Marketplace

JAB Authorization: FedRAMP Connect and FedRAMP In Process

The JAB prioritizes up to 12 CSOs each year to work towards FedRAMP Authorization. Each CSP must go through a process called “FedRAMP Connect” wherein they submit a business case that provides detailed product information and government-wide demand. The criteria for business cases and evaluation are described in detail within the JAB Prioritization Criteria and Guidance document.

Prior to being listed as FedRAMP In Process on the Marketplace for a JAB P-ATO, a CSP must:

• Achieve FedRAMP Ready within 60 days of being prioritized by the JAB
• Finalize the CSO’s System Security Plan (SSP)
• Engage a FedRAMP recognized 3PAO to develop a Security Assessment Plan (SAP), conduct a full security assessment, and produce a Security Assessment Report (SAR)
• Upload all required security package materials to MAX.gov (a federal document repository) for systems Authorized at the Moderate baseline, or to their own repository if the system is Authorized at the High baseline
• Participate in a formal Kickoff Meeting with the JAB, PMO, and partnering 3PAO

Completion of the Kickoff Meeting will result in a “go” / “no-go” decision point for JAB Authorization efforts. If a CSP achieves a “go” decision, the partnership with the JAB for a P-ATO may proceed, and the CSO will be listed as FedRAMP In Process (In JAB Review) on the FedRAMP Marketplace.

Agency Authorization: FedRAMP In Process Requirements

In order to be listed as FedRAMP In Process with a federal agency, a CSP must:

1. Obtain written confirmation of the agency’s intent to authorize (In Process Request)
2. Submit a completed Work Breakdown Structure (WBS) to the PMO that aligns with timeline requirements
3. Confirm the system is fully operational (The FedRAMP PMO defines “fully operational” as being in a production environment and is assessment ready.)
4. Fulfill at least one of four additional requirements listed below

In Process Request Email - Required Information

The In Process Request (IPR) serves as formal notice that an agency is partnering with a federal agency for initial FedRAMP Authorization. To initiate FedRAMP In Process, the FedRAMP PMO must be in receipt of an email or letter from (or including) an Agency Authorizing Official (AO) that states:

1. The CSP name
2. The CSO name
3. The impact level (e.g., Low, Moderate, or High) at which the agency will authorize the service offering
4. The agency and CSP points of contact who will work with FedRAMP during the authorization process
5. Confirmation that the full 3PAO assessment is planned to begin no more than six (6) months from the date of the In Process Request (include the assessment start date if it has been scheduled)
6. An attestation that the partnering agency is actively working with the CSP to grant an Authorization to Operate (ATO) within 12 months of the In Process designation

In addition to the In Process Request, a CSP and agency should submit a Work Breakdown Structure and fulfill one of the four additional requirements listed below.

Work Breakdown Structure

CSPs must work with their agency partner and 3PAO to complete a Work Breakdown Structure (WBS) and submit to the PMO prior to achieving FedRAMP In Process. The WBS is used to validate the assessment timeline requirement and the 12-month ATO requirement listed above. Submitting a WBS creates shared visibility into the anticipated timeline to completion for key project milestones.

The FedRAMP PMO will provide CSPs and agencies with a WBS template at the beginning of the CSP intake process, or when an In Process Request email is sent to the PMO.

Additional Requirements

One of the following additional requirements must be met for a CSP to be listed on the FedRAMP Marketplace as FedRAMP In Process:

1. The agency provides proof of a contract award for the use of the CSO
2. The agency and CSP demonstrate use of the service offering to the PMO Note: An email from the Agency AO stating the instance of the CSO undergoing Authorization is being used by the agency will meet this requirement
3. The CSO is currently listed as FedRAMP Ready on the Marketplace
4. Completion of a formal FedRAMP facilitated Kickoff Meeting that includes the agency, CSP, FedRAMP PMO, and, if applicable, 3PAO

Kickoff Meetings

The purpose of the Kickoff Meeting is to formally begin the agency authorization process by introducing key team members, reviewing the Cloud Service Offering, and ensuring all stakeholders are aligned on the overall process. Kickoffs are meant to be in service of the CSP and Agency partnership. While a CSP may achieve In Process through other means, the PMO strongly encourages CSPs and agencies to conduct a Kickoff Meeting as outlined in the Agency Authorization Playbook.

Change in Initial Agency Partner or Authorizing Official

If a CSP changes agency partners during the initial authorization, the requirements listed above must be followed by the new agency. Upon fulfillment of the requirements, the Marketplace listing will be updated to include the new agency and FedRAMP In Process date. If the Agency AO changes while a CSP is listed as In Process, the FedRAMP PMO must be notified within 30 days and must receive a new In Process Request notification from the new AO.

Questions Regarding In Process Timeline

The FedRAMP Marketplace displays the date a CSO was listed as In Process with the JAB or an agency. Questions regarding the status or progress toward FedRAMP Authorization for a FedRAMP In Process CSO should be directed to the CSP’s email address listed on their Marketplace page, or info@fedramp.gov.

Department of Defense Requirements

CSPs pursuing initial authorization with a Department of Defense (DoD) component agency at DoD IL-2 may work towards initial FedRAMP Authorization at the Moderate baseline. The service offering must be configured as a multi-tenant environment that is capable of hosting any federal agency customer. Service offerings that are built for DoD-only use may not achieve initial authorization via FedRAMP, and instead should work with the Defense Information Systems Agency (DISA) for initial authorization. Additionally, CSPs pursuing initial authorization with DoD component agencies at DoD IL-4 or higher must first authorize their CSO via DISA. More information can be found within the Cloud Computing Security Requirements Guide and the DoD Cloud Authorization Services (DCAS) website (CAC required). If you have questions, please reach out to DISA’s hotline mailbox: disa.meade.re.mbx.cloud-team@mail.mil.

CSPs pursuing DISA authorization may be listed on the FedRAMP Marketplace as In Process by fulfilling FedRAMP’s agency In Process requirements listed on the previous section.