Trust center rules checklist

Official rule: Providers MUST publicly share up-to-date information about the cloud service offering in both human-readable and JSON formats, including at least the following information that is available and applicable:

FedRAMP ID

Service Model

Deployment Model

Business Category

UEI Number

Sales Contact Information

Security Contact Information

Product Website Link

Link to Product Logo (must be a valid image link, properly named, that will display in a browser without processing - transparent PNG preferred)

Overall Service Description

Detailed list of specific services and their security categories (see CDS-CSO-SVC (Public Service List) (Service List))

Link to Secure Configuration Guidance

Overview of documentation supplied by the provider for the cloud service offering

Link to Trust Center landing page that includes instructions on accessing information in the trust center

Next Ongoing Certification Report date (see CCM-OCR-NRD (Next Report Date))

Current FedRAMP Recognized independent assessment service

Official rule: Providers MUST publicly share a detailed list of specific services and their security categories that are included in the cloud service offering using clear feature or service names that align with standard public marketing materials; this list MUST be complete enough for a potential customer to determine which services are and are not included in the FedRAMP Minimum Assessment Scope without requesting access to underlying FedRAMP Certification Data.

Official rule: Providers MUST always include the FedRAMP ID of the related cloud service offering in all FedRAMP Certification Data once assigned, including all reports, notifications, and other communication that results from FedRAMP rules.

Official rule: Providers MUST include FedRAMP Certification Reports with their FedRAMP Certification Data without inappropriate modifications, and make such reports available within 2 weeks of receiving the materials from FedRAMP.

Official rule: Providers with Class C Certifications MUST maintain a web service, available to all necessary parties, that indicates current and historical availability of core services within the cloud service offering over at least the past 30 days, including availability incidents, in both human-readable and machine-readable formats; this service MUST be available even if the primary cloud service offering is unavailable.

Official rule: Providers MUST use a FedRAMP-compatible trust center to store and share FedRAMP Certification Data with all necessary parties.

Official rule: Providers MUST use automation to ensure information remains consistent between human-readable and machine-readable formats when FedRAMP Certification Data is provided in both formats.

Official rule: Providers MUST provide sufficient information in FedRAMP Certification Data to support agency authorization decisions but SHOULD NOT include sensitive information that would likely enable a threat actor to gain unauthorized access, cause harm, disrupt operations, or otherwise have a negative adverse impact on the cloud service offering.

Official rule: Providers MUST supply all relevant policies and procedures in the FedRAMP Certification Data, including a human-readable and machine-readable reference that explains at least the following about each included policy and procedure:

Name of policy or procedure

Name of file, document, web page, etc.

Brief summary of policy or procedure

Word count of document

Current version

Date of last update

Related FedRAMP Practices (if applicable)

Official rule: Providers MUST supply snapshots of FedRAMP Certification Data aligned to Ongoing Certification Reports to all necessary parties; these snapshots MUST be available for the duration of FedRAMP Certification.

Official rule: Providers with Class C Certifications MAY supply per-service FedRAMP Certification materials.

Official rule: Providers MAY responsibly share some or all of the information in a FedRAMP Certification Package publicly or with other parties if the provider determines doing so will NOT likely have an adverse effect on the cloud service offering.

Official rule: Trust centers MUST share FedRAMP Certification Data with all necessary parties without interruption.

Official rule: Trust centers MUST provide documented programmatic access to all FedRAMP Certification Data, including programmatic access to human-readable materials.

Official rule: Trust centers MUST maintain an inventory and history of federal agency users or systems with access to FedRAMP Certification Data and MUST make this information available to FedRAMP upon request.

Official rule: Trust centers MUST log access to FedRAMP Certification Data and store summaries of access for at least six months; such information, as it pertains to specific parties, SHOULD be made available upon request by those parties.

Official rule: Trust centers SHOULD make FedRAMP Certification Data available to view and download in both human-readable and machine-readable formats.

Official rule: Trust centers SHOULD include features that encourage all necessary parties to provision and manage access to FedRAMP Certification Data for their users and services directly.

Official rule: Providers MUST notify FedRAMP within 5 business days of denying an agency access request for FedRAMP Certification Data.

Official rule: Providers SHOULD supply access to the FedRAMP Certification Package with agencies upon request.

Official rule: Providers MUST notify all necessary parties when migrating to a trust center and MUST provide information in their existing USDA Connect Community Portal secure folders explaining how to use the trust center to obtain FedRAMP Certification Data.