Federal Risk and Authorization Management Program (FedRAMP)
FedRAMP is the US government's standardized program for assessing, authorizing, and continuously monitoring the security of cloud services used by federal agencies. The program's core idea is reuse: a cloud service is assessed and authorized once, and every agency can then rely on that authorization through the FedRAMP Marketplace instead of running its own review.
Who Needs It
Any cloud service provider (CSP) that wants federal agencies as customers. Federal policy requires agencies to use FedRAMP-authorized cloud services for federal data, so authorization functions as a market-access requirement: without it, agencies generally cannot buy your product. This applies to SaaS, PaaS, and IaaS offerings alike, and it extends to providers whose products sit inside another authorized offering's boundary.
The investment is substantial. Expect to define a precise authorization boundary, implement the applicable NIST SP 800-53 baseline, undergo assessment by an accredited Third Party Assessment Organization (3PAO), and commit to ongoing continuous monitoring (vulnerability scanning, deviation reporting, and plan-of-action management). Many providers stand up a dedicated federal environment rather than bringing their entire commercial platform into scope.
Impact Levels
Services are categorized under Federal Information Processing Standards (FIPS) 199 by the impact a loss of confidentiality, integrity, or availability would have. Each level maps to a baseline of controls drawn from NIST SP 800-53 Revision 5.
| Level | Rev5 Controls | Typical Data |
|---|---|---|
| Low | 156 | Publicly releasable or low-sensitivity federal data |
| Moderate | 323 | Most federal data, including controlled unclassified information; the most common level |
| High | 410 | Data where compromise could be severe or catastrophic: law enforcement, emergency services, health systems, financial systems |
A tailored Low baseline (LI-SaaS) exists for low-risk SaaS tools that do not store personally identifiable information beyond login credentials.
Authorization Paths
The traditional path is agency authorization: a federal agency sponsors the service, a 3PAO performs the assessment, the agency reviews the package and issues an Authority to Operate (ATO), and the service is listed on the Marketplace for other agencies to reuse. Continuous monitoring obligations then apply for as long as the authorization is held.
The Joint Authorization Board (JAB), which previously issued provisional authorizations for widely used services, was retired following the FedRAMP Authorization Act; program governance now sits with the FedRAMP Board. New entrants today choose between agency sponsorship under the Rev5 baselines and the newer FedRAMP 20x path described below.
FedRAMP 20x
FedRAMP 20x is GSA's modernization of the program, launched in March 2025. It replaces document-centric, point-in-time assessment with automated, machine-readable validation:
- Security posture is expressed through Key Security Indicators (KSIs) that can be validated automatically and near-continuously, rather than through hundreds of pages of narrative documentation
- The program aims for the large majority of requirements to be validated by automation, with machine-readable packages (including Open Security Controls Assessment Language (OSCAL)-based formats) replacing manual review
- Existing commercial assurance work, such as System and Organization Controls 2 (SOC 2) and International Organization for Standardization (ISO) 27001, can be leveraged as evidence rather than repeated
- Continuous reporting replaces annual assessments as the primary assurance mechanism
The rollout has been phased: a Low-impact pilot completed in 2025, a Moderate-impact phase completed in early 2026, and broader adoption is underway, with GSA planning to wind down the legacy Rev5 assessment process by mid-2027. Authorized 20x services already appear on the Marketplace. The program is evolving quickly, so we recommend checking fedramp.gov for the current state before committing to a path.