FedRAMP Rev 5
Authorization process (CSP Authorization Playbook volume I: partners, categorization, preparation, assessment, agency ATO and FedRAMP review, reuse) – FedRAMP Rev 5

FedRAMP Rev 5 A.9: A.9 Reuse: every agency issues its own authorization

A FedRAMP Authorized designation makes the package available on request to the whole federal government, but the initial agency ATO is not a government-wide risk acceptance: each subsequent agency reviews the package, determines the acceptability of the risks for its use and issues its own ATO or ATU following the Reusing Authorizations for Cloud Products quick guide, all signed agency letters are sent to FedRAMP, the initial authorizing agency is not responsible for continuous monitoring oversight on behalf of other agencies, and each agency reviews the monthly and annual deliverables for its own continued use.

Maintained by Gerard BlokdykControl text last updated

Other controls in Authorization process (CSP Authorization Playbook volume I: partners, categorization, preparation, assessment, agency ATO and FedRAMP review, reuse) – FedRAMP Rev 5

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll FedRAMP Rev 5 controls