FedRAMP Rev 5 A.7: A.7 Full security assessment

In the authorization phase the 3PAO develops the security assessment plan, which the agency should approve before testing under the just-in-time approach, tests the system according to FedRAMP requirements while the offering is frozen from development, produces the security assessment report detailing findings and enumerating all identified risks with an authorization recommendation, and the provider develops the plan of action and milestones from the findings; the provider and 3PAO then prepare a SAR debrief presentation, uploaded before the meeting, at which the 3PAO presents the approach, scope including validation of the boundary and data flows, results and residual risk, and the provider presents its remediation plan and timeline, deviation requests needing agency approval, and operationally required risks needing agency risk acceptance.