Cloud Service Providers: What OSCs Need to Know
Introduction
At KLC Consulting, Inc., as a C3PAO, we frequently encounter uncertainty among Organizations Seeking Certification (OSCs) about what truly constitutes a CSP under the CMMC Program Rule (32 CFR Part 170). This article – The CSP Definition for CMMC aims to clarify the definition based on the CMMC Program Rule and its reference to NIST 800-145. It provides OSCs with the knowledge they need to ensure compliance.
The CSP Definition for CMMC Foundation: NIST 800-145 and 32 CFR Part 170
The CMMC Program Rule, as defined in 32 CFR Part 170, has been narrowed and now relies on the National Institute of Standards and Technology (NIST) Special Publication 800-145 to define cloud computing (Federal Register pg. 83168, 3rd column, 6th bullet). This standard outlines the essential characteristics that a service must possess to be considered Cloud Service.
The Five Essential Characteristics of a CSP
According to NIST 800-145, a service is classified as Cloud Computing only if it meets all five of the following essential characteristics:
On-Demand Self-Service
- This means users can independently provision computing resources, such as server time and network storage, as needed, without requiring human interaction from the service provider.
- Why it matters: This characteristic is pivotal in distinguishing true cloud services from traditional hosted solutions.
Broad Network Access
- Cloud capabilities are accessible over a network and accessed through standard mechanisms that promote use by diverse thin or thick client platforms (e.g., mobile phones, tablets, laptops, and workstations).
- Why it matters: Access flexibility is a core tenant of cloud computing.
Resource Pooling
- The provider’s computing resources are pooled to serve multiple consumers using a multi-tenant model, with different physical and virtual resources dynamically assigned and reassigned according to consumer demand.
- Why it matters: Efficient resource utilization and scalability are enabled through pooling.
Rapid Elasticity
- Capabilities can be elastically provisioned and released, in some cases automatically, to scale rapidly outward and inward commensurate with demand. To the consumer, the capabilities available for provisioning often appear to be unlimited and can be appropriated in any quantity at any time.
- Why it matters: Cloud services offer the ability to scale resources quickly to meet fluctuating needs.
Measured Service
- Cloud systems automatically control and optimize resource use by leveraging a metering capability at some level of abstraction appropriate to the type of service (e.g., storage, processing, bandwidth, and active user accounts). Resource usage can be monitored, controlled, and reported, providing transparency for both the provider and consumer of the utilized service.
- Why it matters: Transparency and accountability are ensured through measured service.
The Critical Role of On-Demand Self-Service
Among these characteristics, On-Demand Self-Service stands out as a crucial differentiator. In practical terms:
- Cloud Computing Defined: If a customer can sign up, pay, and begin using a service within minutes, almost entirely through automated processes, it likely qualifies as cloud computing.
- Non-Cloud Services: Conversely, if the provider must manually configure systems, gather specific requirements, or customize solutions before granting access, the service does not align with the NIST 800-145 definition of cloud computing.
The CSP Definition for CMMC: Why This Distinction Matters for CMMC
Accurately identifying whether a provider operates as a true CSP under 32 CFR Part 170 directly impacts the scope and requirements of your CMMC assessment.
According to 32 CFR Part 170, the implications for an OSC and ESP if their ESP qualifies as a CSP are as follows:
Implications for OSC
If an OSC uses a CSP to process, store, or transmit CUI, then the CSP must meet the FedRAMP Moderate Baseline requirements in DFARS clause 252.204-7012. The OSC needs to document in its System Security Plan (SSP) how the OSC meets requirements assigned to it in the CSP’s Customer Responsibility Matrix (CRM)
Implications for ESP
If an ESP qualifies as a CSP, and the ESP processes, stores, or transmits CUI, then the CSP must meet the FedRAMP Moderate Baseline requirements. If the ESP qualifies as a CSP, and does not process, store, or transmit CUI, then the CSP is not required to meet FedRAMP requirements.
Entities that are not Cloud Service Providers
32 CFR Part 170 provides the following examples of entities that are not Cloud Service Providers:
- An ESP that provides technical support services to its clients without hosting its own cloud platform offering would be considered a Managed Service Provider (MSP), not a CSP. An ESP may utilize cloud offerings to deliver services to clients without being a CSP.
- An ESP that manages a third-party cloud service on behalf of an OSC would not be considered a CSP.
Resource Link: 32 CFR Part 170
Questions about the CSP Definition for CMMC?
If you have questions about CMMC compliance or need assistance in evaluating your cloud service providers, contact KLC Consulting, Inc. We are here to help you navigate the complexities of cybersecurity and achieve your certification goals.
Arrange a call with us anytime at your convenience. We look forward to talking with you 🌞
