The assessment Team Lead has established a repository in eMass for the assessment artifacts (and placed the documentation received to date) in the repository Exit criteria The CSP and FSO Team agree that the SSP Addendum is complete and can therefore be used as the basis for review and testing Support review of existing FedRAMP documentation: Description: The FSO team assessors review and analyze the FedRAMP SSP and the associated artifacts from the 3PAO involved. In addition, the assessors review the Security Assessment Report (SAR) and the resulting Program of Actions and Milestones (POA&M) for the determination of risk per the FedRAMP process as it relates to DoD The assessors generally trust the results of the 3PAO in this analysis. However, the assessors consider the actions and conclusions as they relate to DoD needs and so questions may arise. Of particular interest will likely be system scans and vulnerability analysis. Milestones/artifacts: The FSO assessment team has requested specific artifacts from past assessments as well as any updates the assessment (e.g. POA&M updates detailed testing info). The CSP has provided the requested artifacts. This may be obtained from the FedRAMP repository or from the CSP (including the 3PAO). The FSO has completed the analysis of FedRAMP materials for risk to DoD environments, identifying additional artifacts or materials needed Exit criteria: Completion of FSO assessment of FedRAMP materials in DRAFT Interim Certification Recommendation and identification of further materials needed to complete DoD overlay requirements Support FSO Assessor review of the provided DoD SSP Errata: Description: The assessors review and analyze the provided Errata for compliance with the additional controls. There may be iterative technical exchanges via teleconference or meetings if questions arise during this process if clarification is needed. Milestones/artifacts: CSP provides all requested additional material and artifacts FSO Assessment team completes(draft) risk report based on documentation, including any recommended adjustment of risk from the FedRAMP assessment Exit criteria FSO Assessment team completes verification/test plan based on the information in the documentation. This plan identifies some security controls to investigate further, either via meetings (either during a site visit or telephone conferencing) or through direct inspection or testing.
The assessment Team Lead has established a repository in eMass for the assessment artifacts (and placed the documentation received to date) in the repository Exit criteria The CSP and FSO Team agree that the SSP Addendum is complete and can therefore be used as the basis for review and testing Support review of existing FedRAMP documentation: Description: The FSO team assessors review and analyze the FedRAMP SSP and the associated artifacts from the 3PAO involved. In addition, the assessors review the Security Assessment Report (SAR) and the resulting Program of Actions and Milestones (POA&M) for the determination of risk per the FedRAMP process as it relates to DoD The assessors generally trust the results of the 3PAO in this analysis. However, the assessors consider the actions and conclusions as they relate to DoD needs and so questions may arise. Of particular interest will likely be system scans and vulnerability analysis. Milestones/artifacts: The FSO assessment team has requested specific artifacts from past assessments as well as any updates the assessment (e.g. POA&M updates detailed testing info). The CSP has provided the requested artifacts. This may be obtained from the FedRAMP repository or from the CSP (including the 3PAO). The FSO has completed the analysis of FedRAMP materials for risk to DoD environments, identifying additional artifacts or materials needed Exit criteria: Completion of FSO assessment of FedRAMP materials in DRAFT Interim Certification Recommendation and identification of further materials needed to complete DoD overlay requirements Support FSO Assessor review of the provided DoD SSP Errata: Description: The assessors review and analyze the provided Errata for compliance with the additional controls. There may be iterative technical exchanges via teleconference or meetings if questions arise during this process if clarification is needed. Milestones/artifacts: CSP provides all requested additional material and artifacts FSO Assessment team completes(draft) risk report based on documentation, including any recommended adjustment of risk from the FedRAMP assessment Exit criteria FSO Assessment team completes verification/test plan based on the information in the documentation. This plan identifies some security controls to investigate further, either via meetings (either during a site visit or telephone conferencing) or through direct inspection or testing.
U_CSM_level_2_saas_template.docx