FedRAMP FedRAMP Authorization Process & Documentation

Question 1

Which document serves as the primary artifact that describes a cloud system's security controls and how they are implemented for FedRAMP authorization?

Accepted Answer

System Security Plan (SSP)

Answer

Plan of Action and Milestones (POA&M)

Answer

Security Assessment Report (SAR)

Answer

Authorization to Operate (ATO)

Question 2

What is the primary purpose of a Plan of Action and Milestones (POA&M) in the FedRAMP process?

Accepted Answer

To document and track remediation of identified security weaknesses

Answer

To authorize a system to operate in a federal environment

Answer

To describe the cloud service provider's business continuity plan

Answer

To list all authorized users of the cloud system

Question 3

In the FedRAMP authorization process, who issues the final Authorization to Operate (ATO)?

Accepted Answer

An Authorizing Official (AO) at the sponsoring federal agency

Answer

The FedRAMP Program Management Office (PMO)

Answer

A Third-Party Assessment Organization (3PAO)

Answer

The cloud service provider's CISO

Question 4

What does the FedRAMP 'Ready' designation indicate about a cloud service offering?

Accepted Answer

The CSP has demonstrated basic security capabilities and is ready to pursue full authorization

Answer

The CSP has received a full Authorization to Operate

Answer

The CSP has passed all 3PAO security tests

Answer

The CSP is approved for use across all federal agencies

Question 5

Which FedRAMP authorization path allows a Cloud Service Provider to pursue authorization sponsored directly by the FedRAMP PMO rather than a single agency?

Accepted Answer

FedRAMP JAB Provisional Authorization

Answer

FedRAMP Agency Authorization

Answer

FedRAMP Tailored Authorization

Answer

FedRAMP Ready Designation

Question 6

What is the maximum acceptable risk level for a cloud system to receive a FedRAMP High baseline authorization?

Accepted Answer

No unmitigated critical or high risks; moderate risks must be accepted

Answer

No unmitigated risks of any kind are permitted

Answer

Up to 10 high risks and unlimited moderate risks

Answer

High risks are acceptable if offset by compensating controls