FedRAMP Rev 5 C.6: C.6 Annual assessment

Under CA-2 the provider undergoes an independent assessment at least annually, and an offering last assessed against Rev 4 undergoes a full new Rev 5 assessment. The provider reviews and updates the SSP and appendices at least annually, tests the incident response plan and contingency plan at least annually, and with the assessor defines the scope on the annual assessment control selection worksheet included in the SAP: the FedRAMP-selected core controls, provider-selected controls for changes since the last assessment excluding those already assessed under a significant change in the same period, validation of POA&Ms closed since the last assessment and of vendor dependencies and deviation requests, controls marked not applicable, and controls not assessed in three years. The assessor prepares the SAP on the template, the provider and assessor brief agency customers on plan, scope and schedule, ideally at the monthly collaborative meeting, the assessment is conducted with time built in for remediation and retesting, the SAR is produced on the current templates with the impact-level traceability matrix and the risk exposure table (LI-SaaS combining implementation, test and results in Appendix A), the provider updates the POA&M with residual risks, and the package with updated documentation is uploaded to the repository with FedRAMP notified.