General RFI / RFP Comments on Cloud SOWs for consideration

# Question/Comment on FedRamp RFI Directory

## Name and Affiliation
{please provide information about your job/role as well as your organization}
Maria Horton, CEO, FedRAMP PM for EmeSec
## Cloud Services
{please provide any questions or comments about general cloud services}

A number of RFIs and RFPs EmeSec has reviewed asks for 3PAO independent services to conduct ST&E in accordance with NIST SP 800-53. The overall descriptions and process follow NIST and agency guidelines except for the requirement of being a 3PAO. From a positive perspective, the credential for 3PAO is positive, however the use of prior A&A, ST&E testing suggestions a lack of buy-in into the newer FedRAMP publicly published forms and templates reducing use across agencies. Examples of these agencies at a high level would be DLA, FDIC and some in the IC community.

Another GSA RFI (Login.Gov) seemed to mix whether the organization was providing consulting or testing or both did not reflect the into of the FedRAMP PMO and A2LA certification for separation and protection of COI efforts. The RFI has not been updated and released a second time yet.

A number of clients come to us asking about whether FedRAMP certification in the RFP or RFI means obtained now, must have now or is there a period of obtaining the certification. My recommendation is that Contracting Personnel and Program Managers be encouraged to be specific about the certification as current, obtained upon award or obtained within 6 months of award. As a 3PAO, we have reviewed several RFIs for interpretation purposes.

## Cloud Security
{please provide any questions or comments about cloud security and guidance for ensuring appropriate security levels are achieved}

## FedRAMP PMO
{please provide any questions or comments about FedRAMP and how the PMO can support your acquisition efforts}

## Additional Question/Comment
{ask away!}