Skip to content
All posts

Assessing Cloud Service Provider Compliance

Picture of Rachel Leidy By  Rachel Leidy  ·  2 minute read

Assessing Cloud Service Provider Compliance:

A DoD Contractor's Questionnaire for FedRAMP and DFARS 7012 Compliance

As a contractor, when seeking evidence, confirmation, and validation of a Cloud Service Provider's (CSP) Cloud Service Offering (CSO) FedRAMP status to ensure compliance with DFARS clause 252.204-7012 and the recently released DoD Memorandum titled "Federal Risk and Authorization Management Program Moderate Equivalency for Cloud Service Provider’s Cloud Service Offerings” (published 1/2/2024), you would ask the following questions to the CSP:

DFARS Clause 252.204-7012 Compliance:

  1. FedRAMP Moderate Authorization Status:
    • Is your CSO FedRAMP Authorized?
    • Is the CSO listed on the FedRAMP Marketplace as FedRAMP Moderate Authorized?
  2. FedRAMP Moderate Equivalency Assessment:
    • Has the CSO undergone a FedRAMP Moderate equivalency assessment?
    • Which Third Party Assessment Organization (3PAO) conducted the assessment?
    • Can you provide the complete Body of Evidence (BOE) for FedRAMP Moderate Equivalency as outlined DoD Memorandum titled "Federal Risk and Authorization Management Program Moderate Equivalency for Cloud Service Provider’s Cloud Service Offerings”?
    • For FedRAMP Moderate equivalency, when was the last 3PAO assessment performed?
    • Are there any Plan of Action and Milestones (POA&M) resulting from the FedRAMP Moderate equivalency assessment, and if so, when are they expected to be remediated/resolved?
  3. DFARS Clause 252.204-7012 Paragraph (c) Through (g) Compliance:
    • How does the CSP comply with DFARS clause 252.204-7012 paragraphs (c) through (g), cyber incident reporting, malicious software, media preservation and protection, access to additional information and equipment necessary for forensic analysis, and cyber incident damage assessment?
  4. Customer Responsibility Matrix (CRM):
    • Have you prepared a Customer Responsibility Matrix (CRM) for the CSO outlining the inherited and shared cybersecurity requirements?
    • Can you provide the latest approved version of the CRM?
  5. Incident Response Plan:
    • Can you confirm that you, the CSP, have a comprehensive incident response plan (IRP)? Specifically, what is the defined process for reporting incidents to clients/contractors? Can you point out the section of the IRP, provided as part of the BoE, that defines this process?
    • How do you ensure that notifications are provided to the contractor in the event of a compromise?
    • Can you outline the process for reporting incidents, and what information is shared with the contractor?

In your pursuit of compliance with DFARS clause 252.204-7012 and the recent DoD Memorandum on FedRAMP Moderate Equivalency, navigating the intricacies of CSP compliance and documentation is crucial. Should you find yourself facing challenges in effectively communicating your questions or requirements to CSPs, or if you require assistance in deciphering CSP answers and provided Body of Evidence (BOE), we are here to help. Our experienced team understands the complexities of cloud security compliance and can provide valuable support. Don't hesitate to reach out to us for expert guidance and assistance in ensuring that your interactions with CSPs align seamlessly with regulatory requirements.

Please contact us if you need support!

Contact Us!