FedRAMP Rev 5 P.1: P.1 Package inventory, templates and the initial checklist

A FedRAMP authorization package consists of the system security plan with appendices A to Q as necessary, the security assessment plan with appendices A to D, the security assessment report with appendices A to F, the plan of action and milestones (SSP Appendix O) and the signed agency ATO; documents are submitted in the designated formats, some on FedRAMP-provided templates, and the provider completes and submits the Initial Authorization Package Checklist with the package. Providers must use FedRAMP templates for the SSP, rules of behavior, information system contingency plan, the control implementation summary and customer responsibility matrix workbook, the integrated inventory workbook, the POA&M and the cryptographic modules table, and develop their own policies and procedures, user guides, incident response plan and configuration management plan; 3PAOs must use the templates for the SAP, test cases, SAR and risk exposure table; nobody may alter or remove template content beyond the italicized instructions, and agency-specific requirements beyond the baseline go in an SSP appendix.