Frameworks

What is FedRAMP?

FedRAMP (the Federal Risk and Authorization Management Program) is a US government program that standardizes how cloud services are security-assessed and authorized for use by federal agencies, using a control baseline drawn from NIST SP 800-53.

Definition

FedRAMP is a US federal program that provides a standardized approach to security assessment, authorization, and continuous monitoring for cloud products and services used by government agencies.

Background

Federal agencies buy a lot of cloud software, and FedRAMP exists so each agency does not have to assess the same cloud service from scratch. A cloud service provider is assessed against a control baseline derived from NIST SP 800-53 by an accredited third-party assessor, and receives an authorization at an impact level (commonly Low, Moderate, or High) reflecting the sensitivity of the data involved. An authorization can be sponsored by a federal agency, and once granted, other agencies can reuse the package. The program was put on a statutory footing by the FedRAMP Authorization Act.

Why it matters

FedRAMP is effectively the entry ticket to sell cloud software to US federal agencies. It is rigorous and resource-intensive, so it matters most to vendors targeting the public sector. For SMBs not selling to government, FedRAMP is usually out of scope, but its NIST 800-53 lineage overlaps heavily with commercial frameworks.

Step by step

1. Determine the impact level (Low, Moderate, or High) your service needs based on the data it handles.
2. Implement the corresponding NIST SP 800-53 control baseline.
3. Engage an accredited third-party assessment organization (3PAO) for the security assessment.
4. Obtain an authorization, typically with a federal agency sponsor.
5. Maintain continuous monitoring to keep the authorization current.

Examples

• A SaaS vendor pursuing federal customers gets a FedRAMP Moderate authorization sponsored by an agency, then other agencies reuse that package.
• A vendor with only commercial customers holds SOC 2 and ISO 27001 instead, because FedRAMP is not required outside government.

Common mistakes

• Assuming FedRAMP is needed for commercial (non-government) sales; it generally is not.
• Underestimating the time and cost of a 3PAO assessment and continuous monitoring.
• Confusing FedRAMP with a commercial certification; it is a government authorization, not the same as SOC 2 or ISO 27001.

FAQ