CSPs many times buy products or services and incorporates these in to their cloud environment to deliver their services. Many times risks can be related to these products and services and these risks are are considered “vendor dependant.” Risks only considered vendor dependencies when remediating vulnerabilities within a product or service is not allowed by the vendor (e.g. it would void the warranty). All vendor dependencies at a high risk level must be mitigated to a moderate through compensating controls within 30 days. Vendor dependencies at the low and moderate level require CSPs to be in contact with their vendors at a minimum of a monthly basis to ensure there are no updates that would remediate the known vulnerabilities. If a CSP contacts their vendors and provides evidence with their monthly deliverables of this contact regarding any fixes to the open vulnerabilities, then a vendor dependency is not considered a late POA&M. Operational requirements exist only for vulnerabilities where the ability to remediate a vulnerability does not exist or remediating a vulnerability is not supported if the vulnerability is vendor dependent. Attached you will find the Monthly Reporting Summary the FedRAMP PMO uses to highlight key considerations for review to the JAB on a monthly basis for each CSP that achieves a P-ATO. In this template you will see: System Status Overview Unique Scanning Summary Raw Scanning Summary Open POA&M Summary Items of Note Considerations for Review Additional Information Requested Deviation Details
CSPs many times buy products or services and incorporates these in to their cloud environment to deliver their services. Many times risks can be related to these products and services and these risks are considered “vendor dependant.” Risks are only considered vendor dependencies when remediating vulnerabilities within a product or service is not allowed by the vendor (e.g. it would void the warranty). All vendor dependencies at a high risk level must be mitigated to a moderate through compensating controls within 30 days. Vendor dependencies at the low and moderate level require CSPs to be in contact with their vendors at a minimum of a monthly basis to ensure there are no updates that would remediate the known vulnerabilities. If a CSP contacts their vendors and provides evidence with their monthly deliverables of this contact regarding any fixes to the open vulnerabilities, then a vendor dependency is not considered a late POA&M. Operational requirements exist only for vulnerabilities where the ability to remediate a vulnerability does not exist or remediating a vulnerability is not supported if the vulnerability is vendor dependent. Attached you will find the Monthly Reporting Summary the FedRAMP PMO uses to highlight key considerations for review to the JAB on a monthly basis for each CSP that achieves a P-ATO. In this template you will see: System Status Overview Unique Scanning Summary Raw Scanning Summary Open POA&M Summary Items of Note Considerations for Review Additional Information Requested Deviation Details
FedRAMP-Continuous-Monitoring-Strategy-Guide-v2.0-3.docx