Attachment A SaaS FedRAMP Requirements.pdf

Section 1: If the solution is not FedRAMP Authorized

Attachment A: SaaS FedRAMP Requirements (Everything included in this section will be added to the PD/PWS aside from the No VA Data section. The No VA Data section is not applicable.)

If the solution is not FedRAMP authorized:

1. The information system solution selected by the Contractor shall comply with the

Federal Information Security Management Act (FISMA).

2. The Contractor shall comply with FedRAMP requirements <<Insert Impact Level from the Data Security Categorization. This should be done by DTC.>> as mandated by Federal laws and policies, including making available any documentation, physical access, and logical access needed to support this requirement.

3. The Contractor shall provide a SaaS product as defined by the following criteria:

Software as a Service (SaaS) is an application delivery model in which the application is hosted on a cloud infrastructure outside the security boundary of VA and is provided to the Cloud Service Customer (CSC) over the internet. The CSC uses the SaaS offering via a thin-client interface, such as a web-browser or a program interface. The CSC subscribes to the SaaS offering and is only responsible for minor in-app customizations. The Cloud Service Provider (CSP) offering the application is responsible for management of the application, safeguarding of data stored or processed by the application, and all elements of the underlying infrastructure. Additionally, the CSP is responsible for all on-going compliance.

In order to qualify as SaaS for use at VA, and to align with Federal Risk and Authorization Management Program (FedRAMP) requirements, the hosting for the offering must conform to the NIST 800-145 definition of Cloud Computing and thus contain following key characteristics:

On-Demand Self-Service: The CSP fully automates the provisioning of both the customer interface and the underlying cloud components of the SaaS offering. In some cases, to the CSP may provision internal resources manually, while providing the CSC an automated interface to request and track the service.

Broad Network Access: The SaaS capabilities are available over the internet or over a network that is available from all access points the CSC requires. The SaaS offering is accessible through common platforms (e.g., mobile phones, tablets, laptops, and workstations).

Resource Pooling: The computing infrastructure supporting the SaaS offering is shared among more than one CSC using a multi-tenant model, and resources are dynamically assigned depending on customer demand.

Rapid Elasticity: Computing capabilities are automatically provisioned and released in a manner that scales with customer demand. In some cases, the scaling of resources may not be fully automated, but it should be fast enough to support the needs of the CSC, which the CSC would have to define.

Measured Service: Resource usage, such as storage, processing, bandwidth, and user activity are measured and reported on in a manner that is relevant to the SaaS offering.

4. Following guidance from the Federal CIO, VA will utilize existing JAB ATO or agency ATO issued by another agency as a starting point for FedRAMP requirements. If neither of those exist, VA will sponsor The Cloud Service Provider for a FedRAMP Authorization. VA will be using the FedRAMP baselines as a starting point, since they are specifically tailored for cloud services.

5. The Contractor shall, where applicable, assist with the VA ATO Process to help achieve agency authorization of the cloud service or migrated application at the impact level required by VA to utilize the product. For this solution the required impact level is: <<Insert Impact Level from the Data Security Categorization. This should be done by DTC.>>

6. The Contractor shall comply with FedRAMP requirements surrounding data location within the Continental United States. FedRAMP specifies data location requirements in the High Baseline as part of control SA-9 (5); however, FedRAMP does not provide or specify data location requirements for other baselines.

7. The Contractor shall complete a FedRAMP System Security Plan (SSP) and supporting documentation including required attachments within 75 calendar days after contract award. (If Data Security Categorization is High Impact, this will be due 94 calendar days after contract award.)

8. The Contractor shall work with a VA Subject Matter Expert to develop a specific system boundary diagram including any integration and connectivity components for VA use. This will be known as the VA Implementation Diagram (VAID) and will demonstrate the proposed implementation of this system at VA. The Contractor shall complete this deliverable with VA within 10 calendar days of contract award.

9. The Contractor shall complete a Third-Party Assessment Organization (3PAO) Security Assessment Plan (SAP) within 90 calendar days after contract award. (If Data Security Categorization is High Impact, this will be due after 113 calendar days after contract award.)

10. The Contractor shall complete a 3PAO Security Assessment Report (SAR) within 90 calendar days after the SSP is accepted by VA. (If Data Security Categorization is High Impact, this will be due 113 calendar days after the SSP is accepted by VA.)

11. The Contractor shall work with VA Subject Matter Experts to test the validity of the Incident Response Plan (IRP) and ensure proper troubleshooting of issues that may arise. This should be completed within 30 calendar days of the SSP being delivered.

12.

documentation, records, and databases.

13. If new or unanticipated vulnerabilities are discovered by either VA or the Contractor, or if existing safeguards have ceased to function, the discoverer shall immediately bring the situation to the attention of the other party in accordance with Addendum B, VA Information, and Information System Security/Privacy Language.

14. The Contractor shall comply with data management requirements.

15. Successful issuance of a VA ATO will be required before live VA data can be used in the system.

16. The Contractor shall participate in FedRAMP Continuous Monitoring activities as

Guide found on the FedRAMP website.

17.The Contractor shall participate in monthly Agency and FedRAMP Sustainment meetings following the granting of a VA ATO.

18. The Contractor shall provide continuous monitoring activities including, but not limited to scans, security artifacts, and monthly Plan of Action and Milestones (POAM) reports as outlined by VA and FedRAMP requirements.

Deliverables:

A. FedRAMP System Security Plan (SSP) and required Attachments B. VA Implementation Diagram C. 3PAO Security Assessment Plan (SAP) D. 3PAO Security Assessment Report (SAR) E. Plan of Action and Milestones Monthly Reports.