What to ask before the tool is in the boundary.
These guides are buying questions, not a ranked list and not a set of extra requirements. They do not name products. If the service stores, processes, or transmits CUI in an external cloud, leave this section and use the directory, which is built for that FedRAMP question.
Not legal advice. This is a plain-language reading aid for contractors and the providers who support them. It is not a CMMC assessment, not a FedRAMP determination, and not a substitute for 32 CFR Part 170, the contract, or advice from counsel. Templates and worksheet results are starters. Replace every example with your own facts.
Guide
How to evaluate an SPA tool or service
What to settle before you buy or renew: CUI or not, cloud or not, and which packet of evidence actually applies.
Guide
Evidence, logging, access, and where the data lives
Shared responsibility, logs, administrative access, and storage location, including older log storage.
What you are buying
You are buying a security function that will be in the assessment, plus a written split of duties, plus a way to show where the data lives. You are not buying a FedRAMP package unless the service handles CUI.