FedRAMP FedRAMP Authorization Process & Documentation 2

Question 1

Which NIST publication provides the core security control catalog used as the foundation for FedRAMP security requirements?

Accepted Answer

NIST SP 800-53

Answer

NIST SP 800-53 (Security and Privacy Controls for Information Systems) is the foundational control catalog for FedRAMP.

Question 2

What is the FedRAMP 'Marketplace' and what is its primary function?

Accepted Answer

A public directory of authorized FedRAMP cloud services available for agency use

Answer

The FedRAMP Marketplace is a publicly searchable directory listing all authorized cloud services, their status, and authorization details.

Question 3

How long is a FedRAMP authorization valid before it must be re-authorized or reaffirmed?

Accepted Answer

Indefinitely, as long as continuous monitoring requirements are met

Answer

FedRAMP authorizations do not expire on a fixed schedule; they remain valid as long as the CSP meets continuous monitoring and reporting requirements.

Question 4

What must a Cloud Service Provider submit to initiate the FedRAMP Agency Authorization process?

Accepted Answer

A completed SSP, SAP, and evidence of a federal agency sponsor

Answer

To initiate agency authorization, a CSP needs a completed SSP, a Security Assessment Plan, and a federal agency willing to sponsor and fund the authorization.

Question 5

In FedRAMP documentation, what is the purpose of the Control Implementation Summary (CIS)?

Accepted Answer

To provide a high-level matrix of which controls are implemented by the CSP vs. the customer

Answer

The CIS is a matrix that shows the implementation status and responsibility (CSP, customer, or shared) for each FedRAMP security control.

(FedRAMP) Federal Risk and Authorization Management Program Certified Practice Test

(FedRAMP) Federal Risk and Authorization Management Program Certified Practice Test

FedRAMP FedRAMP Authorization Process & Documentation 2