FedRAMP Rev 5 P.3: P.3 Authorization boundary and data flow diagrams

Before documenting controls the provider clearly defines the authorization boundary, the foundation of the SSP, validated against the inventory during the 3PAO assessment; the authorization boundary diagram shows the services, components and devices within the boundary and every external system or service that provides functionality or is used to manage and operate the offering, including underlying authorized IaaS and PaaS, interconnections, APIs, external cloud services, corporate shared services and update services, so that AOs see what needs risk acceptance or is the agency's responsibility; data flow diagrams show how federal data and metadata and sensitive system data flow within and outside the offering, following the FedRAMP Authorization Boundary Guidance and section 8 of the SSP for the diagrams and narratives.