FedRAMP_Accreditation_Body_Application.docx

Adherence to the Requirements for FedRAMP 3PAO Accreditation Body Application for FedRAMP 3PAO Accreditation Body

Instructions

Please complete all sections of the application form and submit the completed application and requested supporting documentation to the Federal Risk and Authorization Management Program (FedRAMP) Program Management Office (PMO).

A complete application will include the following components:

1. General Information

2. Designated Point of Contact for Accreditation Body (AB) Applicant

3. Alternate Designated Point of Contact for Accreditation Body (AB) Applicant

4. Evidence of Competence and Conformance

5. Agreement to Adhere to the Requirements for FedRAMP 3PAO Accreditation Body (AB)

Submission

Method: Applicants must return a completed application, including all documents, in Microsoft Word 2007 or PDF format, to the FedRAMP PMO email address: 3PAO@FedRAMP.gov.

Please submit application with:

· Cover letter that includes the company's name, company's contact information, and the date of submission.

· List of the names of all the attachments submitted indicating to which application requirement each attachment applies.

· Each document must include a header with the document title, the name of the document it supports (if an attachment), and the name of the applicant organization.

Application Rules

1. FedRAMP reserves the right to approve multiple Accreditation Bodies at a time.

2. Accreditation Body selection.

a) FedRAMP’s determination will be based on the information provided, the completeness of an accreditation organization’s description of the elements listed in the requirements in this application, and each accreditation organization’s overall accreditation experience.

The accreditation organization that is determined to be the best qualified will be notified that it has been selected as the FedRAMP Approved 3PAO Accreditation Body. All other accreditation organizations will be notified that their requests for FedRAMP Approved 3PAO Accreditation Body status have been denied

b) Any accreditation organization that submits a timely request for FedRAMP Approved 3PAO Accreditation Body status and is denied may request reconsideration in accordance with the reconsideration rules below.

3. FedRAMP Approved Accreditation Body status.

a) The FedRAMP Approved 3PAO Accreditation Body’s status will expire not later than three years from the date its status was granted by FedRAMP.

b) Should the FedRAMP Approved 3PAO Accreditation Body fail to meet any of the requirements listed in this application, FedRAMP reserves the right to revoke the FedRAMP Approved 3PAO Accreditation Body’s approved status.

Reconsideration

1. An accreditation organization that submits a timely request for FedRAMP Approved 3PAO Accreditation Body status and is denied may request reconsideration of the decision to deny its request for FedRAMP Approved 3PAO Accreditation Body status.

2. Submission requirement. To request reconsideration, an accreditation organization is required to submit to FedRAMP, within 15 days of receipt of a denial notice, a written statement with supporting documentation contesting the decision to deny its request for FedRAMP Approved 3PAO Accreditation Body status. The submission must demonstrate that clear, factual errors were made in the review of its request for FedRAMP Approved 3PAO Accreditation Body status and that the accreditation organization would have been selected as the FedRAMP Approved 3PAO Accreditation Body if those errors had been corrected. If FedRAMP does not receive an accreditation organization’s submission within the specified timeframe, then its request for reconsideration may be denied.

3. Decision.

a) If FedRAMP determines that an accreditation organization has met the FedRAMP requirements, then that organization will receive further consideration for the FedRAMP Approved 3PAO Accreditation Body. All other accreditation organizations will be notified that their requests for reconsideration have been denied.

b) Final decision. A reconsideration decision issued by FedRAMP is final and not subject to further review.

Questions and Clarifications All questions and clarifications must be submitted to 3PAO@FedRAMP.gov by 5:00pm EST April 29, 2013. The FedRAMP PMO will publish answers to these questions by 5:00pm EST May 3, 2013.

Application for FedRAMP 3PAO Accreditation Body

FedRAMP 3PAO Accreditation Body Application Instructions and Rules

FedRAMP 3PAO Accreditation Body Page 1

General Information

Company Name:

Company Address:

City: State: Zip Code:

Country: ______________________________________________

Home Page URL:

FedRAMP is asking prospective assessment organizations to disclose where the company is established. One of the following blocks must be marked:

· Established in the United States;

· Established in a designated country as defined by FAR 25.003; or

· Established in a country other than the United States or a designated country as defined by FAR 25.003.

Designated Point of Contact for FedRAMP 3PAO AB Applicant First Name: Last Name:

Title:

Phone Number:

Email Address:

Alternative Point of Contact for FedRAMP 3PAO AB Applicant First Name: Last Name:

Title:

Phone Number:

Email Address:

Required Information Please submit the following information to demonstrate your organization’s ability to serve as the FedRAMP Approved 3PAO Accreditation Body:

1. A detailed description of the accreditation body's conformance to ISO/IEC 17011:2004;

2. Proof of status as signatory to an international mutual recognition agreement whose scope includes ISO/IEC 17020:1998

3. A current list and description of any conformity assessment services offered whose scope includes information technology or information technology security. Provide a range of prices for each scope as well as a range of processing time for applications within that scope.

4. Experience and lessons learned in evaluating the conformance of organizations to ISO/IEC 17020:2012 and/or ISO/IEC 17020:1998.

5. Descriptions of three corrective actions taken in a current ISO/IEC 17020:1998 accreditation program of any scope.

6. A description of the accreditation body’s roles and qualifications for key personnel; including quality and technical assessors.

7. The resumes of the accreditation body’s employees filling the key roles; including the resumes of the quality and technical assessors.

8. An approach and relative timeline to accrediting FedRAMP 3PAO applicants to ISO/IEC 17020:2012; include awareness activities, training, and accreditation activities.

9. Details of the approach the accreditation body uses to apply ISO/IEC 17020:1998 requirements to unique accreditation program requirements. Give three examples applying ISO/IEC 17020:1998 to the FedRAMP 3PAO requirements.

10. Detailed description of the accreditation body’s approach used to determine technical competency of 3PAOs consistent with FedRAMP 3PAO requirements;

11. Details on overall approach and the accreditation process your organization would use to accredit a 3PAO applicant.

12. Detailed description on the surveillance approach per ISO/IEC 17011:2004.

13. Approach for responding to, and investigating, complaints against 3PAOs.

14. Optional: Provide five examples of how assessments of cloud systems differ from assessments of standard data center IT assessments.

Agreement Please confirm that you have read, understand, and agree that your organization(s) will adhere to the following Requirements by signing and dating the attestation below.

1. Maintain conformance with ISO/IEC 17011:2004;

2. Maintain status as signatory to an international mutual recognition agreement whose scope includes ISO/IEC 17020:1998.

3. In accrediting Third-party Assessment Organizations, verify conformance to ISO/IEC 17020:1998 and FedRAMP technical requirements.

4. Consistently and accurately report findings and accreditation statuses to the FedRAMP PMO.

5. Provide monthly process status updates to the FedRAMP PMO.

6. Make all 3PAO applicant materials available to the FedRAMP PMO upon request.

7. Ensure 3PAO applicants understand the requirements of the 3PAO application.

8. Participate in an annual review held by the FedRAMP PMO to determine adherence to FedRAMP 3PAO Accreditation Body requirements.

9. Establish and maintain appropriate and consistent communication channels with the FedRAMP PMO.

10. Establish and maintain policies and procedures that incorporate feedback from the FedRAMP PMO to improve the Accreditation Body’s FedRAMP accreditation processes.

11. FedRAMP reserves the right to revoke the FedRAMP Approved 3PAO Accreditation Body’s approved status should the accreditation body fail to continuously meet any of the requirements listed in this application.

As the applicant Accreditation Body’s Authorized Representative, I declare under penalty of perjury that I have read and understood the requirements as outlined in ISO/IEC 17011:2004 and FedRAMP. My organization conforms to these requirements, except as noted in any attachments to this document. I further declare under penalty of perjury that all statements made in this application are true and correct to the best of my information and belief.

Signature: _________________________________________________________ Date:

Name: _________________________________________________________________________________________

Title: __________________________________________________________________________________________

Organization: ___________________________________________________________________________________