Questions_and_Answers_022813.docx

February 28, 2013 FedBizOpps Announcement #RFI-XB-13-001G Questions and Answers

1. After the first 3PAO designations were made, 3PAO's were informed that their ongoing accreditation status would have privatized oversight at some point in the future, potentially dovetailing this oversight with the ISO 17020 certification. It now appears that 3PAO's will have to 're-qualify' to be a 3PAO. The current 3PAO's, GSA and NIST put a lot of effort into the past 3PAO accreditation efforts. Has any consideration been given to grand-fathering current 3PAO's into the future privatized oversight framework to eliminate duplication of effort?

a. Current 3PAOs will have to be re-certified by the privatized accreditation body. There will be a grand-fathering period during which current 3PAOs will have to prove they meet the privatized accreditation body’s requirements. During the grand-fathering period, 3PAOs will maintain their accreditation status.

2. Who would pay for the services provided by a privatized 3PAO oversight body? (e.g., GSA? current 3PAO's? expectant 3PAO's?)

a. The 3PAO applicant will pay for the services provided by a privatized accreditation body.

3. May CSPs respond to this RFI providing suggestions and/or comments to the 3PAO application and 3PO requirements?

a. Yes, FedRAMP invites responses from anyone.

4. Will current 3PAOs have to re-apply? If new requirements are added to the 3PAO application process, will current accredited 3PAOs be required to meet as well?

a. Please refer to question 1.

5. Will ***** be kept notified of additional outcomes of this RFI?

a. The information gathered from this RFI will be used in FedRAMP’s decision making process regarding the privatization of the 3PAO accreditation process and updates to the 3PAO requirements.

6. Why didn’t the RFI come out through the Federal Register?

a. FedRAMP has used FedBizOpps for all other RFIs. In addition to releasing the RFI on FedBizOpps, FedRAMP distributed the RFI to the entire FedRAMP listserv as well as the 3PAO SIG listserv.

7. What format should the final document be submitted in? (PDF, Word, etc.)

a. Please submit all comments in Microsoft Word 2007 or 2010.

8. Is there a POC (full name, email address, and phone number) associated with the 3PAO@FedRAMP.gov requirement that the email should be addressed to?

a. Please address all responses to ‘FedRAMP PMO’ and submit the response electronically to 3PAO@FedRAMP.gov