Compliance Glossary

Cloud Service Offering (CSO) refers to a specific product or service provided by a cloud service provider (CSP) to the federal agencies in the USA. 

Cloud Service Providers (CSPs) must determine if their Cloud Service Offering (CSO) is for government use only, available to the public, private, or a hybrid cloud setup. Additionally, CSOs are classified into three impact levels—Low, Moderate, or High—and evaluated across three key security objectives: confidentiality, integrity, and availability.

FedRAMP has made it easier for CSOs to conduct business with federal agencies in the United States by creating a standard security authorization. Now, CSOs are able fulfill the needs of various agencies after getting authorized by the FedRAMP PMO (Program Management Office). Once a cloud service offering acquires the FedRAMP approved designation, it is listed the FedRAMP marketplace for federal agencies to browse through available and secure services. 

The JAB (Joint Authorization Board) selects up to 8 CSOs each year to focus on for FedRAMP JAB authorization. If a 3PAO can confirm that a CSO is ready for this process, they may submit a Readiness Assessment Report (RAR) to the FedRAMP PMO. Once the FedRAMP PMO approves the RAR, the CSO is listed as FedRAMP Ready on the FedRAMP Marketplace.