Unlocking FedRAMP Collaboration: Simplifying CSP-to-CSP Security Package Access

[karanbir-sekhri]

When one CSP becomes a customer of another CSP and asks for their FedRAMP security package, the usual response is:

Please take a trip to the FedRAMP PMO first, once they approve you, we’ll open the door to the artifacts. 🙂

Is there a simpler CSP-to-CSP path, or does every package request need to take the FedRAMP PMO route?

Curious how others handle this when a CSP needs another CSP’s FedRAMP artifacts for risk assessments, inherited controls, or compliance reviews.

[pete-gov]

For the legacy model, FedRAMP doesn't manage package access for private companies, only agencies.

Certification packages are entirely the intellectual property of the company that creates them, and FedRAMP has no ability to control or provide access to them for other companies. FedRAMP only has the ability to set rules for how companies can consistently make this information available to agencies.

The Certification Data Sharing rules make it quite clear that FedRAMP does not assert any ownership over packages and will not penalize parties for responsibly sharing these in any way in CDS-CSO-RPS (Responsible Public Package Sharing).