The Federal Risk and Authorisation Management Program provides a standardised approach to security assessment, authorisation, and continuous monitoring for cloud products and services used by US federal agencies.
What is FedRAMP?
FedRAMP (Federal Risk and Authorisation Management Program) is a US government-wide programme that provides a standardised approach to security assessment, authorisation, and continuous monitoring for cloud products and services. Any cloud service provider seeking to sell to US federal agencies must obtain FedRAMP authorisation.
FedRAMP is based on NIST 800-53 controls and requires assessment by a FedRAMP-accredited Third Party Assessment Organisation (3PAO). Authorised products are listed on the FedRAMP Marketplace, enabling federal agencies to procure them with confidence.
FedRAMP Rev 5, aligned to NIST 800-53 Rev 5, introduced significant changes including new supply chain risk management and privacy controls, increasing the compliance burden for cloud service providers.
Compliance requirements
FedRAMP requirements are based on NIST 800-53 controls, with additional FedRAMP-specific parameters and requirements for cloud environments.
Implement controls to limit access to federal information systems and data to authorised users, processes, and devices.
Establish and maintain baseline configurations for cloud systems, and control changes through a formal change management process.
Develop, implement, and test contingency plans for cloud systems to ensure continuity of operations and rapid recovery from disruptions.
Establish an operational incident-handling capability, including US-CERT reporting requirements for federal cloud systems.
Conduct risk assessments of cloud systems using FedRAMP-specific methodologies, including continuous monitoring and vulnerability scanning.
Implement controls to protect communications and data in transit and at rest within cloud environments serving federal agencies.
Audit process
Netru manages the complete FedRAMP authorisation journey, from selecting your path through to 3PAO assessment management and continuous monitoring.
We determine the appropriate FedRAMP authorisation path: Agency ATO, Joint Authorisation Board (JAB), or FedRAMP Ready designation.
We categorise your cloud system using FIPS 199 to determine the appropriate impact level (Low, Moderate, or High).
We draft your comprehensive SSP documenting implementation of all applicable NIST 800-53 controls for your impact level.
We manage the engagement with a FedRAMP-accredited Third Party Assessment Organisation (3PAO) to conduct the formal security assessment.
We prepare the Security Assessment Report (SAR) and Plan of Action and Milestones (POA&M) for agency or JAB review.
We support the agency's Authority to Operate (ATO) decision process and manage the FedRAMP Marketplace listing.
We establish and manage the ongoing continuous monitoring programme required to maintain FedRAMP authorisation.
How Netru delivers it
Our team has deep experience navigating the FedRAMP authorisation process. We manage every aspect from SSP drafting to 3PAO liaison, continuous monitoring setup, and Marketplace listing, so you can focus on winning federal contracts.
Talk to our teamBefore you talk to anyone