that they have communicated with the applicable POC of the leveraged system to determine the current status of remediation of those risks at least every 30 days. Consider the following example: The IaaS CSP currently has only implemented FedRAMP NIST SP 800-53, revision 3 requirements. The SaaS leveraging the IaaS has implemented FedRAMP NIST SP 800-53, revision 4. During the assessment of the SaaS, it was determined that the leveraged IaaS had not transitioned to implementation of FedRAMP NIST SP 800-53, revision 4. To be compliant, the SaaS CSP must have the following: Have a SAR that identifies the gaps in the inherited controls (gaps from Rev. 3 to Rev. 4) The SaaS POA&M must track these deficiencies These findings are identified as The SaaS CSP must verify the “Vendor Dependencies”. status of these deficiencies every 30 days and document the status in the POA&M The SaaS SSP must reflect these inherited controls are partially implemented or planned based on the SAR findings The SaaS SSP text for these inherited controls must include full implementation “Pending and testing by <CSP/System Name>” Closure of these POA&Ms can occur once the leveraged IaaS CSP meets the FedRAMP NIST SP 800-53, revision 4 requirements and has fully and successfully tested the implementation of these controls The preceding is only an example. It does not imply the requirements only apply to SaaS providers. Similar requirements apply whenever a CSP claims vendor dependency as the reason for an open POA&M item. During the annual assessment, the 3PAO verifies the applicable requirements are met.
that they have communicated with the applicable POC of the leveraged system to determine the current status of remediation of those risks at least every 30 days. Consider the following example: The IaaS CSP currently has only implemented FedRAMP NIST SP 800-53, revision 3 requirements. The SaaS leveraging the IaaS has implemented FedRAMP NIST SP 800-53, revision 4. During the assessment of the SaaS, it was determined that the leveraged IaaS had not transitioned to implementation of FedRAMP NIST SP 800-53, revision 4. To be compliant, the SaaS CSP must have the following: Have a SAR that identifies the gaps in the inherited controls (gaps from Rev. 3 to Rev. 4) The SaaS POA&M must track these deficiencies These findings are identified as “Vendor Dependencies”. The SaaS CSP must verify the status of these deficiencies every 30 days and document the status in the POA&M The SaaS SSP must reflect these inherited controls are partially implemented or planned based on the SAR findings The SaaS SSP text for these inherited controls must include “Pending full implementation and testing by <CSP/System Name>” Closure of these POA&Ms can occur once the leveraged IaaS CSP meets the FedRAMP NIST SP 800-53, revision 4 requirements and has fully and successfully tested the implementation of these controls The preceding is only an example. It does not imply the requirements only apply to SaaS providers. Similar requirements apply whenever a CSP claims vendor dependency as the reason for an open POA&M item. During the annual assessment, the 3PAO verifies the applicable requirements are met.
FedRAMP-Annual-Assessment-Guidance.docx