As the new revision of R311 - Specific Requirements - Federal Risk and Authorization Management Program FedRAMP has been released and your 3PAO is not scheduled to have an assessment for the next 4 months, we ask that you provide evidence of your compliance to the new clauses below, no later than April 22, 2017. Failure to return this information WILL result in adverse accreditation actions, such as suspension of accreditation until compliance with the updated requirements can be confirmed. Please let us know if you have any questions. The submission should be directed to with your 3PAO’s Master Code and Certificate Number in the subject line. 4.9 If your 3PAO has not performed any FedRAMP assessments since the previous A2LA onsite assessment, the 3PAO must: 4.9.1 Provide evidence that its organization has individuals on staff that are knowledgeable of FedRAMP assessments (and assessments that are similar in scope, such as cloud assessments, cybersecurity assessments and other risk assessments). 4.9.3 Provide resumes of all FedRAMP designated assessors. 4.9.4 Provide evidence that all assessors have completed the required training. 4.9.5 Provide evidence that their Quality Management system is still effectively operating. 6.1.2 F.1 Identify any/all staff (by name) who could comprise the core members of your FedRAMP assessment team (add lines as necessary): Senior Representative Penetration Tester Quality Management Representative 6.1.5 F.1 Provide a summary list of all training courses (planned for the year) and a statement of how that training is related to FISMA, cloud computing, FedRAMP and cyber security. IB1 F.1 Provide evidence that any subcontractors being used for multiple engagements are included in an updated Inspector Witnessing Plan. 6.1.10 F.2 Provide training records for all staff who have been or could be involved (including subcontractors) with the FedRAMP assessments over the past year. 6.2.2 F.1
As the new revision of R311 - Specific Requirements - Federal Risk and Authorization Management Program FedRAMP has been released and your 3PAO is not scheduled to have an assessment for the next 4 months, we ask that you provide evidence of your compliance to the new clauses below, no later than April 22, 2017. Failure to return this information WILL result in adverse accreditation actions, such as suspension of accreditation until compliance with the updated requirements can be confirmed. Please let us know if you have any questions. The submission should be directed to with your 3PAO’s Master Code and Certificate Number in the subject line. 4.9 If your 3PAO has not performed any FedRAMP assessments since the previous A2LA onsite assessment, the 3PAO must: 4.9.1 Provide evidence that its organization has individuals on staff that are knowledgeable of FedRAMP assessments (and assessments that are similar in scope, such as cloud assessments, cybersecurity assessments and other risk assessments). 4.9.3 Provide resumes of all FedRAMP designated assessors. 4.9.4 Provide evidence that all assessors have completed the required training. 4.9.5 Provide evidence that their Quality Management system is still effectively operating. 6.1.2 F.1 Identify any/all staff (by name) who could comprise the core members of your FedRAMP assessment team (add lines as necessary): Senior Representative Penetration Tester Quality Management Representative 6.1.5 F.1 Provide a summary list of all training courses (planned for the year) and a statement of how that training is related to FISMA, cloud computing, FedRAMP and cyber security. IB1 F.1 Provide evidence that any subcontractors being used for multiple engagements are included in an updated Inspector Witnessing Plan. 6.1.10 F.2 Provide training records for all staff who have been or could be involved (including subcontractors) with the FedRAMP assessments over the past year. 6.2.2 F.1
A2LA_F311b.docx