Module 8 Cloud, FedRAMP, and Third-Party Risk
What you will be able to do
- Explain what an agency still owns when it uses an external service, in each cloud service model.
- Describe the current FedRAMP structure, map older terms to it, and read a marketplace listing critically.
- Run a vendor security review and write a request for information and a determination memo.
- Apply supply chain basics at system level, including inventories of software components.
- Decide when an information exchange needs an agreement, and govern applications built on shared platforms.
Lessons
The lessons, exercise, and quiz are for registered learners. Create a free account or sign in to read them.
- 1. Using Someone Else's Service · 35 min Completed
- 2. FedRAMP Today · 45 min Completed
- 3. Assessing a Vendor · 50 min Completed
- 4. Supply Chain Risk Basics · 35 min Completed
- 5. Interconnections and Shared Platforms · 40 min Completed
Practice and quiz
- Practical exercise: A Vendor Request for Information and Determination Memo
- Module quiz (10 questions, pass mark 80 percent)
Overview
No federal system stands alone. This module covers the parts of your system that belong to someone else: cloud providers, software vendors, suppliers of components, partner systems, and shared agency platforms. In each case the question is the same. What are we relying on, what proof do we have, what is still ours to do, and who has accepted the risk?
The module begins where Module 7 ended: with a proposed change to send TreasuryFlow's payee data to a commercial validation service.
Builds on
- Module 7, Lesson 3 and exercise: the security impact analysis that found the validation service to be a significant change.
- Module 4, Lesson 3: documenting inherited and hybrid controls.
- Module 6, Lesson 3: authorization to use.
- Module 5, Lesson 5: commercial audit reports as supporting evidence.
- Module 2, Lesson 2: boundaries, and the two separate questions for small applications.
Lessons
| # | Lesson | Time | Status |
|---|---|---|---|
| 1 | Using Someone Else's Service | 35 min | Adapted from existing material |
| 2 | FedRAMP Today | 45 min | Adapted; time-sensitive |
| 3 | Assessing a Vendor | 50 min | Adapted; composite anonymized cases |
| 4 | Supply Chain Risk Basics | 35 min | New |
| 5 | Interconnections and Shared Platforms | 40 min | Part new, part adapted |
What is binding here, and what is guidance
| Source cited in this module | Kind | Why it has that status |
|---|---|---|
| FISMA | Binding statute | Agency responsibility extends to information and systems handled by others on its behalf |
| FedRAMP Authorization Act | Binding statute | Establishes the program and the presumption of adequacy |
| OMB policy on FedRAMP | Binding policy on agencies | Directs agencies' use of the program; confirm the current memorandum |
| FedRAMP Consolidated Rules for 2026 | Binding on providers seeking or holding FedRAMP status | Program rules; they determine what evidence agencies receive |
| FedRAMP Marketplace | Reference | A listing, not a decision |
| Section 889; Federal Acquisition Supply Chain Security Act orders | Binding law and orders | Flat prohibitions; not open to risk acceptance |
| Federal Acquisition Regulation clauses | Binding in contracts | Carry security terms to vendors |
| Privacy Act requirements for matching and disclosure | Binding statute | Applies when personal information is exchanged |
| NIST SP 800-145, 800-161, 800-218, 800-47, 800-35 | Guidance | Definitions and methods |
| NIST SP 800-53 controls SA-4, SA-9, CA-3, SR family | Guidance, required in practice | Selected in baselines applied through Circular A-130 and FIPS 200 |
| SOC 2 reports, ISO/IEC 27001 certificates | Commercial assurance | Supporting evidence only in a federal context |
| Agency vendor review, interconnection, and platform governance policies | Binding within the agency | Set the forms, tiers, and approval levels you work to |
| The three-tier model for platform applications | Course illustration | An example; agencies set their own |
| Signed agreements and contracts | Binding on the parties | They are the commitments themselves |
Module summary
- Using an external service moves work, never accountability.
- Across infrastructure, platform, and software services the customer always keeps the data, access, customer-side settings, use of outputs, the exit, and the risk decision.
- A provider's FedRAMP status and the agency's decision to use the service are two separate signatures.
- FedRAMP now issues certifications in Classes A to D, through 20x or Rev5 types and Agency or Program paths. Older documents say "authorized" and "Low, Moderate, High." Dates are moving; check the program site.
- A listing is where the review starts: which offering, what status, what class, what scope, how current.
- Assess the use, not the vendor in general. Gather existing evidence, ask a short specific set of questions, analyze fit and gaps, and recommend with conditions. Put requirements in the contract.
- Supply chain risk is inherited trust. Know your components, generate and search software bills of materials, and remember that some prohibitions are not open to risk acceptance.
- Any designed movement of data across a boundary is an information exchange and needs an approved, current agreement.
- Applications on a shared platform inherit a great deal, but never their data decisions, access, connections, or ownership. Tier them and enforce guardrails in the platform.
What comes next
Module 9 covers four areas where federal requirements are moving fastest: Zero Trust, post-quantum cryptography, logging architecture, and artificial intelligence inside authorized systems.
Last reviewed 2026-11-12. Federal requirements, dates, and web addresses change. Before you rely on a date, deadline, or figure, open the source linked in the lesson.