3PAO Assessment Teams Must Be Qualified
July 20 | 2023
FedRAMP requires FedRAMP recognized third party assessment organization (3PAO) personnel, who perform FedRAMP security assessments, to meet all personnel qualification requirements, as published by the American Association for Laboratory Accreditation (A2LA), in the R311 – Specific Requirements: Federal Risk and Authorization Management Program (FedRAMP) policy. Specifically, the roles required for a FedRAMP assessment are a senior assessor, junior assessor, and penetration tester. The personnel assigned to these respective roles must meet the personnel requirements for years of experience, training, certification qualifications, and technical proficiency activities. Please note, a team consisting of a mix of qualified and unqualified personnel is not permitted. All three required roles must be performed by personnel who meet the requirements for their specific role.
Beginning on October 1, 2023, FedRAMP, in coordination with A2LA, will be actively reviewing cloud service offering (CSO) initial authorization / annual assessment submissions and 3PAO-provided Readiness Assessment Report (RAR) submissions to ensure the documented 3PAO assessment teams are staffed with qualified personnel.
In accordance with the FedRAMP Obligations and Performance Standards document, “any 3PAO assessment deliverables containing work performed, prepared, or submitted by 3PAO personnel who do not meet the requirements for their role will be determined to be invalid, will be rejected, and will need to be redone by personnel who meet the required qualifications. FedRAMP will pursue corrective actions and possible removal of FedRAMP recognition if 3PAO deliverables and personnel do not meet these performance standards.”
Failure of a 3PAO to perform according to these standards affects the federal government’s ability to authorize cloud systems based on a 3PAO’s independent assessment, as outlined in “Appendix B: Detailed 3PAO Performance Standards” of the aforementioned document. It is obligatory for 3PAOs to ensure each assessment team is staffed appropriately to avoid delays in FedRAMP’s ability to review authorization packages, annual assessments, and RARs.
For additional information or questions related to this topic, please contact info@fedramp.gov.
