Adds a unique or alternative implementation of any of the security controls as these are captured in the System Security Plan, this is a Significant Change and must be added to the system via the FedRAMP Significant Change process or during the next annual assessment. The 3PAO should consider the following for dialogue, when evaluating the overall readiness of a Cloud Service Offering feature or service to be onboarded: Overall alignment of the new feature or service with the FedRAMP and National Institute of Science and Technology (NIST) definition of cloud computing, according to NIST SP 800-145 Whether the feature or service remediates and/or introduces mitigations to current vulnerabilities Observed strengths and weaknesses of the service or feature implementation Clearly defined CSP and customer responsibilities related to the new service/feature within the system to which it is being added Overall maturity level relative to the system type, size, and complexity and how that relates to the new service onboarding. IMPORTANT: For this new Cloud Service Offering Onboarding effort, it is imperative that the new feature or service to be onboarded lies within the <Cloud Service Offering Name> authorization boundary. Inaccuracies regarding the new feature or service onboarding within the New Cloud Service Offering Onboarding Feature Request may give authorizing officials and FedRAMP grounds for disallowing any further services onboarding, removing a vendor from FedRAMP, and disciplinary actions initiated against the 3PAO as per the guidelines set by FedRAMP. Document Revision History Date Page(s) Description Author
Adds a unique or alternative implementation of any of the security controls as these are captured in the System Security Plan, this is a Significant Change and must be added to the system via the FedRAMP Significant Change process or during the next annual assessment. The 3PAO should consider the following for dialogue, when evaluating the overall readiness of a Cloud Service Offering feature or service to be onboarded: Overall alignment of the new feature or service with the FedRAMP and National Institute of Science and Technology (NIST) definition of cloud computing, according to NIST SP 800-145 Whether the feature or service remediates and/or introduces mitigations to current vulnerabilities Observed strengths and weaknesses of the service or feature implementation Clearly defined CSP and customer responsibilities related to the new service/feature within the system to which it is being added Overall maturity level relative to the system type, size, and complexity and how that relates to the new service onboarding. IMPORTANT: For this new Cloud Service Offering Onboarding effort, it is imperative that the new feature or service to be onboarded lies within the <Cloud Service Offering Name> authorization boundary. Inaccuracies regarding the new feature or service onboarding within the New Cloud Service Offering Onboarding Feature Request may give authorizing officials and FedRAMP grounds for disallowing any further services onboarding, removing a vendor from FedRAMP, and disciplinary actions initiated against the 3PAO as per the guidelines set by FedRAMP. Document Revision History Date Page(s) Description Author
FedRAMP-New-Service-Onboarding-Request-V2.0.docx