Is a Trust Center part of the CSO?

[gmengelberg]

Since a Trust Center does not process Federal Customer Data, I assume/suspect that it should not be considered part of the CSO (i.e., not inside the boundary). If so, this would exempt the Trust Center from adhering to SCN requirements.

Are both of these correct assumptions?

[pete-gov]

The answer is "it depends" - specifically, on what you put in your trust center. Apply the Minimum Assessment Scope:

MAS-CSO-IIR (Identify Information Resources) : Providers MUST identify a set of information resources to assess for FedRAMP Certification that includes all information resources that are likely to handle federal customer data or likely to impact the confidentiality, integrity, or availability of federal customer data handled by the cloud service offering; this set of information resources is the cloud service offering.

Your statement addresses the first part of this requirement (it does not process federal customer data), but you also need to consider the second part: is it likely to impact the CIA of federal customer data in the cloud service offering?

If you are following FedRAMP rules on being responsible and careful with the information you share in your FedRAMP Certification Package then it may be reasonable to determine that the information in the Trust Center isn't likely to impact CIA of federal customer data in the service offering. This is, IMO, the ideal state - most FedRAMP Trust Center information could be published publicly without risking CIA of data in the cloud service offering if it's well designed.

On the other hand, we know that some folks still habitually put fairly sensitive information into these materials. Maybe you provide sufficient information in the FedRAMP Certification Package that if someone were able to obtain that information then they're likely to exploit it in a way that exposes data in the cloud service offering. Maybe you have a bad habit of being like "our recovery codes are stored in a treasure chest buried at these GPS coordinates" or something in your SDR. In that case, the Trust Center is an information resource that is processing information that is likely to impact CIA of the federal customer data in the cloud service offering because if someone pops it they get a nice "X marks the spot" map!

I guarantee there are some cloud services where the Trust Center is in scope, and there are some where it's not. Either way you better make sure it's secure, since you're telling folks to go there and trust the information in it.

[gmengelberg]

Thank you Pete.