Email¶
Email is the primary communication channel between the GRC-ITSM platform and its users. The email system handles incoming ticket creation from emails, outgoing notifications and replies, automated acknowledgments, and template-driven communications.
- General Settings - outgoing email configuration, processing behavior, and global email options
- Mailbox Setup - configuring mailboxes for incoming email processing and outgoing communications
- Email Rules - conditional rules for routing and processing incoming emails
- Email Templates - customizable templates for notifications, replies, and automated communications
Default Mailboxes¶
The GRC-ITSM platform comes pre-configured with a primary service desk mailbox (e.g., servicedesk@organization.com) that serves as the default mailbox for all email processing and notifications. Incoming emails to this address create new tickets or update existing ones, and all outgoing notifications and replies are sent from this address unless overridden by team-specific or mailbox-specific settings.
FedRAMP Security Inbox¶
For organizations operating under a FedRAMP authorization, the platform also includes a dedicated FedRAMP Security Inbox mailbox. This is a mandatory FedRAMP requirement: every FedRAMP-authorized Cloud Service Provider must maintain a dedicated, monitored security email address that serves as a direct communication channel between FedRAMP/GSA and the organization's security team.
The FedRAMP Security Inbox is configured to:
- Receive emails from @fedramp.gov and @gsa.gov without any barriers (no spam filtering, CAPTCHA, or delivery delays for these domains)
- Route emergency-designated messages to senior security officials
- Send automatic acknowledgment of received FedRAMP communications
- Create high-priority tickets for FedRAMP communications requiring action
FedRAMP Security Inbox Compliance
FedRAMP tests the Security Inbox regularly (at least quarterly) by sending messages that require a human response. Failure to respond to Emergency communications within the required timeframes results in corrective action from FedRAMP, which can include suspension from the FedRAMP Marketplace (minimum 30 days) and placement on a public Corrective Action Plan.
Required response timeframes by impact level:
| Impact Level | Response Deadline |
|---|---|
| High | Within 12 hours |
| Moderate | Within 1 business day |
| Low | Within 3 business days |
This requirement is driven by OMB Memorandum M-24-15, Section VII(a)(17), and supports the organization's incident reporting and response capabilities related to FedRAMP controls IR-6 (Incident Reporting), IR-7 (Incident Response Assistance), and the FedRAMP 20x KSI-INR (Incident Response) domain.