The FISMA Focus IPD

From: FedRAMP

FedRAMP is requesting feedback on an updated, DRAFT version of the 3PAO Accreditation Requirements. This DRAFT updates FedRAMP’s current 3PAO requirements which originated in 2010. As a growing program, FedRAMP has recognized the need to update these requirements to improve the quality of 3PAO assessment documentation, assessment team training, and oversight of accredited organizations. Once finalized, these requirements will be used by the American Association of Laboratory Accreditors (A2LA) to review 3PAO applicants and evaluate currently accredited 3PAOs for inclusion within the FedRAMP 3PAO Program.

The PMO will host a webinar on July 28th from 11 am to 12 pm EST on the DRAFT FedRAMP 3PAO Accreditation Requirements. Please register to participate and learn more about what new changes have been made.

An updated DRAFT of the requirements has been developed as part of the FedRAMP Forward strategic initiative to enhance the consistency and quality of 3PAO assessments and deliverables. The new requirements include the following sections:

1. Guiding Principles

• Assessments must be impartial
• Oversight of assessment must be impartial

2. 3PAO Resource Requirements

• Must have a minimum of three resources on an assessment team
• Must have a senior representative on an assessment team

3. Protection of Sensitive Info

• Must protect CSP information
• Must have related policies and procedures in place
• Must not submit actual CSP records to A2LA

4. Training

• Must take mandatory FedRAMP PMO training
• Training must include topics on FISMA, FedRAMP, and cloud technologies
• Training records must list organization that provided training
• Training records must be submitted during annual review

5. Quality Control

• Accountability for each section of SAR is required
• Quality review of all documents must be performed before delivery to CSP
• After Action Report is required for each assessment
• 3PAO must request that CSP to evaluate its work

6. Assessment Report Requirements

• All SARs must include authorization recommendation
• All SARs must include readable scan reports

FedRAMP is seeking comments on this DRAFT requirements document. The 30 day open comment period is from July 22, 2015 to August 20, 2015. Please send all suggestions and changes to info@fedramp.gov with the subject line: “Draft 3PAO Accreditation Requirements Feedback”.

Documents for Review

1. Draft FedRAMP Third Party Assessment Organization (3PAO) Accreditation Requirements

Document Feedback

1. Draft FedRAMP Third Party Assessment Organization (3PAO) Accreditation Requirements Comment Template

Please use this template to provide comments and suggestions on improving the Draft FedRAMP Third Party Assessment Organization (3PAO) Accreditation Requirements document. For instructions on how to populate this template, refer to page 1 of the template, “How to Populate Draft FedRAMP Third Party Assessment Organization (3PAO) Accreditation Requirements Comment Template”.