FedRAMP
Also known as: Federal Risk and Authorization Management Program, FedRAMP Authorization, ATO, Authorization to Operate
FedRAMP (the Federal Risk and Authorization Management Program) is a US government program that provides a standardized security assessment, authorization, and continuous monitoring process for cloud products and services used by federal agencies.
A cloud service provider that achieves FedRAMP Authorization earns the right to operate in federal environments and can market that authorization to any federal agency, avoiding duplicate security assessments. Authorization is based on NIST SP 800-53 controls scaled to Low, Moderate, or High impact levels.
FedRAMP, explained at three levels
At home
When a US government agency wants to use a cloud service (like cloud storage or a communication platform) federal law requires that the service meet strict security standards to protect government data. FedRAMP is the program that checks those standards in advance, so agencies can choose from a pre-approved list rather than each doing their own security review. It is like a safety certification that a cloud company earns once and can then show to any government agency.
At work
If your organization provides cloud services and wants to sell to US federal agencies, FedRAMP Authorization is effectively mandatory. The program requires a formal security assessment by a Third Party Assessment Organization (3PAO), an Authorization to Operate (ATO) from a sponsoring agency, and ongoing continuous monitoring including monthly vulnerability scanning, annual penetration testing, and security status reporting.
At home
FedRAMP impact levels reflect the potential harm if information is compromised. Low impact covers data whose loss would have limited effects. Moderate impact (the most common level) covers personally identifiable information, financial records, and controlled unclassified information. High impact covers law enforcement data and health systems where unauthorized access could cause severe harm. The higher the impact level, the more controls are required.
At work
For most of FedRAMP's history, a provider reached authorization through a sponsoring agency, which reviewed the 3PAO assessment and issued an ATO that other agencies could then reuse, or through the Joint Authorization Board, a path retired in 2024. FedRAMP 20x, launched in 2025, adds a route built on automated, machine-readable evidence instead of long narrative documents, and as of 2026 it is replacing the traditional process in stages. Either way, continuous monitoring follows: monthly vulnerability scan reports, prompt incident reporting, and annual assessments.
At home
FedRAMP's control baseline is drawn from NIST SP 800-53 Rev 5, with FedRAMP-specific parameters and required evidence types. The System Security Plan (SSP) is the central documentation artifact describing the system boundary, data flows, control implementations, and inherited controls from the cloud infrastructure. FedRAMP-authorized IaaS and PaaS providers publish Customer Responsibility Matrices showing which controls they implement, which customers inherit, and which are shared.
At work
From a practitioner standpoint, the FedRAMP authorization process typically takes 6-18 months and costs $500,000 to $2M+ for the initial assessment. The biggest cost driver is documentation. Cloud-native authorization approaches, where the service is built on an existing FedRAMP-authorized platform and inherits controls, can significantly reduce the new control implementation burden. The FedRAMP Marketplace's 'In Process' designation allows agencies to begin procurement conversations before full authorization is granted.
Real-world examples
At home
Thomas works for a startup that built a document management tool and wants to sell it to the Department of Veterans Affairs. The VA's procurement office told him the product needs FedRAMP Moderate authorization before they can sign a contract. Thomas begins the sponsorship process with the VA as the authorizing agency.
At work
The IT procurement team at the Department of Labor needed to replace an aging collaboration platform. Instead of running a separate security assessment for each shortlisted vendor, they filtered the marketplace to FedRAMP Moderate authorized services, reducing the vendor list from 12 to 4 and cutting procurement timeline significantly.
How it compares
| Feature | FedRAMP | SOC 2 | FISMA |
|---|---|---|---|
| Who it applies to | Cloud service providers selling to US federal agencies | Any service organization (typically SaaS/cloud) | US federal agencies and their information systems |
| Who assesses it | Third Party Assessment Organization (3PAO) | Licensed CPA firm | Inspector General or third-party assessor |
| Mandatory? | Yes for cloud services in federal use | No: voluntary | Yes for federal agencies |
| Control basis | NIST SP 800-53 | AICPA Trust Service Criteria | NIST SP 800-53 |
| Output | Authorization to Operate (ATO) listed in Marketplace | SOC 2 Type I or Type II report | Authority to Operate for federal agency systems |
FedRAMP and FISMA both use NIST SP 800-53 controls but serve different purposes: FedRAMP authorizes cloud products for use across federal agencies, while FISMA governs the security of federal agency information systems themselves. SOC 2 is voluntary and most relevant to commercial B2B markets.
For analysts
In BA artefacts, FedRAMP requirements typically appear as vendor qualification constraints for cloud services in federal or regulated environments. When documenting requirements for a system hosted in the cloud and used by a federal agency, specify the required FedRAMP impact level based on data sensitivity. Flag that the authorization process adds 6-18 months to vendor onboarding timelines: this must be reflected in project planning. Useful constraint: 'The selected cloud platform must hold a current FedRAMP Moderate Authorization to Operate, listed on the FedRAMP Marketplace, before procurement is approved.'
History & origin
FedRAMP was established in 2011 under the Federal Cloud Computing Strategy, which directed agencies to evaluate cloud options before investing in on-premises infrastructure. Before FedRAMP, each agency independently evaluated cloud vendors' security, creating redundant effort and inconsistent standards. The program is managed by the General Services Administration (GSA). The FedRAMP Authorization Act, signed in December 2022, formally codified the program and directed expansion. As of 2024, more than 300 cloud services hold FedRAMP authorization.