FedRAMP FedRAMP Third-Party Assessment & Supply Chain 1

Question 1

What is the primary role of a Third-Party Assessment Organization (3PAO) in the FedRAMP authorization process?

Accepted Answer

To independently test and evaluate a CSP's security controls and produce a Security Assessment Report

Answer

A 3PAO independently assesses the CSP's security controls and produces the Security Assessment Report (SAR) used in the authorization decision.

Question 2

Which organization accredits Third-Party Assessment Organizations (3PAOs) to perform FedRAMP assessments?

Accepted Answer

American Association for Laboratory Accreditation (A2LA)

Answer

A2LA (American Association for Laboratory Accreditation) is the accreditation body that certifies 3PAOs to perform FedRAMP security assessments.

Question 3

What document does a 3PAO produce that outlines the planned scope, methodology, and schedule for a FedRAMP security assessment?

Accepted Answer

Security Assessment Plan (SAP)

Answer

The Security Assessment Plan (SAP) describes how the 3PAO will conduct the assessment, including test cases, scope, and timeline.

Question 4

In FedRAMP supply chain risk management, what does SCRM stand for?

Accepted Answer

Supply Chain Risk Management

Answer

SCRM stands for Supply Chain Risk Management, which addresses risks from hardware, software, and service providers in the cloud system's supply chain.

Question 5

How must a FedRAMP CSP handle external services or APIs that are integrated into their authorized cloud offering?

Accepted Answer

External services must be documented in the SSP and assessed as part of the authorization boundary or accepted as risk

Answer

All external services within the authorization boundary must be documented in the SSP; if not FedRAMP authorized themselves, they represent risk that must be accepted.

(FedRAMP) Federal Risk and Authorization Management Program Certified Practice Test

(FedRAMP) Federal Risk and Authorization Management Program Certified Practice Test

FedRAMP FedRAMP Third-Party Assessment & Supply Chain 1