IVV-CSF-ACFAssessment of Rev5 Controls with Findings
rev5MUST
Providers MUST have Rev5 Controls with negative findings from the previous FedRAMP independent assessment included in the next FedRAMP independent assessment.
Who it binds
Which certifications it binds
- Certification type
- 20x · Rev5 — this subset states no type restriction
- Path
- Program · Agency — this subset states no path restriction
Evidence this requirement demands
No requirement-specific artifacts — but the defaults below still apply.
5 default artifacts owed by every FRR requirement
- Explanation of how the rule is followed, or an explanation of the reason and resulting risk to customers for not following the rule.
- Verification that the implementation is appropriate for the rule, or that the reason for not implementing is accepted by a senior official.
- Validation that the implementation is in place and working as intended, or that the reason for not implementing is accepted by a senior official.
- Independent verification.
- Independent validation.
Group rev5, subset CSF of Independent Verification and Validation. See all obligations on /obligations or the full evidence plan on /evidence.