Attachment B - SaaS FedRAMP Requirements .pdf

Attachment B: SaaS FedRAMP Requirements

Contents Attachment B: SaaS FedRAMP Requirements

If the solution is not FedRAMP authorized:

If the solution is FedRAMP Authorized but not VA FedRAMP Authorized

Deliverables:

If the solution is FedRAMP Authorized and VA FedRAMP Authorized

Deliverables:

Attachment B: SaaS FedRAMP Requirements

If the solution is not FedRAMP authorized:

1. The information system solution selected by the Contractor shall comply with the Federal

Information Security Management Act (FISMA).

2. The Contractor shall comply with FedRAMP requirements Moderate as mandated by Federal laws and policies, including making available any documentation, physical access, and logical access needed to support this requirement.

3. The Contractor shall provide a SaaS product as defined by the following criteria: Software as a Service (SaaS) is an application delivery model in which the application is hosted on a cloud infrastructure outside the security boundary of VA and is provided to the Cloud Service Customer (CSC) over the internet. The CSC uses the SaaS offering via a thin-client interface, such as a web-browser or a program interface. The CSC subscribes to the SaaS offering and is only responsible for limited application configuration settings. The Cloud Service Provider (CSP) offering the application is responsible for management of the application, safeguarding of data stored or processed by the application, and all elements of the underlying infrastructure.

In order to qualify as SaaS for use at VA, and to align with Federal Risk and Authorization Management Program (FedRAMP) requirements, the hosting for the offering must conform to the NIST 800-145 definition of Cloud Computing and thus contain following key characteristics:

• On-Demand Self-Service: The CSP fully automates the provisioning of both the customer interface and the underlying cloud components of the SaaS offering. In some cases, to the CSP may provision internal resources manually, while providing the CSC an automated interface to request and track the service.

• Broad Network Access: The SaaS capabilities are available over the internet or over a network that is available from all access points the CSC requires. The SaaS offering is accessible through common platforms (e.g., mobile phones, tablets, laptops, and workstations).

• Resource Pooling: The computing infrastructure supporting the SaaS offering is shared among more than one CSC using a multi-tenant model, and resources are dynamically assigned depending on customer demand.

• Rapid Elasticity: Computing capabilities are automatically provisioned and released in a manner that scales with customer demand. In some cases, the scaling of resources may not be fully automated, but it should be fast enough to support the needs of the CSC, which the CSC would have to define.

• Measured Service: Resource usage, such as storage, processing, bandwidth, and user activity are measured and reported on in a manner that is relevant to the SaaS offering.

The SaaS offering must be hosted within the United States and data stored/processed/transmitted within the offering must remain within the United States.

CSPs should be aware of FedRAMP and ready to partner with VA through the SaaS https://www.fedramp.gov/agency-authorization/

FedRAMP Authorization process.

4. Following guidance from the Federal CIO, VA will utilize existing JAB ATO or agency ATO issued by another agency as a starting point for FedRAMP requirements. If neither of those exist, VA will sponsor FedRAMP ATO. VA will be using the FedRAMP baselines as a starting point, since they are specifically tailored for cloud services.

5. The Contractor shall, where applicable, assist with the VA ATO Process at to help achieve agency authorization of the cloud service or migrated application Moderate.

6. The Contractor shall complete a FedRAMP System Security Plan (SSP) and supporting documentation within 45 calendar days after contract award. (If Data Security Categorization is High Impact, this will be due 85 calendar days after contract award.)

7. The Contractor shall complete a Third-Party Assessment Organization (3PAO) Security Assessment Plan (SAP) within 90 calendar days after contract award. (If Data Security Categorization is High Impact, this will be due after 130 calendar days after contract award.)

8. The Contractor shall complete a 3PAO Security Assessment Report (SAR) within 140 calendar days after contract award. (If Data Security Categorization is High Impact, this will be due 180 calendar days after contract award.)

9. The Contractor shall afford VA access to the Contractor’s and Cloud Service Provider’s (CSP) facilities, installations, technical capabilities, operations, documentation, records, and databases.

10. If new or unanticipated threats or hazards are discovered by either VA or the Contractor, or if existing safeguards have ceased to function, the discoverer shall immediately bring the situation to the attention of the other party in accordance with the security addendum B.

11. The Contractor shall not release any data without the consent of VA in writing. All requests for release must be submitted in writing to the Contracting Officer’s Representative (COR)/Contracting Officer (CO).

12. For live VA data to be used in this system, a FedRAMP Authorization and Agency ATO will be required.

Deliverables:

A. FedRAMP System Security Plan (SSP) and supporting documentation B. VA Implementation Diagram: This is a VA specific architecture diagram demonstrating the proposed implementation of this system at VA (VAID) C. 3PAO Security Assessment Plan (SAP) D. 3PAO Security Assessment Report (SAR)

If the solution is FedRAMP Authorized but not VA FedRAMP Authorized:

1. The information system solution selected by the Contractor shall comply with the Federal

Information Security Management Act (FISMA)

2. The Contractor shall comply with FedRAMP requirements as mandated by Federal laws and policies, including making available any documentation, physical access, and logical access needed to support this requirement

3. The Contractor shall, where applicable, assist with the VA ATO Process to help achieve agency authorization of the cloud service or migrated application.

4. The Contractor shall provide IRP scenario within 14 days and complete Table-Top exercise within 21 days of award unless current VA IRP can be provided

5. The Contractor shall provide a System Boundary Diagram that demonstrates implementation and any proposed VA interconnections including required ports and protocols at the time award

6. The Contractor shall complete a FedRAMP System Security Plan (SSP) and supporting documentation at the time of award

7. The Contractor shall complete a Third-Party Assessment Organization (3PAO) Security Assessment Plan (SAP) at the time of award

8. The Contractor shall complete a 3PAO Security Assessment Report (SAR) at the time of award

9. The Contractor shall afford VA access to the Contractor’s and Cloud Service Provider’s (CSP) facilities, installations, technical capabilities, operations, documentation, records, and databases

10. If new or unanticipated threats or hazards are discovered by either VA or the Contractor, or if existing safeguards have ceased to function, the discoverer shall immediately bring the situation to the attention of the other party in accordance with the security addendum B

11. The Contractor shall not release any data without the consent of VA in writing. All requests for release must be submitted in writing to the Contracting Officer’s Representative (COR)/Contracting Officer (CO)

12. In order for live VA data to be used in this system, a FedRAMP Authorization and Agency ATO will be required

Deliverables:

A. System Boundary Diagram B. FedRAMP System Security Plan (SSP) and supporting documentation C. 3PAO Security Assessment Plan (SAP) D. 3PAO Security Assessment Report (SAR)

If the solution is FedRAMP Authorized and VA FedRAMP Authorized:

1. The information system solution selected by the Contractor shall comply with the Federal

Information Security Management Act (FISMA), and have a current VA authorization

2. The Contractor shall comply with FedRAMP requirements as mandated by Federal laws and policies, including making available any documentation, physical access, and logical access needed to support this requirement

3. The Contractor shall, where applicable, assist with the VA ATO Sustainment Process to help maintain health and quality of agency authorization of the cloud service or migrated application.

4. The Contractor shall provide access to FedRAMP authorized and VA authorized environment.

5. The Contractor shall afford VA access to the Contractor’s and Cloud Service Provider’s (CSP) facilities, installations, technical capabilities, operations, documentation, records, and databases

6. If new or unanticipated threats or hazards are discovered by either VA or the Contractor, or if existing safeguards have ceased to function, the discoverer shall immediately bring the situation to the attention of the other party in accordance with the security addendum B

7. The Contractor shall not release any data without the consent of VA in writing. All requests for release must be submitted in writing to the Contracting Officer’s Representative (COR)/Contracting Officer (CO)

8. In order for live VA data to be used in this system, access must be provided to the FedRAMP Authorized and Agency Authorized environment

9. The Contractor shall participate in monthly Agency and FedRAMP Sustainment meetings

10. The Contractor shall participate monitoring and reoccurring security artifacts, including monthly POAM reports

Deliverables:

A. Dates for current ATO expiration, due at award B. Most recent monthly POAM (Plan of Action and Milestones) finding reports