"Do Once, Use Many Times"

• Home
• Risk Management
  • RM Concepts
    • Governance Models
    • Mutitiered Views
      • Tier 1 – Organization
      • Tier 2 – Mission/Business Process
      • Tier 3 – Information Systems
    • Trust and Trustworthiness
  • RM Roles and Responsibilities
  • RM Process
    • Framing Risk
    • Assessing Risk
    • Responding to Risk
    • Monitoring Risk
  • Risk Assessments
    • Risk Assessment Fundamentals
    • Risk Assessment Process
      • Preparing for the Risk Assessment
      • Conducting the Risk Assessment
      • Maintaining the Risk Assessment
  • Risk Response Strategies
  • Informing Risk Response
• FedRAMP Process
  • Initiate Request
    • Conduct Security Categorization
      • Step 1: Identify Information Types
        • Mission-Based Information Types
        • Management and Support Information Types
      • Step 2: Select Provisional Impact Levels
      • Step 3: Review and Adjust/Finalize Information Type Impact Levels
      • Step 4: Assign System Security Category
    • Document FIPS-199 Categorization
    • Submit Security Assessment Request Form
    • Document Control Tailoring Workbook (CTW)
    • Document Control Implementation Summary (CIS)
  • Document Security Controls
    • Document System Security Plan
  • Perform Security Testing
    • Selecting an Independent Third Party Assessor
    • Develop Security Assessment Plan
    • Document Security Assessment Results
    • Document Plan of Action and Milestones
  • Finalize Security Assessment
  • Continuous Monitoring
    • Continuous Monitoring Program
    • Change Control Process
    • Operational Visibility
    • Incident Response
• JAB
  • Charter
  • Security Controls
    • AC
    • AT
    • AU
    • CA
    • CM
    • CP
    • IA
    • IR
    • MA
    • MP
    • PE
    • PL
    • PS
    • RA
    • SA
    • SC
    • SI
  • Privacy Controls
    • TR
    • IP
    • AP
    • DM
    • UL
    • DI
    • SE
    • AR
  • Security Controls Maintenance
• PMO
  • FedRAMP Document Hierarchy
  • CONOPs
    • Definition/Purpose
    • Workflow
    • Stakeholders
    • Governance/Roles
    • High Level Operations
    • Using the Program
    • Third-Party Assessment Organizations
    • Security Assessments
    • Leveraging the Provisional Authorization
    • Ongoing Assessment and Authorization (Continuous Monitoring)
  • Contracts/SLAs
  • ATO Repository
• NIST
  • Cloud Computing Program
  • Risk Management Framework (RMF)
    • RMF Roles and Responsibilities
    • RMF Steps
      • Step 1: Categorize Information System
      • Step 2: Select Security Controls
      • Step 3: Implement Security Controls
      • Step 4: Assess Security Controls
      • Step 5: Authorize Information System
      • Step 6: Monitor Security Controls
  • RMF Online Training
  • SDLC
    • Initiation Phase
    • Development/Acquisition Phase
    • Implementation/Assessment Phase
    • Operation/Maintenance Phase
    • Disposal Phase
• DHS
  • Continuous Diagnostics and Mitigation
  • Trusted Internet Connection
  • US-CERT
• Resources
  • CSA GRC Stack
    • Using the CCM within FedRAMP
    • Using CloudAudit within FedRAMP
  • Cloud Working Groups
  • Federal IT Policy Evolution
  • 25 Point Implementation Plan
    • Apply Light Technology and Shared Solutions
    • Strengthen Program Management
    • Align the Acquisition Process with the Technology Cycle
    • Align the Budget Process with the Technology Cycle
    • Streamline Governance and Improve Accountability
    • Increase Engagement with Industry
  • Federal Cloud Computing Strategy
  • Federal IT Shared Services Strategy
    • Implementation Strategy
    • Policy Considerations
    • Federal Governance for IT Shared Services
    • Design Principles
  • FISMA
  • References
• FAQ

Home » FedRAMP Document Hierarchy