For Informational Purposes Only - SaaS FedRAMP Information.docx

Software-as-a-Service (SaaS) Templated Language | VA Data

VA Data Please insert the following language into the requirements section:

ASSESSMENT, AUTHORIZATION, and CONTINUOUS MONITORING

1. The information system solution selected by the Contractor shall comply with the Federal Information Security Management Act (FISMA).

2. The Contractor shall comply with FedRAMP requirements as mandated by Federal laws and policies, including making available any documentation, physical access, and logical access needed to support this requirement.

3. The Contractor shall provide a SaaS product as defined by the following criteria: Software as a Service (SaaS) is an application delivery model in which the application is hosted on a cloud infrastructure outside the security boundary of VA and is provided to the Cloud Service Customer (CSC) over the internet. The CSC uses the SaaS offering via a thin-client interface, such as a web-browser or a program interface. The CSC subscribes to the SaaS offering and is only responsible for limited application configuration settings. The Cloud Service Provider (CSP) offering the application is responsible for management of the application, safeguarding of data stored or processed by the application, and all elements of the underlying infrastructure.

In order to qualify as SaaS for use at VA, and to align with Federal Risk and Authorization Management Program (FedRAMP) requirements, the hosting for the offering must conform to the NIST 800-145 definition of Cloud Computing and thus contain following key characteristics:

· On-Demand Self-Service: The CSP fully automates the provisioning of both the customer interface and the underlying cloud components of the SaaS offering. In some cases, to the CSP may provision internal resources manually, while providing the CSC an automated interface to request and track the service.

· Broad Network Access: The SaaS capabilities are available over the internet or over a network that is available from all access points the CSC requires. The SaaS offering is accessible through common platforms (e.g., mobile phones, tablets, laptops, and workstations).

· Resource Pooling: The computing infrastructure supporting the SaaS offering is shared among more than one CSC using a multi-tenant model, and resources are dynamically assigned depending on customer demand.

· Rapid Elasticity: Computing capabilities are automatically provisioned and released in a manner that scales with customer demand. In some cases, the scaling of resources may not be fully automated, but it should be fast enough to support the needs of the CSC, which the CSC would have to define.

· Measured Service: Resource usage, such as storage, processing, bandwidth, and user activity are measured and reported on in a manner that is relevant to the SaaS offering.

The SaaS offering must be hosted within the United States and data stored/processed/transmitted within the offering must remain within the United States. CSPs should be aware of FedRAMP and ready to partner with VA through the SaaS FedRAMP Authorization process.

4. Following guidance from the Federal CIO, VA will utilize existing JAB ATO or agency ATO issued by another agency as a starting point for FedRAMP requirements. If neither of those exist, VA will sponsor FedRAMP ATO. VA will be using the FedRAMP baselines as a starting point, since they are specifically tailored for cloud services.

5. The Contractor shall, where applicable, assist with the VA ATO Process to help achieve agency authorization of the cloud service or migrated application.

6. The Contractor shall complete a FedRAMP System Security Plan (SSP) and supporting documentation within 45 calendar days after contract award. (If Data Security Categorization is High Impact, this will be due 85 calendar days after contract award.)

7. The Contractor shall complete a Third-Party Assessment Organization (3PAO) Security Assessment Plan (SAP) within 90 calendar days after contract award. (If Data Security Categorization is High Impact, this will be due after 130 calendar days after contract award.)

8. The Contractor shall complete a 3PAO Security Assessment Report (SAR) within 140 calendar days after contract award. (If Data Security Categorization is High Impact, this will be due 180 calendar days after contract award.)

9. The Contractor shall afford VA access to the Contractor’s and Cloud Service Provider’s (CSP) facilities, installations, technical capabilities, operations, documentation, records, and databases.

10. If new or unanticipated threats or hazards are discovered by either VA or the Contractor, or if existing safeguards have ceased to function, the discoverer shall immediately bring the situation to the attention of the other party in accordance with the security addendum B.

11. The Contractor shall not release any data without the consent of VA in writing. All requests for release must be submitted in writing to the Contracting Officer’s Representative (COR)/Contracting Officer (CO).

12. For live VA data to be used in this system, a FedRAMP Authorization and Agency ATO will be required.

Deliverables:

A. FedRAMP System Security Plan (SSP) and supporting documentation B. VA Implementation Diagram: This is a VA specific architecture diagram demonstrating the proposed implementation of this system at VA (VAID) C. 3PAO Security Assessment Plan (SAP) D. 3PAO Security Assessment Report (SAR) SaaS Best Practices (not to be included in the templated language)

Federal Risk and Authorization Management Program (FedRAMP) There are relatively few SaaS products that are already FedRAMP authorized. Because of this, VA has created a process to onboard new SaaS applications to VA, including sponsoring the desired SaaS product for FedRAMP. Some important points to know:

· What is it: The Federal Risk and Authorization Management Program (FedRAMP) is a government-wide program that promotes the adoption of secure cloud services across the federal government by providing a standardized approach to security assessment, authorization, and continuous monitoring for cloud products and services. FedRAMP empowers agencies to use modern cloud technologies, with an emphasis on security and protection of federal information.

· What is the Value: FedRAMP eliminates duplicative efforts by providing a common security framework. Agencies review their security requirements against a standardized baseline. A Cloud Service Provider (CSP) goes through the authorization process once, and after achieving an authorization for their Cloud Service Offering (CSO), the security package can be reused by any federal agency.

· FedRAMP enables the federal government to accelerate the adoption of cloud computing by creating transparent standards and processes for security authorizations and allowing agencies to leverage security authorizations on a government-wide scale.

· VA Agency Sponsorship: If there is a VA business need for an application, and the vendor is willing to pursue FedRAMP, VA will sponsor that vendor through the authorization process upon procurement of their SaaS. DTC team is a resource for when a contract is awarded to help vendors navigate the FedRAMP process.

· VA Requirement: FedRAMP was adopted as official policy in December of 2011 through the FedRAMP Policy memo which established that all government agencies are required to follow FedRAMP and defining cloud service through NIST SP 800-60. The VA requires a FedRAMP ATO for all federal data stored outside the VA security boundary.

· By FedRAMP policy, Agencies cannot sponsor a product for FedRAMP unless they already have an awarded contract in place with the vendor. So, no product could ever be added to FedRAMP by Agency sponsorship if it had to be Authorized prior to award.

· A FedRAMP Authorization is not necessary at the time of award. This is now common practice: VA has awarded 25+ SaaS contracts in the last year that were not FedRAMP Authorized at the time of the award.

FedRAMP Estimated Cost:

Note: This estimate is a cost analysis provided to us by previous vendors. It’s HIGHLY suggested you conduct your own cost analysis when it comes to 3PAO assessments.

System Security Plan (SSP)

Links to FedRAMP reference material:

· FedRAMP.gov links for reference

· FedRAMP Agency Authorization process – agency agnostic description of the FedRAMP authorization process

· FedRAMP Documents & Templates – landing page for updated documents and templates

· FedRAMP System Security Plan (SSP) Templates

· Low baseline

· Moderate baseline

· High baseline

· FedRAMP Marketplace – the FedRAMP marketplace where other IaaS/PaaS/SaaS, utilizing Departments/Agencies, and third party assessors (3PAO) are listed

· FedRAMP FAQs - Tips and Cues that provide helpful information about FedRAMP to Agencies, CSPs, 3PAOs, and other stakeholders.

FedRAMP Timeline:

Note: This timeline is an estimate and can vary from type request, acquisition, and length of 3PA0 assessment.

1. Pre-Authorization

a. Once DTC obtains Vendor commitment to move forward with FedRAMP, acquisition process is started (26 weeks to procure the tool). During this time, VA Contracting Office creates a contract to proceed with the FedRAMP Authorization process with VA as the sponsoring agency.

2. Full Security Assessment

a. CSP/VA Complete VA Implementation Diagram

i. Estimated Timeline: 2 weeks

b. System Security Plan (SSP) Development (including any diagrams) and Initial Review of SSP Package

i. Estimated Timeline: 10 weeks

c. Enterprise Security Architecture (ESA) Cloud Security Package Review

i. SSP is reviewed by the VA ESA Cloud Security Team, they provide support in implementing with feedback as needed.

1. Estimated Timeline: 4 weeks

d. 3PAO Test TFS Cloud/Assessment

i. The Third-Party Assessment Organization (3PAO) completes an audit of your environment and develops the Security Assessment Report (SAR).

ii. The SAR is debriefed and outcome from the debrief is the Security Compliance & Architecture Report (SCAAR).

1. SCAAR Development Estimated Timeline : 10 weeks

iii. Plan of Action and Milestones (POA&M) will be developed based on SAR and SCAAR feedback

1. Estimated Timeline for steps 1-3: 15 weeks

3. Agency Authorization Process

a. The VA will work with you to complete the ATO.

i. Estimated Timeline: 17 weeks

4. FedRAMP PMO Completes a review of the FedRAMP ATO

a. VA provides ATO to FedRAMP PMO and FedRAMP completes final review to provide FedRAMP Authorized status

i. Estimated Timeline: 4 weeks

Proposed Invoicing Schedule The biggest challenge is to avoid paying for subscriptions that the VA cannot utilize. Since this SaaS Product is processing VA data it cannot be utilized until FedRAMP Authorization and Agency ATO are both approved.

However, to best use VA resources and not pay for something that the end user is not permitted to access, Product Engineering and the Digital Transformation Center recommends that the following deliverable timelines be included in procurement documents to accelerate the FedRAMP preparation process. You’ll note this includes incremental billing, protecting VA from paying for services they can’t use.

· Completed FedRAMP System Security Plan (SSP), VAID, and all supporting documentation (10% of contract value billable upon receipt)

· 3PAO Security Assessment Plan (SAP) (10% of contract value billable upon receipt)

· 3PAO Security Assessment Report (SAR) (10% of contract value billable upon receipt) The remaining 70% will be billable when all ATO work is complete image1.png