Are cloud service providers (CSPs) required to use a FedRAMP recognized third party assessment organization (3PAO)?

For the FedRAMP Authorization process, the assessment organization must be a FedRAMP recognized 3PAO.For the Agency Authorization process, a 3PAO is recommended, but not required. A CSP’s agency partner may choose to use their own independent assessment organization to assess the system. If an agency chooses to use their own independent assessment organization, the Agency Authorizing Official must submit an attestation regarding the organization’s impartiality and independence. The independent assessment organization must use the most current FedRAMP templates for the assessment and follow all FedRAMP requirements.