After the agency reviews the deliverables, requests any additional testing and accepts the risk, its AO signs an ATO letter to the provider system owner and FedRAMP; FedRAMP then performs a cursory review for government-wide reuse consisting of a quality review that the package is complete and developed to FedRAMP guidance and a risk review that all deficiencies are correctly enumerated across deliverables. The steps are: provider and 3PAO upload current versions of all deliverables and assessment artifacts to the FedRAMP repository (Low and Moderate) or the provider's repository (High); the provider submits the Initial Authorization Package Checklist to intake; FedRAMP verifies the upload; the package enters the queue in order received; the review team raises clarifications and technical gaps, submits a final review report and recommendation to FedRAMP leadership, the Marketplace designation changes to FedRAMP Authorized, and the report, typically with post-authorization actions for the provider and 3PAO, goes to all stakeholders.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.