MKT-IIP-AGU: what evidence shows a cloud service is "intended for" agency use?

[fitz-taylor]

We're a small SaaS provider preparing for a 20x Class C assessment on the Program Certification path. Our customers today are federal contractors, and we are pursuing federal agency users in parallel. MKT-IIP-AGU says a provider must demonstrate the offering is intended for direct or indirect agency use, but the rules don't say what evidence FedRAMP looks for. Five questions:

1. What evidence demonstrates intended direct use: a letter of intent from an agency program office, a no-cost pilot or evaluation agreement, an SBIR end-user memo, or only a contract? Does it need to come from an authorizing official?
2. If one boundary contains several applications, is an agency use case for one application enough for the whole offering?
3. For indirect use, what shows that an offering is included as a third-party information resource in another agency-used offering: a letter from that provider, or its listing documentation?
4. If an offering serves both agencies and private contractors, does contractor use (including for CMMC) matter once one agency use case is real?
5. Timing: must the use case exist at Initial Implementation listing, or can it be shown by the time we apply for certification?

[pete-gov]

MKT-IIP-AGU says a provider must demonstrate the offering is intended for direct or indirect agency use, but the rules don't say what evidence FedRAMP looks for.

This isn't about what agencies say they will or won't do, this is about what your product is designed to do. It should be relatively straightforward to demonstrate that you expect agencies to directly or indirectly use your product.

On the flip side, sometimes it's pretty straightforward that products are not intended for direct or indirect agency use. For example, if you offering a gambling machine management service then it might require a bit more clarity on how exactly you expect agencies to use that cloud computing product.

What evidence demonstrates intended direct use: a letter of intent from an agency program office, a no-cost pilot or evaluation agreement, an SBIR end-user memo, or only a contract? Does it need to come from an authorizing official?

It comes from the business, not an agency. It's an attestation where you are saying that you are not making a false claim about what your product is intended to do in order to trick the government (FedRAMP) into spending official resources on reviewing your product if your intent is not to participate in the FedRAMP Marketplace. Don't make false claims!

If one boundary contains several applications, is an agency use case for one application enough for the whole offering?

That would be very much against the principles of the minimum assessment scope and appear designed to waste government time and resources, which probably wouldn't go over very well. Don't include things in a cloud service offering that aren't necessary for the cloud service offering. That's not an explicit rule as much as it's just a good idea.

For indirect use, what shows that an offering is included as a third-party information resource in another agency-used offering: a letter from that provider, or its listing documentation?

The simplest way to provably demonstrate this is to to show us which FedRAMP Certified cloud service offerings use the product in their cloud service offering.

If an offering serves both agencies and private contractors, does contractor use (including for CMMC) matter once one agency use case is real?

FedRAMP is for commercial cloud service offerings, the same offering can be available to commercial customers and government customers.

Timing: must the use case exist at Initial Implementation listing, or can it be shown by the time we apply for certification?

You must provide this demonstration when requesting a marketplace listing, yes.

This is one of those things where we get a bit nervous when people start worrying about how they're going to demonstrate that their product is designed to be used by agencies because it shouldn't be that tricky....