FedRAMP Business Case Tips!
As the August 25th due date for the FedRAMP Business Case approaches, we have been receiving some questions from Cloud Service Providers (CSPs) about how to best prove their demand , which is the most heavily weighted criteria for prioritization. There are several ways to prove demand for your Cloud Service Offering (CSO) when completing your FedRAMP Business Case:
Current Government Customers: Upload a list of current customers and the contract information (name, number, period of performance) and government point of contact for your work. We will not contact your customers without letting you know and receive your permission first. You can also upload copies of emails to your Business Case or have your current customers email us directly at firstname.lastname@example.org verifying that they do use your CSO. Both of these forms of verification are equally acceptable.
Current Government Customers Using the On-premise Version of your CSO: Uploading a copy of an email to the Business Case or having your current on-premise customers email us directly at email@example.com verifying that they do use your service and would be potentially interested in moving to the cloud if your CSO obtained a FedRAMP Authorization. This is not binding in any way and requires no commitment from your customer to move.
Potential Federal Agency Customers: Uploading a copy of an e-mail to the Business Case or having a potential customers email us directly at firstname.lastname@example.org verifying that they are actively interested in your CSO and would be potentially interested in acquiring your services if the CSO obtained a FedRAMP Authorization. This is not binding in any way and requires no commitment from them.
In order for CSPs to know the basic information we would like to see in the demand verifications, we developed sample letters for your reference which can be found in the appendix of the JAB Prioritization Guidance. Please use these as your guide for what to request from your current and potential customers when verifying their demand.
We understand that your current and potential government customers are busy and you may feel uncomfortable asking them to provide these emails. The FedRAMP PMO is here to support you and is happy to participate in a call with your current or potential customers or send them an email directly confirming that this verification does not bind them in any way in is just proof of current or potential use.
We have also been receiving questions about how much demand CSPs need to prove. The FedRAMP PMO recommends that you provide as much proof as possible to bolster your Business Case. For evaluation purposes, we will only be able to consider customers we have verification from. For example, if you say you have 20 potential customers in your Business Case, but we only receive proof of demand from 6 customers via your uploads in the Business Case form and email@example.com, we would evaluate your potential demand at 6.
To give you a frame of reference on the amount of demand we’d like to see, in the last round of FedRAMP Connect five of the CSPs that were prioritized had significantly proven current demand with an average of 10 current customers for their CSO. Two CSPs had significantly proven potential demand with high state and local use, averaging at 15, and relevant RFI responses/potential demand, averaging at 12. Combined, all of the CSPs that were prioritized showed an average of 14 potential customers.
As you and your team continue to work on your FedRAMP Business Case, please feel free to reach out to us at firstname.lastname@example.org if you have any questions or if you would like set up a call with the FedRAMP PMO to discuss your case and receive feedback. We are also available to speak with you about your demand verification and troubleshoot how to prove your demand if you’re having a difficult time receiving responses from your government contacts.
For more context on FedRAMP Connect, please make sure to review our previous blog post on the updated FedRAMP Connect Process and it’s related blogs, as well as our JAB Prioritization Guidance. We look forward to reviewing your business cases and if you have any questions, please do not hesitate to reach out to email@example.com.