-9(5) - External Information System Services | Processing, Storage, and Service Location control parameters, within the High Baseline only, specifying the following:
-This update is effective immediately and applies to all cloud products and services that are authorized or in-process of achieving a FedRAMP Authorization at the FedRAMP High Baseline. All applicable forms and templates have been updated to reflect this change. As always, we appreciate your partnership and if there are any questions or comments, please contact us at info@fedramp.gov. For media inquiries, please email press@gsa.gov.
-:ET \ No newline at end of file diff --git a/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/34/2a16855ca56025e6cca5a87fff2bf1514c837e7e08196649743a61196f63c8 b/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/34/2a16855ca56025e6cca5a87fff2bf1514c837e7e08196649743a61196f63c8 deleted file mode 100644 index f1535d15..00000000 --- a/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/34/2a16855ca56025e6cca5a87fff2bf1514c837e7e08196649743a61196f63c8 +++ /dev/null @@ -1,40 +0,0 @@ -I"The FedRAMP Joint Authorization Board has approved the FedRAMP Rev. 5 baselines! The FedRAMP baselines were updated to correspond with the National Institute of Standards and Technology’s (NIST) Special Publication (SP) 800-53 Rev. 5 Catalog of Security and Privacy Controls for Information Systems and Organizations and SP 800-53B Control Baselines for Information Systems and Organizations.
- -Outlined below are the released documents with a supporting high level summary:
- -During the approval process, FedRAMP has been working diligently to complete updates based on public comments to the Rev. 5 baselines and supporting documentation. The FedRAMP Open Security Controls Assessment Language (OSCAL) baseline profiles and resolve profile catalogs will be released within the next few weeks along with:
-FedRAMP will also provide training and educational forums specific to the Rev. 5 updates and the transition process this summer.
- -In the meantime, we ask that CSPs and other stakeholders review the CSP Transition Plan and make plans to address the updated templates in the coming weeks.
- -Join the FedRAMP subscriber list here to receive program updates, important reminders, blog announcements, and the monthly PMO Newsletter. If you have any questions, please contact info@fedramp.gov.
- -We thank you for your patience!
-:ET \ No newline at end of file diff --git a/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/34/428d07384ccc6cc3e9496a068fa54d721a5679771b3a31b8602878aed7cea6 b/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/34/428d07384ccc6cc3e9496a068fa54d721a5679771b3a31b8602878aed7cea6 deleted file mode 100644 index 5dfb5658..00000000 Binary files a/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/34/428d07384ccc6cc3e9496a068fa54d721a5679771b3a31b8602878aed7cea6 and /dev/null differ diff --git a/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/34/b7fbcfc657de2e672302d299f3cf450985626d426cc5fc15fface6b28ed1aa b/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/34/b7fbcfc657de2e672302d299f3cf450985626d426cc5fc15fface6b28ed1aa deleted file mode 100644 index f4e8f49d..00000000 --- a/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/34/b7fbcfc657de2e672302d299f3cf450985626d426cc5fc15fface6b28ed1aa +++ /dev/null @@ -1,14 +0,0 @@ -I"yThe following Cloud Service Providers (CSPs) have been selected to work with the Joint Authorization Board (JAB) for a Provisional Authority to Operate (P-ATO):
- -These CSPs were selected in accordance with our JAB Prioritization Guidance and Criteria document and will work with the JAB on their security package reviews. We’re proud to see the scope and scale of innovation and infrastructure modernization that this next group of vendors represent for JAB Authorizations. Congratulations!
- -Interested in working with the JAB? The next due date for FedRAMP Connect Business Cases will be January 21, 2022 at 5:00 p.m. ET. CSPs interested in working with the JAB should review the JAB Prioritization Guidance and Criteria document in its entirety and reach out to info@fedramp.gov with questions or to set up a coaching call. If you are an agency customer that would like to see a CSP prioritized to work with the JAB, please share the above information with your cloud service provider and reach out to info@fedramp.gov expressing your interest.
-:ET \ No newline at end of file diff --git a/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/3d/0118b397eb37fd1c94b3fb5fa4ecb771b17cd2c5cd3477b0fa644767eb80ba b/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/3d/0118b397eb37fd1c94b3fb5fa4ecb771b17cd2c5cd3477b0fa644767eb80ba deleted file mode 100644 index 6543eb11..00000000 --- a/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/3d/0118b397eb37fd1c94b3fb5fa4ecb771b17cd2c5cd3477b0fa644767eb80ba +++ /dev/null @@ -1,9 +0,0 @@ -I"The following Cloud Service Providers (CSPs) have been selected to work with the Joint Authorization Board (JAB) for a Provisional Authority to Operate (P-ATO) from our latest round of FedRAMP Connect:
-Did you know that over 30% of FedRAMP Cloud Service Providers (CSPs) are small businesses?* When we share this statistic across industry and the federal community, people are quite surprised — and pleased! Since small businesses represent an essential component of FedRAMP, we realized it was essential to engage directly with the small business community to gather feedback to improve the program.
-:ET \ No newline at end of file diff --git a/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/4e/69541bdc40679660b80917ac1ce19c77e69fe3fb50ea27d443f06ec48463cf b/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/4e/69541bdc40679660b80917ac1ce19c77e69fe3fb50ea27d443f06ec48463cf deleted file mode 100644 index cec7df0a..00000000 --- a/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/4e/69541bdc40679660b80917ac1ce19c77e69fe3fb50ea27d443f06ec48463cf +++ /dev/null @@ -1,6 +0,0 @@ -I"?Ryan Hoesing joined the team in December 2016 after serving in an executive administrative role for senior leadership at the General Services Administration (GSA). Ryan leads the team that helps manage customer engagement between agencies and Cloud Service Providers (CSPs). Ryan is in charge of making sure that authorization timelines are met through Federal Risk and Authorization Management Program’s (FedRAMP)’s ever-changing kanban boards. In doing so, Ryan helps the FedRAMP Agency Authorization team push the adoption of secure cloud technologies across the federal government.
- -In previous roles, Ryan has demonstrated proven leadership skills in strategy and business development that he now uses in his current role with the FedRAMP Program Management Office (PMO). Ryan joined GSA in 2014 after serving as a business economic development advisor in the U.S. Peace Corps from 2012-2014. Ryan has taken classes in front-end web development that have helped fuel his interest in Internet of Things and cloud security.
- -Ryan holds a B.A. in Business Administration from the University of Nebraska-Lincoln and is an avid Nebraska football fan. In 2019, Ryan completed his M.S. in Cybersecurity Management and Policy. Ryan also serves as a Contract Officer’s Representative (COR III) on all FedRAMP contracts.
-:ET \ No newline at end of file diff --git a/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/50/e9fba2268d34a0b90973f03cba209d550ee07984b057afb981382a52802ac4 b/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/50/e9fba2268d34a0b90973f03cba209d550ee07984b057afb981382a52802ac4 deleted file mode 100644 index d41cb52c..00000000 --- a/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/50/e9fba2268d34a0b90973f03cba209d550ee07984b057afb981382a52802ac4 +++ /dev/null @@ -1,2 +0,0 @@ -I"Congratulations to the following Cloud Service Providers (CSPs) selected to work with the Joint Authorization Board (JAB) for a Provisional Authority to Operate (P-ATO) from the latest round of FedRAMP Connect:
-:ET \ No newline at end of file diff --git a/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/56/74df961751857f896f00074109b085f572c5cc2db9649904d03db34c241c0e b/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/56/74df961751857f896f00074109b085f572c5cc2db9649904d03db34c241c0e deleted file mode 100644 index 54a0cf4c..00000000 --- a/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/56/74df961751857f896f00074109b085f572c5cc2db9649904d03db34c241c0e +++ /dev/null @@ -1,14 +0,0 @@ -I"4As Cloud Service Providers (CSPs) start to submit their container vulnerability scans in order to meet Container Scanning Guidance requirements, stakeholders monitoring submissions should expect to see large increases in the number of unique vulnerabilities.
- -What’s Different?
- -Traditional vulnerability scanning tools use an overarching PluginID or Vulnerability ID that wraps multiple Common Vulnerabilities and Exposures (CVE) under one ID. Container scanning solutions typically track unique vulnerabilities at the Common Vulnerabilities and Exposures (CVE) level, which is much more granular. This means that you could have an increased number of unique vulnerabilities in CSPs monitoring submissions.
- -What’s the Impact?
- -Those monitoring these new submissions could possibly see a jump of hundreds of unique vulnerabilities within the container scans.
-The Federal Risk and Authorization Management Program (FedRAMP) has great news to share: The President signed the FedRAMP Authorization Act as part of the FY23 National Defense Authorization Act (NDAA) (See Sec. 5921, page 1055). The Act codifies the FedRAMP program as the authoritative standardized approach to security assessment and authorization for cloud computing products and services that process unclassified federal information. This recognizes the work FedRAMP and its stakeholders have achieved over the last decade.
-:ET \ No newline at end of file diff --git a/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/57/cb461969de5d16ecaaff14390744302b463f49c3bc416f5434a9a7b224f042 b/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/57/cb461969de5d16ecaaff14390744302b463f49c3bc416f5434a9a7b224f042 deleted file mode 100644 index 7abff350..00000000 --- a/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/57/cb461969de5d16ecaaff14390744302b463f49c3bc416f5434a9a7b224f042 +++ /dev/null @@ -1,16 +0,0 @@ -I"The following Cloud Service Providers (CSPs) have been selected to work with the Joint Authorization Board (JAB) for a Provisional Authority to Operate (P-ATO) from our latest round of FedRAMP Connect:
- -These CSPs were selected in accordance with our JAB Prioritization Guidance and Criteria document and will work with the JAB on their security package reviews. We’re proud to see the scope and scale of innovation and infrastructure modernization that this next group of vendors represent for JAB authorizations. Congratulations!
- -The next due date for FedRAMP Connect Business Cases will be May 7, 2021 at 5:00 p.m. ET. If you are a CSP interested in working with the JAB, please review the JAB Prioritization Guidance and Criteria document in its entirety and reach out to info@fedramp.gov with questions or to set up a coaching call.
- -If you are an agency customer that would like to see a CSP prioritized to work with the JAB, please share the above information with your service provider and reach out to info@fedramp.gov expressing your interest.
-:ET \ No newline at end of file diff --git a/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/5f/2525368226f163d02ce8aed17587e36841315b8970af96e6e01cca69c2c83e b/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/5f/2525368226f163d02ce8aed17587e36841315b8970af96e6e01cca69c2c83e deleted file mode 100644 index 228a5898..00000000 --- a/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/5f/2525368226f163d02ce8aed17587e36841315b8970af96e6e01cca69c2c83e +++ /dev/null @@ -1,2 +0,0 @@ -I"FedRAMP recently revised training materials for the System Security Plan (SSP) Required Documentation training (200A Course). This training is designed to give Cloud Service Providers (CSPs) an understanding of security package development requirements and an overview of the required templates and supporting documentation necessary when creating a SSP.
-:ET \ No newline at end of file diff --git a/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/5f/e4b04dea7cdefb5a5a4dcc9e3595805f89eb4a5bb29f491287177719cfe1e3 b/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/5f/e4b04dea7cdefb5a5a4dcc9e3595805f89eb4a5bb29f491287177719cfe1e3 deleted file mode 100644 index 929264c1..00000000 --- a/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/5f/e4b04dea7cdefb5a5a4dcc9e3595805f89eb4a5bb29f491287177719cfe1e3 +++ /dev/null @@ -1,17 +0,0 @@ -I"KWe’re excited to announce the release of FedRAMP’s updated Penetration Test Guidance!
- -These updates were made to address the ever-changing cybersecurity landscape. Revisions include updated guidance around existing and new threats as well as addressing attack vectors so they’re in alignment with current best practices.
- -The revision process included the following initiatives:
-Thank you to all of our stakeholders who participated in the development of this document!
- -Please reach out to info@fedramp.gov with any questions.
-:ET \ No newline at end of file diff --git a/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/61/e194c01e5086030e096e32152fd77edc0132940ffd18cf81c7f55ac908bb4a b/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/61/e194c01e5086030e096e32152fd77edc0132940ffd18cf81c7f55ac908bb4a deleted file mode 100644 index 40e0aeb3..00000000 --- a/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/61/e194c01e5086030e096e32152fd77edc0132940ffd18cf81c7f55ac908bb4a +++ /dev/null @@ -1,10 +0,0 @@ -I"-FedRAMP released updates to the System Security Plan (SSP) Attachment 12 template, the FedRAMP Master Acronym and Glossary document, and the FedRAMP Initial Authorization Package Checklist template.
- -The SSP Attachment 12 - FedRAMP Laws and Regulations template was updated to include the latest publications, policies information, and relevant links. This is a required attachment to the SSP template and should be used, or updated, by CSPs undergoing the initial authorization process and submitted as part of their SSP package.
- -The FedRAMP Master Acronym and Glossary document was updated to include a more comprehensive listing of acronyms / terms found in FedRAMP documentation.
- -The FedRAMP Initial Authorization Package Checklist template was updated to remove attachments that are now embedded in the SSP template and to clarify instructions. CSPs are required to complete and submit the checklist when uploading the authorization package to the FedRAMP Repository.
- -FedRAMP will continue to make ongoing updates to documents and templates and will communicate the changes once they’re released. If you have any questions, feedback, or suggestions for documentation updates, please reach out to info@fedramp.gov.
-:ET \ No newline at end of file diff --git a/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/66/40622fe81bcbfea5c610b8ec1a27155d5e8f4a74502c72f922214cd6daac2d b/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/66/40622fe81bcbfea5c610b8ec1a27155d5e8f4a74502c72f922214cd6daac2d deleted file mode 100644 index 0a252997..00000000 --- a/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/66/40622fe81bcbfea5c610b8ec1a27155d5e8f4a74502c72f922214cd6daac2d +++ /dev/null @@ -1,7 +0,0 @@ -I"VTechnology changes rapidly and Cloud Service Providers (CSPs) continue to evolve in order to improve and adapt to customer needs. Some technology changes affect how continuous monitoring is performed. In response to requests from industry and to bridge the vulnerability scanning compliance gaps between traditional cloud systems and containerized cloud systems, FedRAMP developed the Vulnerability Scanning Requirements for the Deployment and Use of Containers (DRAFT) document.
- -This document addresses FedRAMP compliance pertaining to the processes, architecture, and security considerations specific to vulnerability scanning for cloud systems using container technology. The requirements described in this document are part of the FedRAMP Continuous Monitoring Strategy Guide and FedRAMP Vulnerability Scanning Requirements . The vulnerability scanning requirements for containerized systems serve to supplement and update existing requirements defined in those documents.
- -FedRAMP and the JAB would like your feedback on this document before the final version is published. Please submit your comments to info@fedramp.gov by September 11, 2020.
- -:ET \ No newline at end of file diff --git a/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/66/d1e36a68ae2383f0ac64f45e4ff39d78c2996c3d28e933376e237f5394ccce b/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/66/d1e36a68ae2383f0ac64f45e4ff39d78c2996c3d28e933376e237f5394ccce deleted file mode 100644 index 9890b8f5..00000000 --- a/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/66/d1e36a68ae2383f0ac64f45e4ff39d78c2996c3d28e933376e237f5394ccce +++ /dev/null @@ -1,10 +0,0 @@ -I"\Do you have bold, innovative, and actionable ideas that can help transform the way agencies secure federal data while keeping in pace with modernization efforts?
- -The FedRAMP PMO is excited to announce the launch of The FedRAMP Ideation Challenge. We’re calling on all members of the cybersecurity community - Cloud Service Providers (CSPs), Agencies, Third Party Assessors (3PAOs), and others - to contribute ideas for a new approach to risk assessments and security authorizations for cloud products and services. We deeply value feedback and input, understanding that this is vital in order to grow and reach the next level of improved customer experience and program success.
- -We want to ensure FedRAMP continuously explores initiatives in support of a modern, efficient, and effective authorization process in an effort to reduce time and cost, without compromising cybersecurity rigor. We invite participants to share their best thinking on the next phase of FedRAMP.
- -You’ll find more information about The FedRAMP Ideation Challenge, including an overview, background, submission details, and more on our new FedRAMP Ideation Challenge page.
- -Thank you for your insights, partnership, and commitment to taking FedRAMP to the next level!
-:ET \ No newline at end of file diff --git a/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/69/5b86185fe6093cc91077f8b7035b4b6e84b1a6d23f02075df70f6a700e2715 b/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/69/5b86185fe6093cc91077f8b7035b4b6e84b1a6d23f02075df70f6a700e2715 deleted file mode 100644 index e0756223..00000000 --- a/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/69/5b86185fe6093cc91077f8b7035b4b6e84b1a6d23f02075df70f6a700e2715 +++ /dev/null @@ -1,15 +0,0 @@ -I"The FedRAMP PMO recently launched the FedRAMP YouTube channel as a one-stop source for quick, simple, informative videos on FedRAMP tutorials, and program updates. The channel provides another medium for stakeholders to understand FedRAMP and the authorization process in addition to making information more accessible to all stakeholders.
- -A key feature of the channel are our new short FedRAMP videos that highlight an overview of the program, legal policy and framework, the authorization process, and the FedRAMP Marketplace.
- -Check out the first video, A FedRAMP Overview - Introduction:
- -You can view other videos on the FedRAMP Overview Playlist in addition to videos specific to other topics, ranging from updated 3PAO requirements, OSCAL updates, and FedRAMP’s transition plan to NIST’s Rev5. Most recently we produced a video highlighting the new FedRAMP.gov.
- -In 2021, we will continue to post new videos on a regular basis that are timely and relevant to FedRAMP. If you have any suggestions for video topics, please reach out to info@fedramp.gov.
-:ET \ No newline at end of file diff --git a/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/6f/e918c2faf7713ba52393d4eadf9d9779f1a0556ef51dfd40033ca631d37d46 b/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/6f/e918c2faf7713ba52393d4eadf9d9779f1a0556ef51dfd40033ca631d37d46 deleted file mode 100644 index 8a5fa974..00000000 --- a/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/6f/e918c2faf7713ba52393d4eadf9d9779f1a0556ef51dfd40033ca631d37d46 +++ /dev/null @@ -1,2 +0,0 @@ -I"The FedRAMP Annual Assessment Guidance provides guidance to assist CSPs, 3PAOs, and Federal Agencies in determining the scope of an annual assessment based on NIST SP 800-53, revision 4, FedRAMP baseline security requirements, and FedRAMP continuous monitoring requirements.
-:ET \ No newline at end of file diff --git a/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/92/099590e52079a63f3c7581fc4b866e9340e2114e117f8d88f9afe450866e87 b/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/92/099590e52079a63f3c7581fc4b866e9340e2114e117f8d88f9afe450866e87 deleted file mode 100644 index da9ad8d1..00000000 --- a/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/92/099590e52079a63f3c7581fc4b866e9340e2114e117f8d88f9afe450866e87 +++ /dev/null @@ -1,14 +0,0 @@ -I"The Federal Risk and Authorization Management Program (FedRAMP) is pleased to announce the release of the Vulnerability Scanning Requirements for Containers document. This document addresses FedRAMP compliance pertaining to the processes, architecture, and security considerations specific to vulnerability scanning for cloud systems using container technology. Prior to this release, the document was reviewed by Cloud Service Providers (CSPs) in a Technical Exchange Meeting and was provided to our stakeholders for public comment to ensure the guidance met CSPs’ needs.
- -Technology is constantly changing, and CSPs continue to evolve in order to improve and adapt to customer needs in this dynamic landscape. Some technology changes affect how continuous monitoring is performed. It is the goal of FedRAMP to provide a standardized approach to security assessment authorization and continuous monitoring for cloud products and services. The security requirements described within this document facilitate a CSP’s ability to leverage container technology while maintaining compliance with FedRAMP. Existing scanning requirements are outlined in the FedRAMP Continuous Monitoring Strategy Guide and FedRAMP Vulnerability Scanning Requirements. This document’s requirements are considered supplemental and are applicable for all systems implementing container technologies, including:
-If you have any questions on this guidance document, please reach out to info@fedramp.gov.
-:ET \ No newline at end of file diff --git a/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/92/1edc377b9a2eb89c0112805547e852ea27d2ebe31643dc647288fa8d3358af b/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/92/1edc377b9a2eb89c0112805547e852ea27d2ebe31643dc647288fa8d3358af deleted file mode 100644 index da5ae82b..00000000 --- a/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/92/1edc377b9a2eb89c0112805547e852ea27d2ebe31643dc647288fa8d3358af +++ /dev/null @@ -1,2 +0,0 @@ -I"6As part of our spotlight series on the members of the FedRAMP PMO team, we wanted to introduce John Hamilton, our FedRAMP Program Manager of Security Operations. We sat down with John to learn about his background, his day-to-day operations, his priorities and goals, and his interests outside of work.
-:ET \ No newline at end of file diff --git a/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/93/40c7166a7802bf2c703d5dd6282586b56a837380f1b10801659eedddb9a05e b/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/93/40c7166a7802bf2c703d5dd6282586b56a837380f1b10801659eedddb9a05e deleted file mode 100644 index 5419038d..00000000 --- a/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/93/40c7166a7802bf2c703d5dd6282586b56a837380f1b10801659eedddb9a05e +++ /dev/null @@ -1,2 +0,0 @@ -I"Cloud Service Providers (CSPs) hire Third Party Assessment Organizations (3PAOs) to perform security assessments for their initial and annual assessment authorizations. These assessments are usually performed onsite, including the physical and environmental controls provided by datacenters housing CSPs’ information technology resources. Due to the current safety guidelines from the Centers for Disease Control and Prevention (CDC) for COVID-19, however, 3PAOs may be permitted to perform the testing of certain datacenters remotely.
-:ET \ No newline at end of file diff --git a/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/95/ed69d92857c45a52d3b94b28715323e7568a22b8ba6b72570f817e0f0252f5 b/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/95/ed69d92857c45a52d3b94b28715323e7568a22b8ba6b72570f817e0f0252f5 deleted file mode 100644 index 80ee8ddd..00000000 --- a/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/95/ed69d92857c45a52d3b94b28715323e7568a22b8ba6b72570f817e0f0252f5 +++ /dev/null @@ -1,2 +0,0 @@ -I"The purpose of this document is to provide guidelines for organizations on planning and conducting Penetration Testing and analyzing and reporting on findings.
-:ET \ No newline at end of file diff --git a/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/9c/99f4dc9c56b80715b8795c72300397760ff835bcc06a3a3854cb7bf0e3efce b/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/9c/99f4dc9c56b80715b8795c72300397760ff835bcc06a3a3854cb7bf0e3efce deleted file mode 100644 index a7c8663b..00000000 --- a/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/9c/99f4dc9c56b80715b8795c72300397760ff835bcc06a3a3854cb7bf0e3efce +++ /dev/null @@ -1,14 +0,0 @@ -I"The Federal Risk and Authorization Management Program (FedRAMP) has great news to share: The President signed the FedRAMP Authorization Act as part of the FY23 National Defense Authorization Act (NDAA) (See Sec. 5921, page 1055). The Act codifies the FedRAMP program as the authoritative standardized approach to security assessment and authorization for cloud computing products and services that process unclassified federal information. This recognizes the work FedRAMP and its stakeholders have achieved over the last decade.
- -The FedRAMP team provided technical assistance in the creation of the Act, and has been planning for several months. Here are a few things we are excited for:
-In FY22, FedRAMP authorized cloud products were reused more than 4,500 times across the federal government, a 60% increase in reuse from FY21 and a 132% increase from FY20. The FedRAMP community continues to grow and includes 204 participating agencies, 280+ cloud service providers, and 40 recognized third party assessment organizations.
- -We will share additional information on how the Act may impact our stakeholders in the near future, including more information on the new Federal Secure Cloud Advisory Committee. Please keep an eye out on all FedRAMP communication channels for any updates on the program.
-:ET \ No newline at end of file diff --git a/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/9e/1c8e3930e818266052b59f88a0c71548d252158fd881194704ac5bd610020a b/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/9e/1c8e3930e818266052b59f88a0c71548d252158fd881194704ac5bd610020a deleted file mode 100644 index 57d063b5..00000000 --- a/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/9e/1c8e3930e818266052b59f88a0c71548d252158fd881194704ac5bd610020a +++ /dev/null @@ -1,2 +0,0 @@ -I"FThe PMO uses this template to review Agency ATO packages.
-:ET \ No newline at end of file diff --git a/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/9e/8b95587cdb83f0b1e698ae5d7603794d79ae6b68841aeaa0ae9317cf0f8efc b/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/9e/8b95587cdb83f0b1e698ae5d7603794d79ae6b68841aeaa0ae9317cf0f8efc deleted file mode 100644 index c2231e3b..00000000 --- a/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/9e/8b95587cdb83f0b1e698ae5d7603794d79ae6b68841aeaa0ae9317cf0f8efc +++ /dev/null @@ -1,2 +0,0 @@ -I"Technology changes rapidly and Cloud Service Providers (CSPs) continue to evolve in order to improve and adapt to customer needs. Some technology changes affect how continuous monitoring is performed. In response to requests from industry and to bridge the vulnerability scanning compliance gaps between traditional cloud systems and containerized cloud systems, FedRAMP developed the Vulnerability Scanning Requirements for the Deployment and Use of Containers (DRAFT) document.
-:ET \ No newline at end of file diff --git a/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/9e/d901ba801b1d7925278f900b4ed157a7c356fe838e0cab672a17391d180960 b/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/9e/d901ba801b1d7925278f900b4ed157a7c356fe838e0cab672a17391d180960 deleted file mode 100644 index 4e4eb990..00000000 --- a/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/9e/d901ba801b1d7925278f900b4ed157a7c356fe838e0cab672a17391d180960 +++ /dev/null @@ -1,7 +0,0 @@ -I"In an effort to strengthen the qualifications of third party assessment organizations (3PAOs), the American Association for Laboratory Accreditation (A2LA) recently released an updated version of the R311 — the policy document that outlines the requirements for all FedRAMP recognized third party assessment organizations (3PAOs) and organizations seeking A2LA accreditation to be recognized by FedRAMP.
- -A2LA’s memorandum highlights the significant changes to the R311 and encourages assessors to read the updates in their entirety. As mentioned in the memorandum, the majority of the requirements are in effect immediately and will be assessed during each 3PAO’s upcoming A2LA assessment. To learn more about the changes, please visit A2LA’s Website.
- -Please reach out to info@fedramp.gov with any questions.
- -:ET \ No newline at end of file diff --git a/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/a5/fd98d3ee831ccc3050c346a501b1bed133d8da0717499823db250a0fb8b25b b/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/a5/fd98d3ee831ccc3050c346a501b1bed133d8da0717499823db250a0fb8b25b deleted file mode 100644 index a6a959ce..00000000 --- a/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/a5/fd98d3ee831ccc3050c346a501b1bed133d8da0717499823db250a0fb8b25b +++ /dev/null @@ -1,2 +0,0 @@ -I"Fiscal Year 2019 was a year of achievement and progress for FedRAMP. Thank you for your collaboration over the past year. We look forward to 2020 as we streamline, simplify, and stay committed to continuous improvement.
-:ET \ No newline at end of file diff --git a/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/ae/9b520e2f7f291599d9addc87eb7050928d39e20b057f7b48619bf382c9bb6f b/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/ae/9b520e2f7f291599d9addc87eb7050928d39e20b057f7b48619bf382c9bb6f deleted file mode 100644 index 51c50b5e..00000000 --- a/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/ae/9b520e2f7f291599d9addc87eb7050928d39e20b057f7b48619bf382c9bb6f +++ /dev/null @@ -1,2 +0,0 @@ -I"FedRAMP’s Agency Liaisons are federal cloud security subject matter experts who serve as a crucial connection between the Program Management Office (PMO) and federal agencies that partner with Cloud Service Providers (CSPs) seeking FedRAMP Authorization.
-:ET \ No newline at end of file diff --git a/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/b3/5ef0e888ba9c02fdcdbbba756a78d73f52b5562b5cead92fece04be1b4a3b9 b/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/b3/5ef0e888ba9c02fdcdbbba756a78d73f52b5562b5cead92fece04be1b4a3b9 deleted file mode 100644 index 5ef39e65..00000000 --- a/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/b3/5ef0e888ba9c02fdcdbbba756a78d73f52b5562b5cead92fece04be1b4a3b9 +++ /dev/null @@ -1,14 +0,0 @@ -I"$The FedRAMP PMO, in coordination with the American Association for Laboratory Accreditation (A2LA), has made several revisions to the FedRAMP Third Party Assessment Organization (3PAO) Obligations and Performance Standards document that focus on further defining the program’s 3PAO performance and compliance expectations.
- -The updates include:
-If you have any questions about these new changes, please reach out to info@fedramp.gov.
-:ET \ No newline at end of file diff --git a/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/bb/c0f6ccb6801de8e820964f6e339c9550ae5ce8f4968ccd0226448ecd866d86 b/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/bb/c0f6ccb6801de8e820964f6e339c9550ae5ce8f4968ccd0226448ecd866d86 deleted file mode 100644 index ca1233de..00000000 --- a/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/bb/c0f6ccb6801de8e820964f6e339c9550ae5ce8f4968ccd0226448ecd866d86 +++ /dev/null @@ -1,15 +0,0 @@ -I"The following Cloud Service Providers (CSPs) have been selected to work with the Joint Authorization Board (JAB) for a Provisional Authority to Operate (P-ATO) from our latest round of FedRAMP Connect:
- -These CSPs were selected in accordance with our JAB Prioritization Criteria and FedRAMP Connect Guidance document and will work with the JAB on their security package reviews. We’re excited to see the scope and scale of innovation and infrastructure modernization that these Cloud Service Offerings represent. Congratulations!
- -The next due date for FedRAMP Connect Business Cases will be March 31, 2023 at 5:00 p.m. ET. If you are a CSP interested in working with the JAB, please review the JAB Prioritization Criteria and FedRAMP Connect Guidance in its entirety, and reach out to info@fedramp.gov with questions or to set up a coaching call.
- -If you are an agency customer that would like to see a CSP prioritized to work with the JAB, please share the above information with your service provider and reach out to info@fedramp.gov expressing your interest.
-:ET \ No newline at end of file diff --git a/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/bd/50d57a2cbdd4ae6fe6c89a2718f977986bcfa38fcff43b1c292844cac3dd97 b/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/bd/50d57a2cbdd4ae6fe6c89a2718f977986bcfa38fcff43b1c292844cac3dd97 deleted file mode 100644 index 27fb6e31..00000000 --- a/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/bd/50d57a2cbdd4ae6fe6c89a2718f977986bcfa38fcff43b1c292844cac3dd97 +++ /dev/null @@ -1,2 +0,0 @@ -I"In June 2020, FedRAMP announced the release of OSCAL resources and templates on GitHub for CSPs, 3PAOs, and agencies to begin exploring for future use. In collaboration with NIST, FedRAMP updated OSCAL resources to include a comprehensive set of guides for additional deliverables, including the SAP, SAR, and POA&M.
-:ET \ No newline at end of file diff --git a/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/bd/c0805a83e6285c3c3e2173e44e889624c6f737025483b3cc0c8b7965090073 b/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/bd/c0805a83e6285c3c3e2173e44e889624c6f737025483b3cc0c8b7965090073 deleted file mode 100644 index 28fd6837..00000000 --- a/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/bd/c0805a83e6285c3c3e2173e44e889624c6f737025483b3cc0c8b7965090073 +++ /dev/null @@ -1,4 +0,0 @@ -I"John Hamilton is Federal Risk and Authorization Management Program’s (FedRAMP) Program Manager of Security Operations. In this role, he works to ensure effective day-to-day operations of the FedRAMP Program Management Office (PMO)’s Readiness Assessment Review (RAR) process, public-facing website, customer mailbox, and secure repository. He also coordinates with FedRAMP’s Joint Authorization Board (JAB) and independent assessor accreditation body (A2LA) to ensure provisionally authorized Cloud Service Providers (CSPs) and Third Party Assessment Organizations (3PAOs) meet FedRAMP performance standards and guidelines.
- -John previously worked for Accenture Federal Services and Booz Allen Hamilton where he served as a trusted cybersecurity advisor for the federal government. He provided leadership, strategy, and information assurance expertise to multiple federal agencies to obtain, maintain, and enhance compliance with mandated IT policies. His extensive experience in working to improve program efficiencies and understanding of systems engineering design approaches facilitated the enterprise-wide implementation of the Department of Labor’s Public Key Infrastructure (PKI) and the Department of Defense’s secure mobility strategy.
-:ET \ No newline at end of file diff --git a/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/be/5baa872ce204f4ef96d4710ac3d0cc7d0ae2f626023a1b0b7087010eba8f9a b/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/be/5baa872ce204f4ef96d4710ac3d0cc7d0ae2f626023a1b0b7087010eba8f9a deleted file mode 100644 index 40985421..00000000 --- a/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/be/5baa872ce204f4ef96d4710ac3d0cc7d0ae2f626023a1b0b7087010eba8f9a +++ /dev/null @@ -1,2 +0,0 @@ -I"Do you have bold, innovative, and actionable ideas that can help transform the way agencies secure federal data while keeping in pace with modernization efforts?
-:ET \ No newline at end of file diff --git a/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/be/60c56a3b4ce64da78058a1bbe177be10e64b490a1f7297053679361e14fcfd b/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/be/60c56a3b4ce64da78058a1bbe177be10e64b490a1f7297053679361e14fcfd deleted file mode 100644 index 18620fa5..00000000 --- a/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/be/60c56a3b4ce64da78058a1bbe177be10e64b490a1f7297053679361e14fcfd +++ /dev/null @@ -1,10 +0,0 @@ -I"jThe FedRAMP PMO is asking for a few minutes of your time. Surveys give us an opportunity to gather your valuable feedback in order to improve both FedRAMP as a whole and your experience working with the PMO. In previous years, FedRAMP released its own survey to our stakeholders. This year we are leveraging the annual GSA Federal Acquisition Service (FAS) Customer Survey to gather your responses around all aspects of your interactions with FedRAMP.
- -Please take a moment to complete this survey before June 23, 2023 to share your opinions with the FedRAMP PMO. You should have received an email earlier this week from surveys@research.gsa.gov titled “How are we doing? Let us know!” The survey should take about 7 minutes to complete.
- -Collecting customer feedback is essential for FedRAMP to align operations to customer needs. We are continuously looking for ways to improve our customer’s experience and provide stakeholders with the tools and services needed to be successful.
- -We want your feedback on what we are doing well and what areas need improvement. The survey results will help FedRAMP to identify program changes and enhancements that better serve our customers. We value your insight and thank you in advance for your participation.
-:ET \ No newline at end of file diff --git a/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/be/8ed64484c3e2fa75b6799922f86161daa212f76da613988ecf549001ba98d2 b/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/be/8ed64484c3e2fa75b6799922f86161daa212f76da613988ecf549001ba98d2 deleted file mode 100644 index 7b777e96..00000000 --- a/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/be/8ed64484c3e2fa75b6799922f86161daa212f76da613988ecf549001ba98d2 +++ /dev/null @@ -1,19 +0,0 @@ -I"kThe Cybersecurity and Infrastructure Security Agency (CISA) at the Department of Homeland Security (DHS) develops and oversees the implementation of “binding operational directives” (BODs) and “emergency directives” (EDs). These directives require action on the part of certain federal agencies and cloud service providers (CSPs). FedRAMP works closely with the Joint Authorization Board (JAB) and DHS CISA to issue actions required and outlined in these BODs and EDs.
- -On November 3, 2021, DHS CISA issued -Binding Operational Directive 22-01, “Reducing the Significant Risk of Known Exploited Vulnerabilities”. This BOD “establishes a CISA-managed catalog of known exploited vulnerabilities that carry significant risk to the federal enterprise and establishes requirements for agencies to remediate any such vulnerabilities included in the catalog. CISA will determine vulnerabilities warranting inclusion in the catalog based on reliable evidence that the exploit is being actively used to exploit public or private organizations by a threat actor.”
- -FedRAMP, in accordance with Binding Operational Directive 22-01 and in consultation with the JAB and DHS CISA, emphasized that CSPs who maintain federal information fall within the scope defined by the BOD. All CSPs must review and implement the actions described within.
- -FedRAMP notified all Authorized CSPs that in order to address the requirement, FedRAMP has updated the POA&M template to accommodate tracking of vulnerabilities against the catalog of known exploited vulnerabilities. CSPs can track vulnerabilities in the new template or simply add a column (column AB, with the header ‘Binding Operational Directive 22-01 tracking’) in their current POA&M. This new column should be filled out with a ‘Yes’ or ‘No’ as to whether this POA&M item’s vulnerability is found in the catalog of known exploited vulnerabilities.
- -CSPs should only include applicable vulnerabilities in their POA&M. They do not have to include a status for every known vulnerability on the CISA-managed catalog.
- -We strongly suggest that CSPs sign up for automatic alerts when new vulnerabilities are added to the catalog.
- -Please contact the PMO at info@fedramp.gov with any questions.
-:ET \ No newline at end of file diff --git a/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/c0/221d60e9be8ceac72119ec8a3d1d8efd57c98f72a5f2fd102814d0493c4aad b/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/c0/221d60e9be8ceac72119ec8a3d1d8efd57c98f72a5f2fd102814d0493c4aad deleted file mode 100644 index 1a867610..00000000 --- a/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/c0/221d60e9be8ceac72119ec8a3d1d8efd57c98f72a5f2fd102814d0493c4aad +++ /dev/null @@ -1,9 +0,0 @@ -I"FedRAMP often receives requests for information and guidance regarding the Agency Authorization process. In response, the FedRAMP Program Management Office (PMO) is releasing a three-part blog series that explores the formal touchpoints with stakeholders as they pursue a FedRAMP Authorization. Throughout this series, we will explore the What, Who, Why, and When of the following touchpoints:
- - -This first edition takes a look at FedRAMP Intake Calls. Cloud Service Providers (CSPs) are highly encouraged to schedule these calls as their first step towards authorizing their Cloud Service Offering (CSO).
-:ET \ No newline at end of file diff --git a/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/c0/8089fd991d0c2621e0af6a26e7ab3013ef6933103c2c581daf365ca5ee8d09 b/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/c0/8089fd991d0c2621e0af6a26e7ab3013ef6933103c2c581daf365ca5ee8d09 deleted file mode 100644 index fc83d52a..00000000 --- a/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/c0/8089fd991d0c2621e0af6a26e7ab3013ef6933103c2c581daf365ca5ee8d09 +++ /dev/null @@ -1,2 +0,0 @@ -I")This document provides CSPs with a framework to create and deploy an automated, CVSS-based vulnerability risk adjustment tool for vulnerabilities identified by vulnerability scanning tools. The document is in DRAFT form while FedRAMP pilots this process with CSPs over the next year or so.
-:ET \ No newline at end of file diff --git a/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/c6/7e003cb82a96e5fdc6559b7b41cb23433deb28a25bef916d2ade9bbed48943 b/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/c6/7e003cb82a96e5fdc6559b7b41cb23433deb28a25bef916d2ade9bbed48943 deleted file mode 100644 index babab26a..00000000 --- a/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/c6/7e003cb82a96e5fdc6559b7b41cb23433deb28a25bef916d2ade9bbed48943 +++ /dev/null @@ -1,2 +0,0 @@ -I"This document defines the FedRAMP policies and procedures for making significant changes. It provides requirements, guidance, and actions the FedRAMP PMO, AO, CSP, and 3PAO will take when a CSP wishes to make a significant change to its provisionally authorized cloud service.
-:ET \ No newline at end of file diff --git a/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/c9/d7f01b01769207be1c594abed3b345c4edca9f81bbcb8fe7c03795f73aa3d4 b/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/c9/d7f01b01769207be1c594abed3b345c4edca9f81bbcb8fe7c03795f73aa3d4 deleted file mode 100644 index de31bb18..00000000 --- a/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/c9/d7f01b01769207be1c594abed3b345c4edca9f81bbcb8fe7c03795f73aa3d4 +++ /dev/null @@ -1,2 +0,0 @@ -I"3On September 25, 2019 the FedRAMP PMO had its first Small Business/Start-Up Meetup in San Francisco! Attendee feedback was overwhelmingly positive and there were several requests for more meetups throughout the year. Many thanks to the 75+ participants from 37 different organizations for attending.
-:ET \ No newline at end of file diff --git a/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/ca/c92883d8c963c616b763e88ba7a414c189dd428fa19160fe00199125028f2e b/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/ca/c92883d8c963c616b763e88ba7a414c189dd428fa19160fe00199125028f2e deleted file mode 100644 index 4db99253..00000000 --- a/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/ca/c92883d8c963c616b763e88ba7a414c189dd428fa19160fe00199125028f2e +++ /dev/null @@ -1,11 +0,0 @@ -I"The Cybersecurity and Infrastructure Security Agency (CISA) at the Department of Homeland Security (DHS) develops and oversees the implementation of “Binding Operational Directives” (BODs) and “Emergency Directives” (EDs). These directives require action on the part of certain federal agencies and cloud service providers (CSPs). FedRAMP works closely with the Joint Authorization Board (JAB) and DHS CISA to issue actions required and outlined in these BODs and EDs.
- -On June 13, 2023, DHS CISA issued Binding Operational Directive 23-02, “Mitigating the Risk from Internet-Exposed Management Interfaces”. This BOD “requires agencies to take steps to reduce the attack surface created by insecure or misconfigured management interfaces across certain classes of devices.”
- -While there is no required action for FedRAMP commercial CSPs, FedRAMP recommends that CSPs review the content in Binding Operational Directive 23-02 and follow these best practices.
- -Please contact the PMO at info@fedramp.gov with any questions.
-:ET \ No newline at end of file diff --git a/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/ca/f8e2f02a51b62035233ae60fcfbef0f54cd8ec99da882914a7d3ff1380d57d b/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/ca/f8e2f02a51b62035233ae60fcfbef0f54cd8ec99da882914a7d3ff1380d57d deleted file mode 100644 index d345fd23..00000000 --- a/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/ca/f8e2f02a51b62035233ae60fcfbef0f54cd8ec99da882914a7d3ff1380d57d +++ /dev/null @@ -1,3 +0,0 @@ -I"The General Services Administration (GSA) is establishing the Federal Secure Cloud Advisory Committee (FSCAC) in compliance with the FedRAMP Authorization Act, part of the FY23 National Defense Authorization Act (NDAA). The FSCAC is a statutory advisory committee in accordance with the provisions of FACA (5 U.S.C. 10).
-:ET \ No newline at end of file diff --git a/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/cf/6c2a7e95c4667a2441e26fdca4f3159406bad04bd4bcda2a35f0fda8d95459 b/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/cf/6c2a7e95c4667a2441e26fdca4f3159406bad04bd4bcda2a35f0fda8d95459 deleted file mode 100644 index 1dc9e4ee..00000000 --- a/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/cf/6c2a7e95c4667a2441e26fdca4f3159406bad04bd4bcda2a35f0fda8d95459 +++ /dev/null @@ -1,2 +0,0 @@ -I"This document outlines the timeliness and accuracy of testing requirements for evidence associated with an authorization package prior to a CSP entering the FedRAMP JAB P-ATO process.
-:ET \ No newline at end of file diff --git a/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/d6/e4bf29cee88a2f34f3ac6c65d01df2f38b8948c21c1372763abe3560b66319 b/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/d6/e4bf29cee88a2f34f3ac6c65d01df2f38b8948c21c1372763abe3560b66319 deleted file mode 100644 index 30f8268f..00000000 --- a/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/d6/e4bf29cee88a2f34f3ac6c65d01df2f38b8948c21c1372763abe3560b66319 +++ /dev/null @@ -1,2 +0,0 @@ -I"Both Cloud Service Providers (CSPs) and Federal Agencies play a role in Continuous Monitoring. FedRAMP Authorized CSPs are required to perform Continuous Monitoring to maintain a sufficient security posture. Federal Agencies are obligated to review a CSP’s Continuous Monitoring artifacts to determine if an Authority-to-Operate (ATO) is appropriate over the life of the system.
-:ET \ No newline at end of file diff --git a/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/d8/9be3259babf9d248290d3332806210f50e39b591905efd0d35548bef2a4ace b/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/d8/9be3259babf9d248290d3332806210f50e39b591905efd0d35548bef2a4ace deleted file mode 100644 index d0c7c719..00000000 --- a/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/d8/9be3259babf9d248290d3332806210f50e39b591905efd0d35548bef2a4ace +++ /dev/null @@ -1,7 +0,0 @@ -I"The FedRAMP PMO recently kicked off a new initiative, the Agency Liaison Program, which is designed to transform the way FedRAMP informs and collaborates with federal agencies. Agencies play an important role in the success of FedRAMP and through this Agency Liaison Program, the PMO will provide support through a “train-the-trainer” model for liaisons to share knowledge and resources about the authorization process to others in their agency.
- -Through this program, we are building a community to enhance collaboration and knowledge sharing across the government, with more than 30 agencies participating in the program. This initiative was developed in response to customer feedback we received from the FedRAMP Ideation Challenge and the ACT-IAC FedRAMP working group. One of FedRAMP’s guiding principles is “do once, use many,” and the program is designed to help agencies and industry be more efficient in their cloud adoption efforts. Additionally, the program establishes a formal feedback mechanism to enable continuous process improvement as the program rolls out new initiatives.
- -The FedRAMP PMO and Agency Liaisons have hit the ground running and have already had a kick-off meeting and first training session with more scheduled next month. If you have any questions regarding the Agency Liaison role within your agency, please reach out to info@fedramp.gov.
- -:ET \ No newline at end of file diff --git a/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/df/75efefd84e68973a6d18e2c9bb40862439e492956e14f2760dd4ea643ddd2b b/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/df/75efefd84e68973a6d18e2c9bb40862439e492956e14f2760dd4ea643ddd2b deleted file mode 100644 index c2cd2a95..00000000 --- a/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/df/75efefd84e68973a6d18e2c9bb40862439e492956e14f2760dd4ea643ddd2b +++ /dev/null @@ -1,2 +0,0 @@ -I"As Cloud Service Providers (CSPs) start to submit their container vulnerability scans in order to meet Container Scanning Guidance requirements, stakeholders monitoring submissions should expect to see large increases in the number of unique vulnerabilities.
-:ET \ No newline at end of file diff --git a/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/df/c86e58dbeaad4d9521e270f9df67345407d167c7a7bad91b20dd0d2d2482e5 b/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/df/c86e58dbeaad4d9521e270f9df67345407d167c7a7bad91b20dd0d2d2482e5 deleted file mode 100644 index e08bb7f2..00000000 --- a/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/df/c86e58dbeaad4d9521e270f9df67345407d167c7a7bad91b20dd0d2d2482e5 +++ /dev/null @@ -1,2 +0,0 @@ -I"<FedRAMP has released the second wave of Rev. 5 documents: the Open Security Controls Assessment Language (OSCAL) FedRAMP Rev. 5 baseline profiles and resolved profile catalogs! OSCAL is a language developed by the National Institute of Standards and Technology (NIST) in collaboration with FedRAMP to reduce the time and resources to prepare, authorize, and reuse cloud products and services. The updated documents will assist stakeholders who leverage OSCAL to reduce time and cost by automating their FedRAMP authorization and continuous monitoring requirements.
-:ET \ No newline at end of file diff --git a/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/e3/b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 b/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/e3/b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 deleted file mode 100644 index 80ef94bd..00000000 --- a/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/e3/b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 +++ /dev/null @@ -1,2 +0,0 @@ -I" -:ET \ No newline at end of file diff --git a/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/e4/2670c41aaba9bcaa6db6eb0c87207ba2ea06af7b42b4171319465557478b9a b/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/e4/2670c41aaba9bcaa6db6eb0c87207ba2ea06af7b42b4171319465557478b9a deleted file mode 100644 index 51b54c42..00000000 --- a/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/e4/2670c41aaba9bcaa6db6eb0c87207ba2ea06af7b42b4171319465557478b9a +++ /dev/null @@ -1,42 +0,0 @@ -I"FedRAMP often receives requests for information and guidance regarding the Agency Authorization process. In response, the FedRAMP Program Management Office (PMO) is releasing a three-part blog series that explores the formal touchpoints with stakeholders as they pursue a FedRAMP Authorization. Throughout this series, we will explore the What, Who, Why, and When of the following touchpoints:
- - -This first edition takes a look at FedRAMP Intake Calls. Cloud Service Providers (CSPs) are highly encouraged to schedule these calls as their first step towards authorizing their Cloud Service Offering (CSO).
- -The Intake Call is a virtual, 30-minute call held to discuss the specifics of a CSO’s FedRAMP Authorization.
-Intakes are typically only attended by the PMO and CSPs, but other stakeholders can be invited at the CSPs discretion.
-These meetings provide an open forum for CSPs to ask questions and air their questions and concerns about the authorization process. It also allows the PMO to learn more about your system and provide appropriate guidance.
-Calls ideally occur as early in the authorization process as possible. However, they should only be scheduled after the CSP completes the following:
-A member from the PMO will follow up with the CSP to provide appropriate guidance and next steps based on what was discussed during the call, including requirements for scheduling a Kickoff Meeting.
- -We look forward to continuing our engagement with industry, and we hope you found this information helpful! Please reach out to intake@fedramp.gov with any questions or for assistance with starting your FedRAMP Authorization journey or visit the Agency Authorization page for more resources on the FedRAMP Authorization process.
- -Stay tuned for our next blog that is focused on the Agency Authorization Kickoff Meeting.
- -The PMO recognizes that not every CSP’s authorization journey will follow steps as outlined here, and specific steps of the process can vary depending on many factors. In addition, it is important to note that these are not the ONLY touchpoints you may have with the PMO, and that you are encouraged to request meetings at any point where we may be of some assistance in your authorization journey.
- - -We receive thousands of questions through info@fedramp.gov, and one of the most popular topics is the FedRAMP Marketplace and which cloud capabilities are FedRAMP Ready, In Process, or Authorized. With over 220 industry partners engaged with the program, the FedRAMP Marketplace is a one-stop-shop in providing visibility into the FedRAMP community. The Marketplace serves as a searchable and sortable database of Cloud Service Offerings (CSOs), aiding Agencies in the process of researching and identifying secure cloud capabilities that are available for government-wide use. It also lists the accredited auditors that can perform the FedRAMP assessment, known as Third Party Assessment Organizations (3PAOs). With over 250,000 visits annually, the Marketplace is a valuable source of real-time information for our customers.
-:ET \ No newline at end of file diff --git a/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/e5/277a1f7eef21780b642eec6259d3f853d4177db888eb8538c55b36c63ced2c b/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/e5/277a1f7eef21780b642eec6259d3f853d4177db888eb8538c55b36c63ced2c deleted file mode 100644 index b0d52854..00000000 --- a/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/e5/277a1f7eef21780b642eec6259d3f853d4177db888eb8538c55b36c63ced2c +++ /dev/null @@ -1,4 +0,0 @@ -I"The due date for FedRAMP Connect Business Cases has been extended to January 28, 2022 at 5:00 p.m. ET. If you are a Cloud Service Provider (CSP) interested in working with the JAB, please review the JAB Prioritization Guidance and Criteria document in its entirety and reach out to info@fedramp.gov with questions or to set up a coaching call.
- -If you are an agency customer that would like to see a CSP prioritized to work with the JAB, please share the above information with your service provider and reach out to info@fedramp.gov expressing your interest.
-:ET \ No newline at end of file diff --git a/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/e5/3156e199f0172b83b93a454c6b8881cd4be4a40726718c024da8bacee0e81f b/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/e5/3156e199f0172b83b93a454c6b8881cd4be4a40726718c024da8bacee0e81f deleted file mode 100644 index b2f5b94b..00000000 --- a/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/e5/3156e199f0172b83b93a454c6b8881cd4be4a40726718c024da8bacee0e81f +++ /dev/null @@ -1,27 +0,0 @@ -I"FedRAMP is releasing baselines for public comment, and we want your feedback.
- -Rev 5 Baselines
- -FedRAMP uses the National Institute of Standards and Technology’s (NIST) guidelines and procedures to provide standardized security requirements for cloud services. Specifically, FedRAMP leverages NIST’s Special Publication [SP] 800-53 - Security and Privacy Controls for Federal Information Systems and Organizations series , the baselines and test cases.
- -In 2020, NIST released SP 800-53, Security and Privacy Controls for Federal Information Systems and Organizations, Revision 5 (Rev. 5) catalog of security and privacy controls and SP 800-53B, Control Baselines for Information Systems and Organizations. The FedRAMP PMO worked with the Joint Advisory Board to develop the FedRAMP baselines in alignment with NIST’s Rev. 5 update.
- -Applying Threat-Based Methodology to Rev 5 Baselines
- -Using the Threat-Based Methodology, FedRAMP analyzed each NIST SP 800-53, Rev. 5 control within the FedRAMP High baseline on their ability to protect, detect, and/or respond to each of the techniques outlined in the MITRE ATT&CK Framework version 8.2. FedRAMP applied the threat-based methodology to evaluate the controls FedRAMP adds above the published NIST Rev. 5 baseline.
- -By applying this methodology, FedRAMP significantly reduced the number of controls added by FedRAMP in addition to the NIST Rev. 5 baselines.
-Each of these additional controls scored high enough in the threat scoring to retain in the FedRAMP baselines. Despite a significant increase in NIST baseline controls, FedRAMP was able to decrease the number of Moderate and High controls by leveraging threat scoring.
- -We Want Your Feedback!
- -FedRAMP anticipates that more strategic control selection will result in a more focused security authorization process. The FedRAMP PMO is releasing this initial draft of the FedRAMP Rev. 5 baselines for public comment. Your feedback is critical in continuing to provide the best guidance possible.
- -Please provide your feedback through this excel file to info@fedramp.gov by Friday, April 1, 2022
-:ET \ No newline at end of file diff --git a/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/e5/34b298367f856587e56e147e69fa7a57a5201f030ac0347c9f62b545c3564e b/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/e5/34b298367f856587e56e147e69fa7a57a5201f030ac0347c9f62b545c3564e deleted file mode 100644 index 4980d9e3..00000000 --- a/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/e5/34b298367f856587e56e147e69fa7a57a5201f030ac0347c9f62b545c3564e +++ /dev/null @@ -1,2 +0,0 @@ -I"iRed Hat, the parent company of Community ENTerprise Linux Operating System (CentOS), has announced that “over the next year [they’ll] be shifting focus from CentOS Linux, the rebuild of Red Hat Enterprise Linux (RHEL), to CentOS Stream, which tracks just ahead of a current RHEL release.” This makes CentOS Stream essentially the beta version of future releases of the RHEL operating system. For those using CentOS 7, Red Hat will continue to support and update this offering throughout the rest of the RHEL 7 life cycle, ending on June 30, 2024. However, CentOS 8 support will end on December 31, 2021.
-:ET \ No newline at end of file diff --git a/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/ee/430741dc1ae0bc883e9f34a5c8f8e50a0b199c68a94f0b7b9637a931fb0b4f b/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/ee/430741dc1ae0bc883e9f34a5c8f8e50a0b199c68a94f0b7b9637a931fb0b4f deleted file mode 100644 index 8fb1c7f3..00000000 --- a/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/ee/430741dc1ae0bc883e9f34a5c8f8e50a0b199c68a94f0b7b9637a931fb0b4f +++ /dev/null @@ -1,2 +0,0 @@ -I">The purpose of this document is to outline the criteria by which CSPs are prioritized to work with the JAB toward a P-ATO, the JAB prioritization process, and the Business Case requirements for FedRAMP Connect. We ask that CSPs review this document in its entirety before beginning the FedRAMP Connect process.
-:ET \ No newline at end of file diff --git a/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/ee/e1ce643007820580d412939227a395b185ee6d039b89ef9302788a5f7fc2f8 b/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/ee/e1ce643007820580d412939227a395b185ee6d039b89ef9302788a5f7fc2f8 deleted file mode 100644 index b09088d0..00000000 --- a/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/ee/e1ce643007820580d412939227a395b185ee6d039b89ef9302788a5f7fc2f8 +++ /dev/null @@ -1,7 +0,0 @@ -I"Please take a moment to complete the FedRAMP Annual Survey for Fiscal Year (FY) 2022 and share your feedback with our team. If you’ve interacted with FedRAMP at any point in the last year, please respond to this 5 minute survey. The survey will close on Friday, September 9, 2022.
- -Collecting customer feedback is essential for FedRAMP to align our operations to customer needs. We are continuously looking for ways to improve our customer’s experience and provide stakeholders with the tools and services needed to be successful. We want your feedback on what we are doing well and what areas need improvement. The survey results will help FedRAMP to identify program changes and enhancements that better serve our customers. -We greatly value your insight and thank you in advance for your participation.
-:ET \ No newline at end of file diff --git a/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/f2/968636a6f65139216029830df9b6d5ed4453ad5932c0f2b91cd9e1d2a8b860 b/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/f2/968636a6f65139216029830df9b6d5ed4453ad5932c0f2b91cd9e1d2a8b860 deleted file mode 100644 index 79f11170..00000000 --- a/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/f2/968636a6f65139216029830df9b6d5ed4453ad5932c0f2b91cd9e1d2a8b860 +++ /dev/null @@ -1,2 +0,0 @@ -I"The FedRAMP PMO would like to thank everyone who completed the FY22 Annual FedRAMP survey this Fall. We completed an analysis of your feedback and are using the data to refine FedRAMP priorities. This feedback and engagement is critical in helping us better understand the challenges you are facing as an Agency, Cloud Service Provider, or Third Party Assessment Organization.
-:ET \ No newline at end of file diff --git a/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/f2/9f2f0085f5d54d5cc0d8ab90dc71fbfa5eec3a8cd3a03c55152ee9009bcabe b/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/f2/9f2f0085f5d54d5cc0d8ab90dc71fbfa5eec3a8cd3a03c55152ee9009bcabe deleted file mode 100644 index c15e9957..00000000 --- a/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/f2/9f2f0085f5d54d5cc0d8ab90dc71fbfa5eec3a8cd3a03c55152ee9009bcabe +++ /dev/null @@ -1,22 +0,0 @@ -I"(Congratulations to the FedRAMP Community on our 10th year anniversary as a program! What a journey it has been and we are honored that so many of you have partnered with us along the way to make FedRAMP the program it is today.
- -In 2011, the US Government recognized the need for a standard for securing cloud computing solutions. On December 8, 2011, the Office of Management and Budget (OMB) signed a memo establishing FedRAMP to provide a cost-effective, risk-based approach for the adoption and use of cloud services.
- -Over the past 10 years the program FedRAMP focused on continued evolution — from redesigning processes to increasing transparency, or re-focusing on security while streamlining documentation — all our progress is first and foremost driven by feedback from you, our community. As current Acting Director, Brian Conrad, mentioned while posting the FY21 look back, “[Behind our evolution], there is a dedicated team of professionals who are passionate about making FedRAMP the best it can be and who are collaborating with the valued industry and agency partners to protect federal information in the cloud.”
- -Over 10 years we have achieved many milestones working alongside our partners by:
-Today, our collective community includes over 180+ participating agencies, 280+ cloud service providers, and 40 recognized 3PAOs. Through this community, we’ve authorized 240 cloud service offerings and those products have been reused over 3,000 times across the federal government. Together, we’re bridging government agencies to the private sector to take advantage of modern and innovative cloud technologies.
- -As we move forward, we’ll continue to focus on our evolution and growth.
- -Thank you for all you do and we look forward to the transformation of this program over the next 10 years.
-:ET \ No newline at end of file diff --git a/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/f2/b6ea1d9bc7bb78a54149b44d20bf76e25d208fdd55b935eccf1303ae8907d1 b/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/f2/b6ea1d9bc7bb78a54149b44d20bf76e25d208fdd55b935eccf1303ae8907d1 deleted file mode 100644 index f6479bc2..00000000 --- a/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/f2/b6ea1d9bc7bb78a54149b44d20bf76e25d208fdd55b935eccf1303ae8907d1 +++ /dev/null @@ -1,2 +0,0 @@ -I"This document was developed to capture the type(s) of system changes requested and the supporting details surrounding requested system changes, including FIPS 199. It can be used to request a significant change within an existing ATO.
-:ET \ No newline at end of file diff --git a/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/f2/c5b706d8b07efc14fbfebebf08c356c1405e3e987d4d4243bd9a7eaa33199b b/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/f2/c5b706d8b07efc14fbfebebf08c356c1405e3e987d4d4243bd9a7eaa33199b deleted file mode 100644 index 5152d7d6..00000000 --- a/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/f2/c5b706d8b07efc14fbfebebf08c356c1405e3e987d4d4243bd9a7eaa33199b +++ /dev/null @@ -1,11 +0,0 @@ -I"FedRAMP recently revised training materials for the System Security Plan (SSP) Required Documentation training (200A Course). This training is designed to give Cloud Service Providers (CSPs) an understanding of security package development requirements and an overview of the required templates and supporting documentation necessary when creating a SSP.
- -This training was revised as part of FedRAMP’s role to establish a training program in the Executive Order on Improving the Nation’s Cybersecurity. FedRAMP is enhancing the training program to ensure stakeholders are effectively trained and equipped to manage FedRAMP requests, and provide improved access to training materials, including videos on demand.
- -Course Description:
- -This course provides CSPs with a deeper understanding of the detail and rigor required to complete the SSP. The SSP is the main document of a security package in which a CSP describes all of the security controls in use on the information system and their implementation. This course will familiarize CSPs with the required documentation for initial package submission and give a detailed overview of FedRAMP’s SSP template and its supporting documents.
- -For more training materials and information visit the FedRAMP Training page and the FedRAMP YouTube Channel.
- -:ET \ No newline at end of file diff --git a/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/f3/f89845e15b1982759512e93980a76813d4e0467fc765714d4c0f0062db2655 b/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/f3/f89845e15b1982759512e93980a76813d4e0467fc765714d4c0f0062db2655 deleted file mode 100644 index 0bd37931..00000000 --- a/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/f3/f89845e15b1982759512e93980a76813d4e0467fc765714d4c0f0062db2655 +++ /dev/null @@ -1,13 +0,0 @@ -I"FedRAMP recently released the updated Agency Authorization Playbook to better reflect how the initial agency authorization process has evolved. This document is a compilation of best practices, tips, and step-by-step guidance for agencies seeking to conduct initial FedRAMP Authorizations or reuse FedRAMP Authorized Cloud Service Offerings (CSOs).
- -While the Agency Authorization Playbook is written to inform federal agencies approaching the FedRAMP Authorization process, the information is helpful to all FedRAMP stakeholders.
- -Updates included information on the following:
-FedRAMP is excited to launch an Open Security Controls Assessment Language (OSCAL) Developer Data Bites series! We invite OSCAL users from Cloud Service Providers (CSPs), federal agencies, and Third Party Assessment Organizations (3PAOs) to join us and take part in discussions with our FedRAMP OSCAL team.
-:ET \ No newline at end of file diff --git a/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/f4/868eb1a8bc82277421bd1e1dd4faa1aacbfe2293e854ce65be6bc0d08e657d b/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/f4/868eb1a8bc82277421bd1e1dd4faa1aacbfe2293e854ce65be6bc0d08e657d deleted file mode 100644 index f1178083..00000000 --- a/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/f4/868eb1a8bc82277421bd1e1dd4faa1aacbfe2293e854ce65be6bc0d08e657d +++ /dev/null @@ -1,2 +0,0 @@ -I"FedRAMP uses the National Institute of Standards and Technology’s (NIST) guidelines and procedures to provide standardized security requirements for cloud services. Specifically, FedRAMP leverages NIST’s Special Publication (SP) 800-53 - Security and Privacy Controls for Federal Information Systems and Organizations series, including the baselines and test cases.
-:ET \ No newline at end of file diff --git a/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/fb/ebc152ed859f78cc1742f30a1bce0c1af10b4c57bbb188ea453352680647c5 b/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/fb/ebc152ed859f78cc1742f30a1bce0c1af10b4c57bbb188ea453352680647c5 deleted file mode 100644 index 03397564..00000000 --- a/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/fb/ebc152ed859f78cc1742f30a1bce0c1af10b4c57bbb188ea453352680647c5 +++ /dev/null @@ -1,2 +0,0 @@ -I"}John Hamilton is Federal Risk and Authorization Management Program’s (FedRAMP) Program Manager of Security Operations. In this role, he works to ensure effective day-to-day operations of the FedRAMP Program Management Office (PMO)’s Readiness Assessment Review (RAR) process, public-facing website, customer mailbox, and secure repository. He also coordinates with FedRAMP’s Joint Authorization Board (JAB) and independent assessor accreditation body (A2LA) to ensure provisionally authorized Cloud Service Providers (CSPs) and Third Party Assessment Organizations (3PAOs) meet FedRAMP performance standards and guidelines.
-:ET \ No newline at end of file diff --git a/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/fc/2f2b744c02ac3efbc51037a0021e07a9e301f0b587ffa28ce666861355b113 b/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/fc/2f2b744c02ac3efbc51037a0021e07a9e301f0b587ffa28ce666861355b113 deleted file mode 100644 index ee3cb0e3..00000000 --- a/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/fc/2f2b744c02ac3efbc51037a0021e07a9e301f0b587ffa28ce666861355b113 +++ /dev/null @@ -1,2 +0,0 @@ -I"FedRAMP recently updated the 3PAO Obligations and Performance Standards document to provide additional clarity and guidance to 3PAOs. This document shares comprehensive information about the 3PAO program, the accreditation standards, and the performance standards a FedRAMP 3PAO must follow to maintain good standing.
-:ET \ No newline at end of file diff --git a/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/fd/5bc28712ddf5ccd30c8a302a43d1253d9719726c046dbde655bfe2ceea1ccc b/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/fd/5bc28712ddf5ccd30c8a302a43d1253d9719726c046dbde655bfe2ceea1ccc deleted file mode 100644 index 14361752..00000000 --- a/.jekyll-cache/Jekyll/Cache/Jekyll--Converters--Markdown/fd/5bc28712ddf5ccd30c8a302a43d1253d9719726c046dbde655bfe2ceea1ccc +++ /dev/null @@ -1,2 +0,0 @@ -I"This document captures FedRAMP’s experience with redesigning its JAB Authorization process based on stakeholder feedback and shares its insights on creating change within the Government.
-:ET \ No newline at end of file