FedRAMP FedRAMP Authorization Process & Documentation

Question 1

Which document serves as the primary artifact that describes a cloud system's security controls and how they are implemented for FedRAMP authorization?

Accepted Answer

System Security Plan (SSP)

Answer

The System Security Plan (SSP) is the central FedRAMP document that describes all security controls and their implementation for a cloud system.

Question 2

What is the primary purpose of a Plan of Action and Milestones (POA&M) in the FedRAMP process?

Accepted Answer

To document and track remediation of identified security weaknesses

Answer

A POA&M tracks identified security weaknesses, their remediation plans, and milestone dates for resolution.

Question 3

In the FedRAMP authorization process, who issues the final Authorization to Operate (ATO)?

Accepted Answer

An Authorizing Official (AO) at the sponsoring federal agency

Answer

The Authorizing Official (AO) at the sponsoring federal agency is responsible for issuing the final ATO decision.

Question 4

What does the FedRAMP 'Ready' designation indicate about a cloud service offering?

Accepted Answer

The CSP has demonstrated basic security capabilities and is ready to pursue full authorization

Answer

FedRAMP Ready indicates the CSP has met baseline security requirements and is positioned to pursue full authorization.

Question 5

Which FedRAMP authorization path allows a Cloud Service Provider to pursue authorization sponsored directly by the FedRAMP PMO rather than a single agency?

Accepted Answer

FedRAMP JAB Provisional Authorization

Answer

The Joint Authorization Board (JAB) Provisional ATO (P-ATO) is sponsored by the FedRAMP PMO and represents the top-tier authorization path.

(FedRAMP) Federal Risk and Authorization Management Program Certified Practice Test

(FedRAMP) Federal Risk and Authorization Management Program Certified Practice Test

FedRAMP FedRAMP Authorization Process & Documentation