RFI for FedRAMP Contract Language

In our efforts to help agencies continue to adopt secure cloud technologies, the GSA Secure Cloud Portfolio has been working to identify barriers for agencies adopting cloud services and in meeting FedRAMP requirements. Over the past decade, Federal policy has consistently pushed forward a “Cloud First” mandate for agencies to default to purchasing cloud products and services for all new IT acquisitions. Additionally, agencies are required to ensure cloud providers meet the FedRAMP requirements when procuring and subsequently authorizing cloud services[^1]. We would like to help agencies acquire cloud services in a way that it is not prohibitive to competition and innovation by hearing from industry regarding cloud contract language. Through the Request for Information (RFI) process The GSA Secure Cloud Portfolio is seeking feedback regarding: How agencies attempt to enforce requirements via contract language: We hope to receive examples , https://github.com/GSA/fedramp/blob/master/rfi-directory/contract_language.md, of both positive and problematic clauses so that we may develop better guidance that leads to better outcomes for both government and industry. We’re also looking for new and creative examples of industry suggested contract language that could be leveraged as well. Reference The information gathered here will be used to identify examples of what agencies should and should not use to incorporate FedRAMP standards into their solicitations. These examples will be used to generate guidance and education to agencies. For more information on additional ways FedRAMP has supported agency acquisitions, please see our Acquisition FAQs , https://s3.amazonaws.com/sitesusa/wp-content/uploads/sites/482/2017/09/FedRAMP-Acquisitions-FAQs.pdf.