VENDOR SECURITY TECHNICAL ACCEPTABILITY CHECKLIST

Vendor Submission and Government Evaluation

VENDOR SECURITY

Technical Acceptability Checklist

FedRAMP Low or Equivalent Security Requirements

Purpose This checklist identifies the documentation and objective evidence the vendor must submit for the Government to evaluate the proposed solution’s technical acceptability.

Vendor / Offeror

Proposed Solution

Submission Date

Vendor Point of Contact

Submission Instructions

• Provide the requested evidence for every applicable requirement. If an item does not apply, explain why it is not applicable.

• Identify each submitted artifact by document name, version or date, owner, and the portion of the proposed solution it covers.

• Equivalent evidence is acceptable when it addresses the same security objective. Clearly explain how the alternative evidence satisfies the requirement.

• Redact credentials, private keys, sensitive personal information, and other information not necessary for the evaluation.

• For open security findings, provide the current status, planned corrective action, responsible party, target completion date, and any compensating controls or formal risk treatment.

Minimum Technical Acceptability Standard The vendor must provide sufficient objective evidence demonstrating that the proposed solution meets the applicable FedRAMP Low baseline or an equivalent security standard. Each applicable requirement must be supported by documentation. Outstanding security deficiencies must be remediated or have a risk treatment acceptable to the Government.

Important: Submitting a policy alone may not be sufficient. When possible, include implementation evidence such as configuration exports, assessment reports, test results, screenshots, tickets, or other records showing the control is operating.

Vendor Submission Index

# Requirement Artifact Name / Version Vendor Status

1 Security Baseline ☐ Submitted ☐ N/A

2 Control Crosswalk ☐ Submitted ☐ N/A

3 System Security Plan ☐ Submitted ☐ N/A

4 Security Assessment ☐ Submitted ☐ N/A

5 POA&M / Remediation Plan ☐ Submitted ☐ N/A

6 Authentication / MFA ☐ Submitted ☐ N/A

7 Access Control ☐ Submitted ☐ N/A

8 Encryption ☐ Submitted ☐ N/A

9 Logging / Monitoring ☐ Submitted ☐ N/A

10 Vulnerability Management ☐ Submitted ☐ N/A

11 Incident Response ☐ Submitted ☐ N/A

12 Contingency / Disaster Recovery ☐ Submitted ☐ N/A

# Requirement Artifact Name / Version Vendor Status

13 Cloud Shared Responsibility ☐ Submitted ☐ N/A

14 Outstanding Findings ☐ Submitted ☐ N/A

15 Application Security ☐ Submitted ☐ N/A

1. Security Baseline

What the vendor must provide

Identify the security framework or baseline claimed for the proposed solution and clearly define the system, services, environments, and components included in that scope.

Examples of acceptable evidence

• FedRAMP Low authorization package or authorization letter

• StateRAMP package or certification

• ISO/IEC 27001 certificate with the applicable Statement of Applicability

• SOC 2 Type II report with scope statement

• Documented NIST SP 800-53 control implementation applicable to the offered solution

Vendor artifacts submitted

Document name(s): __________________________________________ Version / date: ______________________________________________ Scope covered: ______________________________________________

Vendor explanation / exceptions

Government evaluation

☐ Meets requirement ☐ Does not meet ☐ Not applicable ☐ Additional information required

2. Control Crosswalk

What the vendor must provide

Provide a control-by-control mapping to the applicable FedRAMP Low baseline or equivalent standard. Include implementation status, control responsibility, and references to supporting evidence.

Examples of acceptable evidence

• Spreadsheet mapping FedRAMP Low controls to vendor controls

• NIST SP 800-53 control matrix showing implemented, partially implemented, inherited, or not applicable status

• Crosswalk linking each control to SSP sections, policies, configuration evidence, or assessment results

Vendor artifacts submitted

Document name(s): __________________________________________ Version / date: ______________________________________________ Scope covered: ______________________________________________

Vendor explanation / exceptions

Government evaluation

3. System Security Plan (SSP) provide

Provide a current SSP or equivalent document describing the system, architecture, authorization boundary, data flows, hosting environment, interconnected systems, and implemented security controls.

Examples of acceptable evidence

• Current SSP

• Security architecture document

• Network and authorization-boundary diagrams

• Data-flow diagrams identifying where Government data is stored, processed, and transmitted

• System inventory and external interconnection list

Vendor artifacts submitted

Document name(s): __________________________________________ Version / date: ______________________________________________ Scope covered: ______________________________________________

Vendor explanation / exceptions

Government evaluation

4. Security Assessment

What the vendor must provide

Provide the most recent independent assessment of the applicable security controls and the vendor’s response to identified deficiencies.

Examples of acceptable evidence

• Security Assessment Report (SAR)

• Independent third-party security audit

• SOC 2 Type II examination report

• FedRAMP assessment results

• Recent third-party penetration-test report with remediation status

Vendor artifacts submitted

Document name(s): __________________________________________ Version / date: ______________________________________________ Scope covered: ______________________________________________

Vendor explanation / exceptions

Government evaluation

5. POA&M / Remediation Plan provide

Identify known security deficiencies and document the corrective action, responsible owner, interim mitigation, target completion date, and current status for each item.

Examples of acceptable evidence

• Plan of Action and Milestones (POA&M)

• Corrective action plan

• Vulnerability remediation tracker

• Issue register containing owners, milestones, and closure evidence

• Risk treatment plan for findings that remain open

Vendor artifacts submitted

Document name(s): __________________________________________ Version / date: ______________________________________________ Scope covered: ______________________________________________

Vendor explanation / exceptions

Government evaluation

6. Authentication / Multi-Factor Authentication (MFA) provide

Describe how administrators and users authenticate. Provide evidence that MFA and applicable authentication requirements are implemented for relevant account types and access paths.

Examples of acceptable evidence

• Authentication architecture diagram

• MFA policy and enforcement settings

• Microsoft Entra ID, Okta, or comparable identity-provider configuration export

• Screenshots showing MFA enforcement without exposing credentials

• Test results demonstrating MFA for privileged and remote access

Vendor artifacts submitted

Document name(s): __________________________________________ Version / date: ______________________________________________ Scope covered: ______________________________________________

Vendor explanation / exceptions

Government evaluation

7. Access Control

What the vendor must provide

Demonstrate role-based access control, least privilege, privileged-account management, account lifecycle controls, segregation of duties, and periodic access reviews.

Examples of acceptable evidence

• Role-based access control matrix

• Privileged account management procedure

• User provisioning and deprovisioning workflow

• Completed periodic access-review report

• Sample access approval and termination records with personal information redacted

Vendor artifacts submitted

Document name(s): __________________________________________ Version / date: ______________________________________________ Scope covered: ______________________________________________

Vendor explanation / exceptions

Government evaluation

8. Encryption provide

Demonstrate that applicable data is encrypted in transit and at rest. Identify the protocols, algorithms, key-management process, and scope of encryption.

Examples of acceptable evidence

• TLS configuration and supported protocol documentation

• Database and storage encryption settings

• AWS Key Management Service, Azure Key Vault, or equivalent key-management architecture

• Encryption and cryptographic-key management policy

• Configuration evidence showing encryption is enabled

Vendor artifacts submitted

Document name(s): __________________________________________ Version / date: ______________________________________________ Scope covered: ______________________________________________

Vendor explanation / exceptions

Government evaluation

9. Logging / Monitoring provide

Describe security logging, centralized monitoring, event review, alerting, retention, time synchronization, protection of logs, and incident-detection capabilities.

Examples of acceptable evidence

• SIEM architecture or dashboard screenshots

• Microsoft Sentinel, Splunk, or comparable alerting reports

• AWS CloudTrail or Azure activity-log configuration

• Log retention policy and configured retention settings

• Sample security alert and documented analyst response

Vendor artifacts submitted

Document name(s): __________________________________________ Version / date: ______________________________________________ Scope covered: ______________________________________________

Vendor explanation / exceptions

Government evaluation

10. Vulnerability Management

What the vendor must provide

Provide current vulnerability assessment results and evidence showing how vulnerabilities are prioritized, tracked, remediated, validated, and reported.

Examples of acceptable evidence

• Tenable, Qualys, Rapid7, or comparable authenticated vulnerability scan

• Container or dependency scan report

• Remediation tickets and closure evidence

• Rescan showing that identified vulnerabilities were corrected

• Vulnerability management policy and remediation service-level targets

Vendor artifacts submitted

Document name(s): __________________________________________ Version / date: ______________________________________________ Scope covered: ______________________________________________

Vendor explanation / exceptions

Government evaluation

11. Incident Response provide

Provide current procedures for detecting, reporting, containing, investigating, eradicating, recovering from, and notifying the Government of security incidents and breaches.

Examples of acceptable evidence

• Incident Response Plan

• Breach notification procedure and escalation matrix

• Incident response playbooks

• Tabletop or simulation exercise results

• After-action report with corrective actions

Vendor artifacts submitted

Document name(s): __________________________________________ Version / date: ______________________________________________ Scope covered: ______________________________________________

Vendor explanation / exceptions

Government evaluation

12. Contingency / Disaster Recovery provide

Provide current contingency, backup, continuity, and disaster-recovery documentation, including recovery objectives and evidence of recent testing.

Examples of acceptable evidence

• Contingency Plan or Disaster Recovery Plan

• Business Continuity Plan

• Backup architecture, schedule, retention, and restoration procedures

• Disaster-recovery exercise or failover-test report

• Backup restoration test results

Vendor artifacts submitted

Document name(s): __________________________________________ Version / date: ______________________________________________ Scope covered: ______________________________________________

Vendor explanation / exceptions

Government evaluation

13. Cloud Shared Responsibility

What the vendor must provide

Clearly identify controls inherited from the cloud service provider and controls implemented, operated, and monitored by the vendor.

Examples of acceptable evidence

• AWS, Microsoft Azure, or other cloud shared-responsibility matrix

• Customer Responsibility Matrix (CRM)

• Inherited-controls matrix

• Architecture diagram showing provider-managed and vendor-managed components

• Documentation explaining responsibility for patching, logging, identity, encryption, and incident response

Vendor artifacts submitted

Document name(s): __________________________________________ Version / date: ______________________________________________ Scope covered: ______________________________________________

Vendor explanation / exceptions

Government evaluation

14. Outstanding Security Findings provide

Provide the disposition of all unresolved Medium and Critical findings. Include remediation evidence or, when unresolved, documented compensating controls and formal risk treatment.

Examples of acceptable evidence

• Updated report showing finding closure

• Rescan or retest confirming remediation

• Signed risk acceptance or risk treatment record

• Compensating-control description with effectiveness evidence

• Corrective-action ticket with owner and completion date

Vendor artifacts submitted

Document name(s): __________________________________________ Version / date: ______________________________________________ Scope covered: ______________________________________________

Vendor explanation / exceptions

Government evaluation

15. Application Security provide

Demonstrate that security is integrated into the software development lifecycle and that the application is tested for vulnerabilities before and after release.

Examples of acceptable evidence

• Static Application Security Testing (SAST) report, such as Checkmarx, Veracode, or SonarQube

• Dynamic Application Security Testing (DAST) report, such as OWASP ZAP or Burp Suite

• Software composition or dependency analysis report

• Independent application penetration-test report

• Secure SDLC documentation and evidence of vulnerability remediation

Vendor artifacts submitted

Document name(s): __________________________________________ Version / date: ______________________________________________ Scope covered: ______________________________________________

Vendor explanation / exceptions

Government evaluation

Current Submission - Specific Concern The September 2026 ZAP assessment identifies one Medium-risk finding and multiple Low-risk findings. The vendor’s Web Application Security Policy establishes a 30-day remediation expectation for Medium-risk findings. Before a favorable technical acceptability determination can be made, the vendor should submit one of the following:

• A ZAP rescan or other validation showing the Medium-risk finding has been remediated and closed.

• A documented risk treatment approved by the appropriate vendor authority, including compensating controls, the remaining risk, the responsible owner, and the planned remediation date.

Final Government Determination

Determination ☐ Technically Acceptable ☐ Technically Unacceptable ☐ Additional Information Required

Evaluator

Date

Comments

Required Follow-up