FedRAMP is the gateway to selling cloud services to the US federal government. The authorisation process, impact levels, and what the assessment involves.
FedRAMP (Federal Risk and Authorisation Management Program) is the US government's standardised approach to security assessment, authorisation, and continuous monitoring for cloud services. If you want to sell cloud services to US federal agencies, FedRAMP authorisation is a prerequisite. This guide explains the process, the three impact levels, and what the assessment involves.
FedRAMP provides a standardised approach to security assessment for cloud services used by US federal agencies. Rather than each agency conducting its own security assessment, FedRAMP provides a "do once, use many times" framework, a single authorisation that can be reused across multiple agencies.
FedRAMP is based on NIST SP 800-53 security controls, with additional FedRAMP-specific requirements. The number of controls required depends on the impact level, Low, Moderate, or High, which is determined by the sensitivity of the data the cloud service will process.
FedRAMP authorisation is mandatory for cloud services used by federal agencies. Without it, agencies cannot use your service for federal workloads.
FedRAMP Low applies to cloud services where the loss of confidentiality, integrity, or availability would have a limited adverse effect on agency operations. It requires approximately 125 controls. Most productivity and collaboration tools fall into this category.
FedRAMP Moderate applies to services where a breach would have a serious adverse effect. It requires approximately 325 controls and is the most common authorisation level, covering the majority of federal cloud workloads including those involving personally identifiable information (PII).
FedRAMP High applies to services handling the most sensitive unclassified data, law enforcement, emergency services, financial systems, and health systems. It requires approximately 421 controls and is the most demanding authorisation level.
Agency Authorisation: A federal agency sponsors your authorisation. The agency's Authorising Official (AO) reviews the security package and issues an Authority to Operate (ATO). This is the most common pathway for new FedRAMP authorisations.
FedRAMP Authorisation Board (JAB) Authorisation: The Joint Authorisation Board, comprising the DoD, DHS, and GSA, reviews and issues a Provisional Authority to Operate (P-ATO). This pathway is reserved for cloud services with the broadest potential use across the federal government.
FedRAMP Ready: A designation indicating that a Third Party Assessment Organisation (3PAO) has validated that a CSP's security package is ready for the full authorisation process. Not an authorisation itself, but a useful milestone.
Comprehensive documentation of the cloud service's security controls, system boundaries, and data flows.
Independent assessment by a FedRAMP-accredited Third Party Assessment Organisation covering all applicable controls.
Monthly vulnerability scanning, annual penetration testing, and ongoing reporting to the authorising agency.
FedRAMP-specific incident reporting requirements, notification to US-CERT within one hour of discovery.
Assessment and documentation of all external services and components used by the cloud service.
Background checks and security training for all personnel with access to federal data.
Assess your current security posture against FedRAMP requirements and identify the appropriate impact level.
Identify a federal agency sponsor willing to sponsor your authorisation.
Develop the System Security Plan documenting all security controls and system boundaries.
Engage a FedRAMP-accredited 3PAO to conduct the independent security assessment.
Address findings from the 3PAO assessment and update the security package.
The agency Authorising Official reviews the security package and issues the Authority to Operate.
Netru methodology