Skip to content
Documentation

FedRAMP

What it is

The Federal Risk and Authorization Management Program — the US government’s standardized program for assessing and authorizing cloud products and services. A cloud service is assessed once and reused by many federal agencies (“do once, use many times”).

Who it applies to

Cloud Service Providers (CSPs) selling cloud offerings (SaaS, PaaS, IaaS) to US federal agencies. It does not apply to on-prem federal systems (that’s plain FISMA), and a purely commercial company cannot obtain it without a federal customer.

Disclaimer. Not legal/compliance advice. FedRAMP is mid-transition (see FedRAMP 20x). Verify against fedramp.gov before relying on any figure. Verified 2026-05-29.

Why it’s the framework to build toward

FedRAMP is built directly on NIST SP 800-53 Rev 5, the most comprehensive US control catalog. FedRAMP High is the strictest cloud baseline in common use. Implement those controls and you have, in effect, pre-satisfied most of SOC 2, ISO 27001, StateRAMP, and CMMC Level 2. Build the hard one once; map down to the rest.

FedRAMP was codified by the FedRAMP Authorization Act, enacted as part of the FY2023 National Defense Authorization Act (Dec 2022). The Act:

  • Made FedRAMP statutory (it began in 2011 by OMB memo).
  • Established the FedRAMP Board, replacing the former Joint Authorization Board (JAB).
  • Created a presumption of adequacy: once a service is authorized, agencies should reuse that authorization rather than re-assess.
  • Charged GSA with running the FedRAMP Program Management Office (PMO).

The impact levels

A system’s level is set by FIPS 199 categorization of the data it handles, across confidentiality, integrity, and availability (the “high-water mark” of the three):

LevelUse when a breach would cause…NIST 800-53 Rev 5 controls (approx.)
LowLimited adverse effect156
Li-SaaSLow-impact SaaS (tailored Low for simple apps)~156 (tailored subset)
ModerateSerious adverse effect — most federal data lands here323
HighSevere or catastrophic effect (e.g., law enforcement, health, financial, emergency services)410

Control counts are from the FedRAMP Rev 5 baselines released May 30, 2023. Verify the live numbers on fedramp.gov/rev5-transition — they shift as control families are revised by RFC.

Most commercial-to-government SaaS targets Moderate. Target High when handling the most sensitive unclassified data, or to maximize reuse across agencies. This platform’s FRD builds to High.

The authorization path

Since the JAB path was retired (Aug 2024), there is effectively one traditional path:

  1. Agency Authorization (ATO). A sponsoring federal agency reviews the package and issues an Authorization to Operate. Other agencies can then reuse it.
  2. Historically a CSP could also pursue a JAB Provisional ATO (P-ATO) — this path is closed.

What you produce (the package)

  • System Security Plan (SSP) — documents every control and how it’s met. The central artifact.
  • Security Assessment Plan/Report (SAP/SAR) — produced by an independent Third-Party Assessment Organization (3PAO).
  • Plan of Action & Milestones (POA&M) — tracked list of open findings and remediation dates.
  • Supporting policies, a boundary diagram, data-flow diagrams, an incident response plan, contingency plan, and a FIPS 199 categorization.

Continuous Monitoring (ConMon)

Authorization is not one-and-done. CSPs must maintain it: monthly vulnerability scans (OS, web, database), monthly POA&M updates, annual assessment, and significant-change requests. Lapsing ConMon can cost the authorization.

FedRAMP 20x — the 2025–2026 transition

FedRAMP is actively being overhauled. “FedRAMP 20x” (announced 2025) re-architects the program around:

  • Machine-readable security documentation in OSCAL (NIST’s Open Security Controls Assessment Language) instead of static PDFs — enabling automated validation.
  • Continuous, automated compliance over point-in-time review.
  • Faster authorization via standardized key security indicators (KSIs).

Status (as of 2026-05)

20x is in pilot/rollout. The Phase 2 pilot runs through roughly March 31, 2026; consolidated 20x rules are expected around mid-2026 (FY26 Q3), with the broad application pipeline opening later in 2026. Treat 20x specifics as moving targets — confirm on fedramp.gov/20x.

Implication for builders

Invest early in OSCAL-native documentation and automated evidence collection. That’s why the platform pairs this with an OSCAL evidence viewer FRD and treats the SSP as a generated artifact, not a hand-written Word doc.

What it demands of your software (high level)

FedRAMP inherits the NIST 800-53 control families. The ones with the heaviest engineering impact:

  • IA (Identification & Authentication): phishing-resistant MFA, PIV/CAC support, NIST 800-63 assurance levels.
  • AC (Access Control): RBAC/least privilege, session control, separation of duties.
  • AU (Audit & Accountability): tamper-evident audit logs, defined retention.
  • SC (System & Communications Protection): FIPS 140-3 validated cryptography, TLS 1.2+/1.3, boundary protection.
  • CM (Configuration Management): hardened baselines (CIS/DISA STIG), change control.
  • SI (System & Information Integrity): vulnerability scanning, flaw remediation timelines.
  • CP / IR (Contingency & Incident Response): backups, DR, US-CERT reporting.

See the FRD for these as concrete, à-la-carte build modules.

Data residency: FedRAMP data generally must stay within the US and be handled by US persons; many CSPs run a dedicated GovCloud boundary separate from their commercial offering.

Sources (verified 2026-05-29)

ClaimSource
Program overview, baselines, ConMonfedramp.gov
Rev 5 baseline control counts (Low 156 / Mod 323 / High 410), released 2023-05-30FedRAMP Rev 5 transition
FedRAMP 20x initiative, OSCAL, phase timelinefedramp.gov/20x
JAB path discontinued (Aug 2024); Agency Authorization is the pathFedRAMP PMO / 20x announcements
FedRAMP Authorization Act (FY2023 NDAA)GSA FedRAMP
FIPS 199 categorizationNIST FIPS 199