FedRAMP reference

FedRAMP glossary

Every term the rules define, with the wording the rules use.

FedRAMP definitions are not decoration. Terms like accepted vulnerability and significant change carry timelines and reporting obligations, and a rule that looks vague usually is not — it is leaning on a term defined here. 75 terms, as published.

Accepted Vulnerability FRD-ACV

A vulnerability that the provider does not intend to fully mitigate or remediate, OR that has not or will not be fully mitigated or remediated within the maximum overdue period in FedRAMP Vulnerability Detection and Response rules.

Also written: accepted vulnerability, accepted vulnerabilities

Vulnerability

Adaptive Change FRD-ADP

A type of significant change that does not routinely recur and does not introduce substantive potential security risks that need to be assessed in depth.

Also written: adaptive, adaptive change, adaptive changes

Significant Changes

Advisor FRD-ADV

An entity that helps a provider understand, prepare for, or maintain FedRAMP Certification without replacing the provider's responsibility or the assessor's independence.

Also written: advisor, advisors

Stakeholder

Agency FRD-AGY

Has the meaning given in 44 U.S. Code § 3502 (1), which is "any executive department, military department, Government corporation, Government controlled corporation, or other establishment in the executive branch of the Government (including the Executive Office of the President), or any independent regulatory agency, but does not include—(A) the Government Accountability Office; (B) Federal Election Commission; (C) the governments of the District of Columbia and of the territories and possessions of the United States, and their various subdivisions; or (D) Government-owned contractor-operated facilities, including laboratories engaged in national defense research and production activities."

Also written: agency, agencies

Stakeholder

All Affected Parties FRD-AAP

All federal entities whose interests are affected directly or are likely to be affected directly in the event of a vulnerability or incident related to federal customer data. This always includes FedRAMP and directly impacted federal customer agencies.

Also written: all affected parties

Stakeholder

All Necessary Assessors FRD-ANA

All entities who participate in the FedRAMP assessment of a cloud service offering in the context of a FedRAMP Certification. This always includes FedRAMP and any FedRAMP Recognized independent assessor contracted by a provider to perform a FedRAMP assessment.

Also written: all necessary assessors

Stakeholder

All Necessary Parties FRD-ANP

All entities whose interests are affected directly by activity related to a specific cloud service offering in the context of FedRAMP Certifications. This always includes FedRAMP and any agency customer who is using the cloud service offering, but may include additional parties depending on agreements made by the cloud service provider (such as consultants or independent assessors). Potential agency customers or third-party cloud service providers should also be included in most cases but this is not a mandatory requirement under FedRAMP because the cloud service provider may choose who they wish to do business with.

Also written: all necessary parties

Stakeholder

Artifacts FRD-ART

Security-related materials that supply information regarding or evidence of functions, policies, decisions, procedures, operations, or other such activities, for the purposes of obtaining and maintaining a FedRAMP Certification. All such artifacts are considered FedRAMP Certification Data and are included in the FedRAMP Certification Package.

Also written: artifact, artifacts

Certification

Assessor FRD-ASR

An assessor that performs assessment, verification, or validation activities for a cloud service offering seeking to obtain or maintain FedRAMP Certification; FedRAMP is the final assessor for FedRAMP Certification, but FedRAMP Recognized independent assessment services are typically also utilized.

Also written: assessor, assessors

Stakeholder

Certification Class FRD-CCL

The category of assurance that a cloud service offering supplies to federal government customers following FedRAMP Practices, increasing from minimal assurance at Class A to significant assurance at Class D; currently available categories are Class A, B, C, or D.

Also written: Certification Class, Certification Classes

Certification

Certification Class Change FRD-CCC

A type of significant change that is likely to change the FedRAMP Certification class for the entire cloud service offering (e.g. from Class B to Class C or from Class D to Class C).

Also written: certification class change, certification class changes

Significant Changes

Certification Data FRD-CRD

The collective information required by FedRAMP for initial and ongoing FedRAMP Certification of a cloud service offering, including the FedRAMP Certification Package.

Also written: certification data

Certification

Certification Package FRD-CRP

Has meaning from 44 USC § 3607 (b)(8) given to "authorization package", which is "the essential information that can be used by an agency to determine whether to authorize the operation of an information system or the use of a designated set of common controls for all cloud computing products and services [certified] by FedRAMP."

Also written: certification package, certification packages

Certification

Certification Path FRD-CPH

The underlying source of the FedRAMP Certification, either from a federal agency sponsored authorization to operate or directly from FedRAMP itself. The agency path is a legacy path that is only available for FedRAMP Rev5 and still requires review and approval from FedRAMP.

Also written: Certification Path, Certification Paths

Certification

Certification Profile FRD-CPF

The combination of a FedRAMP Certification Type (Rev5 or 20x), FedRAMP Certification Path (Program or Agency), and FedRAMP Certification Class (A, B, C, or D) for a cloud service offering.

Also written: Certification Profile, Certification Profiles

Certification

Certification Type FRD-CTY

The form of assurance that a cloud service offering supplies to federal government customers following FedRAMP Practices, either Rev5 or 20x. Rev5 follows a legacy approach based primarily on documented plans while 20x follows a modern approach based primarily on measured outcomes.

Also written: Certification Type, Certification Types

Certification

Cloud Service Offering FRD-CSO

A specific, packaged cloud computing product or service supplied by a cloud service provider for use by customers, that is the subject of a FedRAMP Certification.

Also written: cloud service offering, cloud service offerings

Debilitating Customer Effect FRD-DCE

An unwanted customer effect that interrupts use of the cloud service for most users or compromises the integrity or confidentiality of most federal customer data. If the adverse customer effect is unknown then it should be treated as if it is debilitating until proven otherwise.

Also written: debilitating customer effect, debilitating customer effects

Customer Effect

Deterministic Telemetry FRD-DTM

Verifiable data collected directly from an authoritative source that represents a factual and reproducible observation of the attributes of a system such as the system's state, configuration, or behavior.

Also written: deterministic telemetry

Disruptive Customer Effect FRD-DCF

An unwanted customer effect that interrupts use of the cloud service for many users for less than 24 hours, or that compromises the integrity or confidentiality of large amounts or many types of federal customer data.

Also written: disruptive customer effect, disruptive customer effects

Customer Effect

Drift FRD-DFT

Changes to information resources that cause deviations from the intended and assessed state; common forms of drift include changes to configurations, deployed software, privileges, running processes, and availability.

Also written: drift, drifts, drifting

False Positive Vulnerability FRD-FPV

A detected vulnerability that is not actually present in an exploitable state in the information resource

Also written: false positive vulnerability, false positive vulnerabilities

Vulnerability

Federal Customer Data FRD-FCD

All electronic information, content, and materials that an agency or its authorized users upload, store, or otherwise supply to a cloud service for processing or storage. This does NOT include account information, service metadata, analytics, telemetry, or other similar metadata generated by the cloud service provider.

Also written: federal customer data

FedRAMP Certification Report FRD-FCR

A report that is produced by FedRAMP documenting the results of a FedRAMP Certification assessment. This report is typically produced after the initial FedRAMP Certification assessment on the Program Certification Path and updated as necessary during ongoing FedRAMP Certification, but may be produced at any time by FedRAMP as part of ongoing FedRAMP Certification activities for any cloud service offering (such as corrective action). Cloud service offerings must include these reports in their FedRAMP Certification Package.

Also written: FedRAMP Certification Report, FedRAMP certification report, certification report

Certification

FedRAMP Certified FRD-FCT

The status of a cloud service offering that has received FedRAMP Certification and meets the legal requirement to be FedRAMP authorized.

Also written: FedRAMP Certified, FedRAMP certified, certified, FedRAMP authorized, FedRAMP Authorized, authorized

Certification

FedRAMP Independent Assessment FRD-FIN

An independent verification and validation assessment, performed by a FedRAMP Recognized independent assessment service or FedRAMP following FedRAMP rules. These assessments are typically first performed to obtain an initial FedRAMP Certification then repeated on an annual basis to maintain FedRAMP Certification.

Also written: FedRAMP independent assessment, FedRAMP independent assessments

FedRAMP Practices FRD-FPR

The security measures, safeguards, precautions, procedures, activities, policies, capabilities, mechanisms, etc. that are expected to be in place by FedRAMP to demonstrate that information resources are properly protected, expressed in FedRAMP 20x Key Security Indicators or FedRAMP Rev5 Controls and supplemented by FedRAMP rules.

Also written: FedRAMP Practice, FedRAMP Practices

FedRAMP Recognized FRD-FRA

The status of independent assessment services that are recognized by FedRAMP to perform assessment activities on behalf of FedRAMP for cloud service offerings seeking to obtain or maintain FedRAMP Certification.

Also written: FedRAMP Recognized, FedRAMP Recognition

FedRAMP Reportable Incident FRD-FRI

An incident that affects the confidentiality or integrity of federal customer data or is likely to affect the confidentiality or integrity of federal customer data.

Also written: FedRAMP Reportable Incident, FedRAMP Reportable Incidents

Incident

FedRAMP Security Inbox FRD-FSI

An email address that follows the FedRAMP Security Inbox rules.

Also written: security inbox, security inboxes, FSI

Final Incident Report (FIR) FRD-FIR

A final report after recovery from an incident that is supplied by FedRAMP Certified cloud service providers to FedRAMP and agency customers, following FedRAMP Incident Evaluation and Communication rules.

Also written: final incident report, final incident reports, FIR, FIRs

Incident

Fully Mitigated Vulnerability FRD-FMV

A vulnerability where the likelihood of exploitation or Potential Agency Impact N-rating has been reduced from the original evaluation until either are negligible, but the vulnerability is still detected.

Also written: fully mitigated vulnerability, fully mitigated vulnerabilities, fully mitigate vulnerabilities

Vulnerability

Handle FRD-HAN

Has the plain language meaning inclusive of any possible action taken with information, such as access, collect, control, create, display, disclose, disseminate, dispose, maintain, manipulate, process, receive, review, store, transmit, use... etc.

Also written: handle, handles, handled, handling

Incident FRD-INT

Has the meaning given in 44 USC § 3552 (b)(2) which is "an occurrence that (A) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or (B) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies."

Also written: incident, incidents

Incident

Information Resource FRD-IRS

Has the meaning from 44 USC § 3502 (6): "information and related resources, such as personnel, equipment, funds, and information technology." This includes any aspect of the cloud service offering, both technical and managerial, including everything that makes up the business of the offering from non-machine-based information resources like organizational policies, procedures, employees, etc. to machine-based information resources like hardware, software, cloud services, code, etc.

Also written: information resource, information resources

Information Resource

Initial Certification FRD-INC

The first FedRAMP Certification of a cloud service offering based on the applicable FedRAMP Practices.

Also written: initial certification, initial certifications

Certification

Initial FedRAMP Assessment FRD-IFA

The first full assessment of a cloud service offering obtaining FedRAMP Certification, coordinated by the provider with all necessary assessors, that results in a FedRAMP Certification.

Also written: initial FedRAMP assessment, IFRA

Assessment

Initial Incident Report (IIR) FRD-IIR

An initial report about an incident that is supplied by FedRAMP Certified cloud service providers to FedRAMP and agency customers, following FedRAMP FedRAMP Incident Evaluation and Communication rules.

Also written: initial incident report, initial incident reports, IIR, IIRs

Incident

Internet-Reachable Vulnerability (IRV) FRD-IRV

A vulnerability in a machine-based information resource that might be exploited or otherwise triggered by a payload originating from a source on the public internet.

Also written: internet-reachable vulnerability, internet-reachable vulnerabilities, IRV, IRVs, NIRV, NIRVs

Vulnerability

Known Exploited Vulnerability (KEV) FRD-KEV

Has the meaning given in CISA Binding Operational Directive 26-04, which is any vulnerability identified in CISA's Known Exploited Vulnerabilities catalog.

Also written: known exploited vulnerability, known exploited vulnerabilities, KEV, KEVs

Vulnerability

Likely FRD-LKY

A reasonable degree of probability based on context.

Also written: likely, likelihood

Likely Exploitable Vulnerability (LEV) FRD-LEV

A vulnerability that is not fully mitigated AND is reachable by a likely threat actor; AND a likely threat actor with knowledge of the vulnerability would likely gain unauthorized access, cause harm, disrupt operations, or otherwise have an undesired adverse impact within the cloud service offering by exploiting the vulnerability.

Also written: likely exploitable vulnerability, likely exploitable vulnerabilities, LEV, LEVs, NLEV, NLEVs

Vulnerability

Machine-Based (Information Resources) FRD-MBI

Any information technology information resource—including systems, processes, software, hardware, services, cloud-native capabilities, and any other such capability, component, or resource—that relies primarily on mechanical or electronic devices (i.e. computers) for operation.

Also written: machine-based, machine based

Information Resource

Machine-Generated FRD-MGN

Automatically produced by a computer process, application, or other mechanism without the intervention or manipulation of a human during production.

Also written: machine-generated

Machine-Readable FRD-MRD

Has the meaning from 44 U.S. Code § 3502 (18) which is "the term "machine-readable", when used with respect to data, means data in a format that can be easily processed by a computer without human intervention while ensuring no semantic meaning is lost"

Also written: machine-readable

Minimal Customer Effect FRD-MCE

An unwanted customer effect that is only noticeable by some users. This includes minor inconveniences such as reduced performance.

Also written: minimal customer effect, minimal customer effects

Customer Effect

Narrow Customer Effect FRD-NCE

An unwanted customer effect that interrupts use of the cloud service for some users for less than 12 hours, or that compromises the integrity or confidentiality of an extremely limited amount and type of federal customer data.

Also written: narrow customer effect, narrow customer effects

Customer Effect

Ongoing Certification FRD-ONC

The continued FedRAMP Certification of a cloud service offering based on the applicable FedRAMP Practices.

Also written: ongoing certification, ongoing certifications

Certification

Ongoing Certification Report (OCR) FRD-OCR

A regular report that is supplied by FedRAMP Certified cloud service providers to agency customers, following FedRAMP Collaborative Continuous Monitoring rules.

Also written: ongoing certification report, OCR, OCRs

Ongoing Incident Report (OIR) FRD-OIR

A recurring report about an ongoing incident that is supplied by FedRAMP Certified cloud service providers to FedRAMP and agency customers, following the FedRAMP Incident Evaluation and Communication rules.

Also written: ongoing incident report, ongoing incident reports, OIR, OIRs

Incident

Overdue Vulnerability FRD-ODV

A vulnerability that the provider intends to fully mitigate or remediate but has not or will not do so within the time frames recommended or required by FedRAMP.

Also written: overdue vulnerability, overdue vulnerabilities

Vulnerability

Partially Mitigated Vulnerability FRD-PMV

A vulnerability where the likelihood or Potential Agency Impact N-rating has been reduced from the original evaluation but the risk of exploitation still exists and the vulnerability is still detected.

Also written: partially mitigated vulnerability, partially mitigated vulnerabilities, partially mitigate vulnerabilities

Vulnerability

Persistent FedRAMP Assessment FRD-PFA

Follow-on assessments of a cloud service offering focused on Key Security Indicators, coordinated by the provider with all necessary assessors, to maintain FedRAMP Certification or change its FedRAMP Certification class.

Also written: persistent FedRAMP assessment, PFRA

Assessment

Persistently FRD-PER

Occurring in a firm, steady way that is repeated over a long period of time in spite of obstacles or difficulties. Persistent activities may vary between actors, may occur irregularly, and may include interruptions or waiting periods between cycles. These attributes of persistent activities should be intentional, understood, and documented; the status of persistent activities will always be known.

Also written: persistently, persistent

Potential Agency Impact FRD-PAI

The estimated cumulative effect of unauthorized access, disruption, harm, or other adverse impacts to all agencies using the cloud service that are likely to result from security incidents or the exploitation of vulnerabilities in the cloud service offering; as estimated following appropriate FedRAMP rules to calculate the Potential Agency Impact N-rating (PAIN).

Also written: potential agency impact, potential agency impacts, PAIN, Potential Agency Impact N-rating

Privileged Account FRD-PAC

An account with elevated privileges that enables administrative functions over some aspect of the cloud service offering that may affect the confidentiality, integrity, or availability of information beyond those given to normal users; levels of privilege may vary wildly.

Also written: privileged account, privileged accounts

Accounts

Promptly FRD-PRO

Without unnecessary delay.

Also written: promptly, prompt

Provider FRD-PRV

The cloud service provider responsible for a cloud service offering in the context of FedRAMP Certification.

Also written: provider, providers, cloud service provider, cloud service providers

Stakeholder

Quarterly Review FRD-QTR

A regular synchronous meeting hosted by a FedRAMP Certified cloud service provider for agency customers, following FedRAMP Collaborative Continuous Monitoring rules.

Also written: quarterly review, quarterly reviews

Certification

Regularly FRD-RGL

Performing the activity on a consistent, predictable, and repeated basis, at set intervals, automatically if possible, following a documented plan. These intervals may vary as appropriate between different activities.

Also written: regularly, regular

Remediated Vulnerability FRD-RMV

A vulnerability that has been neutralized or eliminated and is no longer detected.

Also written: remediated vulnerability, remediated vulnerabilities, remediate vulnerabilities

Vulnerability

Responsibly FRD-RSP

In a way that shows that you have good judgment and the ability to act correctly and make decisions on your own.

Also written: responsibly

Routine Recurring Change FRD-RTR

The type of significant change that regularly and routinely recurs as part of ongoing operations, vulnerability mitigation, or vulnerability remediation.

Also written: routine recurring, routine recurring change, routine recurring changes

Significant Changes

Security Category FRD-SCT

Has the meaning from NIST FIPS 199, which is "The characterization of information or an information system based on an assessment of the potential impact that a loss of confidentiality, integrity, or availability of such information or information system would have on organizational operations, organizational assets, or individuals." Security categories are often referred to as "impact levels" and include Low, Moderate, and High.

Also written: security category, security categories, impact level, impact levels

Security Decision Record (SDR) FRD-SDR

A persistently maintained, verified, and validated record of the security decisions made by a provider over the lifecycle of a cloud service offering. The Security Decision Record replaces the traditional System Security Plan and documents how applicable FedRAMP Practices are addressed, including implementation rationale, resulting customer risk, assessment findings, and supporting artifacts.

Also written: security decision record, security decision records, SDR

Significant Change FRD-SGC

Has the meaning given in NIST SP 800-37 Rev. 2 which is "a change that is likely to substantively affect the security or privacy posture of a system."

Also written: significant change, significant changes

Significant Changes

Third-Party Information Resource FRD-TPR

Any information resource that is not entirely included in the Minimum Assessment Scope for the cloud service offering obtaining FedRAMP Certification.

Also written: third-party information resource, third-party information resources

Information Resource

Top-Level Administrative Account FRD-TLA

The most privileged account with the highest level of access within a cloud service offering for a customer organization, typically with complete control over all aspects of the cloud service offering, including managing resources, users, access, privileges, and the account itself.

Also written: top-level administrative account, top-level administrative accounts

Accounts

Transformative Change FRD-TRF

The type of significant change that introduces substantive potential security risks that are likely to affect existing risk determinations and must be assessed in depth.

Also written: transformative, transformative change, transformative changes

Significant Changes

Trust Center FRD-TRC

A secure repository or service used by cloud service providers to store and share FedRAMP Certification Data. Trust centers are the complete and definitive source for FedRAMP Certification Data and must follow the FedRAMP Certification Data Sharing rules to be FedRAMP-compatible.

Also written: trust center, trust centers

Validation FRD-VLN

Confirmation through objective evidence that implemented security capabilities and related certification data are suitable for their intended FedRAMP Certification use and support the expected security outcomes for a cloud service offering.

Also written: validation, validate, validated

Verification FRD-VRF

Confirmation through objective evidence that specified FedRAMP Practices have been fulfilled for a cloud service offering.

Also written: verification, verify, verified

Vulnerability FRD-VUL

Has the meaning given to "security vulnerability" in 6 USC § 650 (25), which is "any attribute of hardware, software, process, or procedure that could enable or facilitate the defeat of [...] management, operational, and technical controls used to protect against an unauthorized effort to adversely affect the confidentiality, integrity, and availability of an information system or its information." This includes gaps in Rev5 Controls and 20x Key Security Indicators, software vulnerabilities, misconfigurations, exposures, weak credentials, insecure services, and all other such potential weaknesses in protection (intentional or unintentional).

Also written: vulnerability, vulnerabilities

Vulnerability

Vulnerability Detection FRD-VLD

The systematic process of discovering and identifying security vulnerabilities in information resources through assessment, scanning, threat intelligence, vulnerability disclosure mechanisms, bug bounties, supply chain monitoring, and other capabilities. This process includes the initial discovery of a vulnerability's existence and the determination of affected information resources within a cloud service offering.

Also written: vulnerability detection, detect vulnerabilities, detect, detection, detected

Vulnerability

Vulnerability Response FRD-VLR

The systematic process of tracking, evaluating, mitigating, monitoring, remediating, assessing exploitation, reporting, and otherwise managing detected vulnerabilities.

Also written: vulnerability response, respond to vulnerabilities, respond, response, responded

Vulnerability