SDR - Independent Assessor content vs. providers

[gmengelberg]

There are questions on which attributes in the Security Decision Record (SDR) are to be populated by the Independent Assessor. Please advise if the 'Owner' is properly reflected in this screenshot.

[pete-gov]

The cloud service provider is responsible for all content in their SDR, ensuring that independent verification and validation information provided by their independent assessment service is included:

IVV-CSO-ICP Inclusion in Certification Package: Providers MUST supply the results of FedRAMP independent assessments in their FedRAMP Certification Package without inappropriate modification.

The independent assessment service is expected to supply information to the cloud service provider for inclusion in the SDR, and verify it has been included:

IVV-IAS-SUM Assessment Summary: Assessors MUST supply the provider with a high-level summary of their assessment process and findings for each FedRAMP Practice; this summary will be included by the provider in the FedRAMP Security Decision Record for the cloud service offering.

IVV-IAS-VIP Verify Inclusion in Certification Package: Assessors MUST verify that information supplied during a FedRAMP independent assessment is included in the FedRAMP Certification Package by the provider without inappropriate modification.

All of the fields in your screenshot should be populated by the cloud service provider.

The frrAssessment field should be populated by the provider using information supplied by the independent assessment service. That assessment should independently verify and validate everything else.

---

I think part of the confusion is that the cloud service provider is expected to verify and validate things themselves, then that is independently verified and validated by an independent assessor.

[gmengelberg]

Should the provider expect the assessor to provide information on:

• The tests the assessor conducted (i.e., ksiTests)
• The artifacts the assessor reviewed (i.e., ksiEvidence)

[pete-gov]

ksiTests and ksiEvidence are fields the cloud service populates to address SDR-CSX-KSI Key Security Indicators. These are a little confusing in the schema names and can be modified to fit as appropriate for the cloud service provider - I think we'll likely revisit these in CR27 based on how people interpret and use them.

There are descriptions in the schema though:

• ksiTests -> List of tests used to validate the KSI implementation
• ksiEvidence -> Results of the security test used to validate the KSI implementation

These both map to SDR-CSX-KSI #5 ("Validation that the measures are accurately produced and are in place and working as intended"), and would be a thing the cloud service provider would have in place as part of their process.

Should the provider expect the assessor to provide information on:

Yes. The assessor then verifies and validates everything. Every rule, every KSI. So for SDR-CSX-KSI the assessor needs to verify and validate what the provider supplied for all 5 requirements for each KSI.

The assessor doesn't supply the tests and evidence, but they verify and validate that the tests and evidence the provider uses are having the outcome the provider expects and are working as intended and meet the requirements.

[gmengelberg]

That answers my question. Thank you.