Agency and FedRAMP access
What this repository holds
- The Certification Package Overview (also public at /trust/cpo.json)
- The Security Decision Record: a decision for every applicable FedRAMP rule and every Key Security Indicator, with the validation methods and evidence
- The Minimum Assessment Scope boundary package, the cryptographic module list and the logging list
- Ongoing Certification Reports and the snapshot of the certification data taken with each one
- Significant change notifications with their impact analyses, and incident reports for affected agencies
- FedRAMP Certification Reports, published unmodified within 2 weeks of receipt
Human-readable and JSON forms of every item are generated from the same source, so they cannot drift apart.
How to request access
Email security@platformoneinc.com from an official address, naming the agency, the purpose (for example an authorization decision or a continuous-monitoring review) and the people or systems that need access. PlatformOne decides within 1 business day. Access is granted to any U.S. federal agency, or its authorized contractor acting for it, that uses or is evaluating ComplianceONE. FedRAMP is always granted. No non-disclosure agreement is required.
Access is delivered as a link to the ComplianceONE Trust Center carrying a 256-bit random token. The link gives continuing access to everything the grant covers until it is revoked or expires; nobody approves each visit. Every access is logged, and each agency can fetch its own access history. A denial records its reason and is reported to FedRAMP within 5 business days.
What is public without a request
The Certification Package Overview, the public certification data, the service list, the change history, the status page and the Secure Configuration Guide are on the Trust Center for everyone, as pages and as JSON.
Trust Center · Services · Changes · Status · Secure Configuration Guide · Programmatic access · Security