Open asiegelblackberry opened 6 years ago
Aviv,
Thank you for feedback in response to our December RFI. Please note that the PMO and the Secure Cloud Portfolio are digesting the RFI input from across industry and developing next steps.
FedRAMP PMO
Question/Comment on FedRamp RFI Directory
Name and Affiliation
Aviv Siegel, VP Technology, BlackBerry AtHoc
Cloud Services
Some FedRAMP RFPs use provisions from non-cloud RFPs or other types of procured cloud systems. For example, an agency seeking SaaS solution may include in the RFP non-SaaS requirements, such as: workload management, workload-based charging, and low-level monitoring. For a SaaS solution, relevant provisions relate to service level availability and redundant infrastructure.
Exemplar language for relevant cloud system requirements: Software as a Service (SaaS) Availabilities. The Contractor must deliver the following minimum SaaS service level availabilities and Key Performance Parameters (KPP):
The system must include redundancy at one or more geographically-dispersed (separated by a minimum of five hundred miles) alternate locations having sufficient capacity of the primary site and the ability to provide all system functionality when the primary site is disabled. The data at the alternate site will be on-line synchronized with the primary site.
Cloud Security
A FedRAMP RFP should specify what authorization must be in place. Additionally, any desired impact level and deployment model should be explicitly stated. Service model may be relevant in some cases or for some agencies. By using proper FedRAMP program terminology it will make it easier for the market and the agency to ensure clarity and compliance. For example, FedRAMP authorization vs. certification. Lastly, be clear that authorization is to be maintained by the CSP through the life of the engagement.
Exemplar language -
Specific Security Requirements
Some RFPs have duplicative requirements that are inconsistent with FedRAMP. Such requirements are confusing, add undue burden, or conflict with FedRAMP.
Negative examples of such requirements include:
It is recommended for an agency to clearly state any special, additional requirements beyond FedRAMP for its special needs.
For example, requiring support for SAML 2.0 to be covered in the offeror FedRAMP ATO, in addition to MFA authentication for privileged users. Another example would be listing a specific NIST publication to be complied with, such as NIST SP 800-53 Rev4, vs. blanket “comply with NIST”.
Positive exemplar language -