Page Info
Description: An explanation of what Independent Assessors are, why this term is used instead of 3PAOs now, and the general role of the assessor as now performing independent verification and validation.
Purpose: Folks know why it's IAS instead of 3PAO and how to dig into this section.
Independent Assessment Services¶
FedRAMP relies on independent assessment services (also known as independent assessors, formerly referred to as Third-Party Assessment Organizations or 3PAOs) to scale initial assessment capabilities based on industry need instead of directly operating an end-to-end assessment organization within FedRAMP itself. Relying on third-parties that are contracted by cloud service providers reduces cost for taxpayers by placing the burden for initial assessment on the cloud service provider.
This section helps independent assessment services understand the expectations for their participation in the FedRAMP Certification process.
FedRAMP only accepts independent assessments that have been performed by FedRAMP Recognized independent assessment services.
FedRAMP Recognized independent assessment services can be found in the FedRAMP Marketplace.
-
Need support?
Learn how to get involved with the FedRAMP Community and what kind of support FedRAMP offers in public vs in private.
-
Been here awhile?
Things are changing and you'll need to do things differently from here on out.
-
FedRAMP 20x Rules!
The expectations for independent verification and validation under FedRAMP 20x are very different from Rev5, requiring different skills and a new approach.
-
FedRAMP Rev5
FedRAMP Rev5 isn't new but the expectations for independent verification and validation have still shifted and you'll need to review the rules.