Skip to main content

FedRAMP Business Cases for JAB Prioritization Now Due December 30th

Over the last week, we have collected excellent feedback relating to the FedRAMP Business Cases for JAB Prioritization from CSPs, 3PAOs and Agencies. THANK YOU!

Based on what we heard, the due date for FedRAMP Business Cases is extended to December 30th, 2016. We will be providing a full FAQ sheet for the JAB P-ATO prioritization process and FedRAMP Business Case within the next week; in the meantime we wanted to answer and share some of the questions we have received

Question:

Given anticipated capacity of 12 JAB P-ATO certifications per year, how many CSPs will be prioritized by the panel every six months and when will this prioritization happen?

Answer:

Six CSPs will be prioritized twice per year (every six months). The first set of six CSPs will be prioritized in early 2017. The second round of prioritization will happen in the summer of 2017.

Question:

After a CSP submits a FedRAMP Business Case, is there anything that would preclude a CSP from being considered for prioritization?

Answer:

All of the submitted FedRAMP Business Cases will be reviewed and considered for JAB prioritization. There is no element of the FedRAMP Business Case that would disqualify a CSP for prioritization, except for an empty Current and Future Demand section (page 8-10).

Question:

After a CSP has submitted their FedRAMP Business Case, what are the next steps?

Answer:

Once the FedRAMP PMO has received a FedRAMP Business Case from a CSP via info@fedramp.gov, the CSP will receive a confirmation of receipt e-mail from the FedRAMP PMO. In early 2017, the FedRAMP Business Cases will be reviewed by the prioritization panel consisting of representatives from the JAB, CIO Council, and the FedRAMP PMO. The FedRAMP PMO will work with CSPs as necessary to prepare them for this business case review.

Question:

What if the vendor has an offering that isn’t currently used by 4 agencies, but is an offering that could be of interest to 4 or more agencies?

Answer:

Part of demand is current customers and part is potential agency use. The FedRAMP Business Case Template provides an area to show all types of demand.

Question:

If a vendor has a system that is currently writing up it’s Readiness Assessment Report (RAR), but is not yet deemed FedRAMP Ready, do we need to submit the FedRAMP Business Case at the same time as the RAR?

Answer:

The RAR and FedRAMP Business Case submissions should be treated as two separate deliverables. CSPs do not have to be FedRAMP Ready to submit a FedRAMP Business Case on December 30th. However, FedRAMP Ready will be heavily weighted among all preferences for JAB prioritization and is highly encouraged. If a CSP is prioritized that is not FedRAMP Ready, the CSP will have 60 days after prioritization to be deemed FedRAMP Ready by the PMO and a CSP must be FedRAMP Ready to kick-off with the JAB. The FedRAMP PMO will take into consideration changes in a CSP’s FedRAMP Ready status up until the prioritization decision in early 2017.

Please read our November 10th blog on the FedRAMP JAB Prioritization Criteria or Process for more information and feel free to submit any questions you have to info@fedramp.gov.

Page of