FedRAMP Rev 5 P.6: P.6 Security assessment plan

The SAP, developed by the 3PAO and signed by both the 3PAO and the provider as agreement to the scope, methodology, test plan and rules of engagement, uses the FedRAMP template with Appendix A the security controls selection worksheet, B the sampling methodology, C the penetration testing plan and methodology and D significant change request documentation; testing must at least align to FedRAMP guidance, the scope must reflect every service, component and device in the boundary, any vulnerability scan sampling must follow the FedRAMP sampling guide, the schedule must match what was agreed and the penetration test plan must follow the FedRAMP penetration test guidance, and the provider reviews it for quality before testing starts.