Invitation all prospective Third Party Assessment Organizations (3PAO) to attend an Industry Day

The purpose of this announcement is to invite all prospective Third Party Assessment Organizations (3PAO) to attend an Industry Day to obtain details on how to apply to be an accepted Third Party Assessment Organization as part of the Federal Risk and Authorization Management Program (FedRAMP) on December 16th. Under FedRAMP, Cloud service providers (CSPs) will have to provide an independent verification and validation (IV&V) of the security implementations required by FedRAMP through a 3PAO. FedRAMP will accredit 3PAOs for CSPs to use to meet FedRAMP requirements. Please see FBO announcement QTALY001 for more information about the 3PAO application. What: FedRAMP Industry Day When: December 16, 2011 Time: 8:30am-1:00pm Location: GSA, 1275 1st Street NE, Washington DC 20475, Room 201 Registration: FedRAMP.gov/3PAO The Federal Risk and Authorization Management Program (FedRAMP) is a unified government-wide risk management program focused on security for cloud-based systems. FedRAMP will provide a standard approach for conducting security assessments of cloud systems based on an accepted set of security controls and consistent processes. Per OMB policy, agencies acquiring cloud services are required to use FedRAMP. The FedRAMP controls and processes have been vetted and agreed to by agencies across the Federal government. This standardized approach will allow Agencies to leverage security assessments for cloud services. This "approve once, and use many" approach will save cost, time, and staff required to conduct redundant, individual Agency security assessments. CSPs that go through FedRAMP must use 3PAOs to provide an independent verification and validation (IV&V) of the security implementations required by FedRAMP. FedRAMP provisional authorizations must include an assessment by a FedRAMP accredited 3PAO to ensure a consistent assessment process. FedRAMP will use a conformity assessment process to accredit 3PAOs. Conformity assessment is a "demonstration that specified requirements relating to a product, process, system, person or body are fulfilled." (Source: ISO/IEC 17000). Conformity assessment is built on a set of internationally recognized standards that help ensure that the program consistently supports the appropriate level of rigor and independence required. To become an accredited 3PAO under FedRAMP, 3PAOs will have to submit applications that demonstrate that they meet: - 1. Demonstrated technical competence in the security assessment of cloud-based information systems; and - 2. The requirements based on ISO/IEC 17020:1998 for organizations performing inspections. This Industry Day will provide further detail on the role of 3PAOs within FedRAMP, key requirements for 3PAOs the application process for 3PAO's, and the criteria by which applications will be evaluated. Pre-registration is required as space is limited and there is a security check at the door. Please register for the event by COB December 14, 2011. To register, please visit FedRAMP.gov/3PAO. Maximum of 2 representatives per company. No food or drinks. Please note that a strict policy of non-attribution will be followed at this event. Without the express permission of an individual speaker, nothing he or she says will be attributed to that speaker directly or indirectly in the presence of anyone who was not authorized to attend the event. Questions and clarifications about the application process and materials that potential 3PAOs would like to be addressed at the industry day should be submitted to 3PAO@FedRAMP.gov by 5:00pm EST December 14, 2011.