Updates to frrAssessment or ksiAssessment content

[gmengelberg]

• Is a CSP allowed to update the frrAssessment/ksiAssessment content provided by an IA during an assessment?
  • If not, how would the content be updated if the CSP changed the implementation to address the discrepancies identified during the assessment?

[pete-gov]

I'm not entirely sure I understand the context of the question but if you are asking if SDR information can change throughout the assessment then the answer is yes, very much so, and it very much should. If an assessor finds an issue with something that the cloud service provider agrees with then the provider should make appropriate changes and get it reassessed before submitting to FedRAMP.

[gmengelberg]

Thanks for the reply @pete-gov.

During an assessment, an Independent Assessor may identify instances where the content in the SDR (frr|ksi)Implementation attribute(s) does not address the practice requirements, or instances where it is not faithfully implemented. In these instances, the assessor would document the discrepancy in the (frr|ksi)Assessment attribute and provide it to the CSP to update the SDR (per IVV-CSO-ICP).

Over time, the CSP would update the SDR (frr|ksi)Implementation content, and/or the actual implementation, and will want the (frr|ksi)Assessment attribute to be updated to show that there is no longer a discrepancy; however, the assessment has already concluded and the assessor has disengaged.

If the CSP was not allowed to update the (frr|ksi)Assessment attribute in a meaningful way, the documented discrepancy would remain in the SDR until the assessor is re-engaged. In many cases, this may be upwards of a year. If the CSP is allowed to update these attributes once the discrepancy addressed, then the SDR could more faithfully reflect the current state of the system.

Hopefully this helps to clarify why I am asking my question(s).