Certification Data Sharing¶

Providers MUST publicly share up-to-date information about the cloud service offering in both human-readable and machine-readable formats, including at least:

1. Direct link to the FedRAMP Marketplace for the offering
2. Service Model
3. Deployment Model
4. Business Category
5. UEI Number
6. Contact Information
7. Overall Service Description
8. Detailed list of specific services and their security categories (see CDS-CSO-SVC)
9. Summary of customer responsibilities and secure configuration guidance (if applicable, see the FedRAMP Secure Configuration Guide process)
10. Process for accessing information in the trust center (if applicable)
11. Availability status and recent disruptions for the trust center (if applicable)
12. Customer support information for the trust center (if applicable)
13. Next Ongoing Certification Report date (see CCM-OCR-NRD)

Note: Generally, this information should be available on a public webpage.

Terms: Cloud Service Offering, Machine-Readable, Ongoing Certification, Ongoing Certification Report (OCR), Security Category, Trust Center

Providers MUST publicly share a detailed list of specific services and their security categories that are included in the cloud service offering using clear feature or service names that align with standard public marketing materials; this list MUST be complete enough for a potential customer to determine which services are and are not included in the FedRAMP Minimum Assessment Scope without requesting access to underlying FedRAMP Certification Data.

Terms: Certification Data, Cloud Service Offering, Security Category

Providers MUST use a FedRAMP-compatible trust center to store and share FedRAMP Certification Data with all necessary parties.

Note: Rules for FedRAMP-Compatible Trust Centers are explained in the Certification Data Sharing Rules under the FedRAMP-Compatible Trust Centers section (id: CDS-TRC).

Terms: All Necessary Parties, Certification Data, Trust Center

Providers MUST use automation to ensure information remains consistent between human-readable and machine-readable formats when FedRAMP Certification Data is provided in both formats.

Terms: Certification Data, Machine-Readable

Providers MUST provide sufficient information in FedRAMP Certification Data to support agency authorization decisions but SHOULD NOT include sensitive information that would likely enable a threat actor to gain unauthorized access, cause harm, disrupt operations, or otherwise have a negative adverse impact on the cloud service offering.

Note: This is not a license to exclude accurate risk information, but specifics that would likely lead to compromise should be abstracted. A breach of confidentiality with FedRAMP Certification Data should be anticipated by a secure cloud service provider.

Terms: Certification Data, Cloud Service Offering, Likely

Providers MUST make historical versions of FedRAMP Certification Data available for three years to all necessary parties UNLESS otherwise specified by applicable FedRAMP rules; deltas between versions MAY be consolidated quarterly.

Effective Date(s): - Obtain: 2027-05-04 - Maintain: 2027-05-04 - Grace By Assessment Months: 2

Note: Consolidating changes quarterly means that the historical status at the end of each quarter or at the time of the Ongoing Authorization Report or Quarterly Review is sufficient, instead of maintaining separate versions with every single change that took place throughout the quarter.

Terms: All Necessary Parties, Certification Data, Quarterly Review

Notes:

• Providers determine what they consider to be separate services, based on maximizing the customer experience for agencies who may only adopt some services and not others.
• Providers are encouraged to provide a single comprehensive set of materials for all shared aspects of the service offering and only provide separate materials for unique aspects of each service to minimize the burden on providers and agencies.

Trust centers MUST share FedRAMP Certification Data with all necessary parties without interruption.

Note: "Without interruption" means that parties should not have to request manual approval each time they need to access FedRAMP Certification Data or go through a complicated process. The preferred way of ensuring access without interruption is to use on-demand just-in-time access provisioning.

Terms: All Necessary Parties, Certification Data, Trust Center

Trust centers MUST provide documented programmatic access to all FedRAMP Certification Data, including programmatic access to human-readable materials.

Terms: Certification Data, Trust Center

Trust centers MUST maintain an inventory and history of federal agency users or systems with access to FedRAMP Certification Data and MUST make this information available to FedRAMP upon request.

Terms: Certification Data, Trust Center

Trust centers MUST log access to FedRAMP Certification Data and store summaries of access for at least six months; such information, as it pertains to specific parties, SHOULD be made available upon request by those parties.

Terms: Certification Data, Trust Center

Trust centers SHOULD make FedRAMP Certification Data available to view and download in both human-readable and machine-readable formats.

Terms: Certification Data, Machine-Readable, Trust Center

Trust centers SHOULD include features that encourage all necessary parties to provision and manage access to FedRAMP Certification Data for their users and services directly.

Terms: All Necessary Parties, Certification Data, Trust Center

Providers MUST publicly provide plain-language policies and guidance for all necessary parties that explains how they can obtain and manage access to FedRAMP Certification Data stored in the trust center.

Terms: All Necessary Parties, Certification Data, Trust Center

Providers SHOULD share the FedRAMP Certification package with agencies upon request.

Terms: Certification Package

Providers MUST notify FedRAMP by email to info@fedramp.gov within 5 business days of denying an agency access request for FedRAMP Certification Data.

Timeframe: 5 business days

Terms: Certification Data

Providers MUST notify all necessary parties when migrating to a trust center and MUST provide information in their existing USDA Connect Community Portal secure folders explaining how to use the trust center to obtain FedRAMP Certification Data.

Terms: All Necessary Parties, Certification Data, Trust Center

Terms: Certification Data, Machine-Readable