FedRAMP

The foundational catalog of security and privacy controls that all FedRAMP-authorized cloud services must implement. Controls are organized into 20 families including Access Control (AC), System and Communications Protection (SC), and Audit and Accountability (AU).

• Low Impact: 125 controls for systems where data loss has limited adverse effects
• Moderate Impact: 325 controls covering 80% of federal cloud systems
• High Impact: 421 controls for systems protecting sensitive law enforcement, financial, or health data

Each control specifies parameters, implementation guidance, and assessment procedures that third-party assessment organizations (3PAOs) use to verify compliance.

The comprehensive document that describes how a Cloud Service Provider (CSP) implements each required security control within its system boundary. The SSP serves as the single source of truth for assessors and authorizing officials.

Key components include:

• System Boundary Diagram: Visual representation of all interconnected system components, data flows, and external connections
• Control Implementation Summary: Detailed narrative for each NIST 800-53 control explaining the technical, operational, and management mechanisms in place
• Roles and Responsibilities: Clear delineation between CSP responsibilities and federal agency customer responsibilities under the shared responsibility model

The SSP must be updated whenever significant architectural changes occur and is reviewed during annual assessments.

An independent evaluation conducted by an A2LA-accredited 3PAO that validates a CSP's security implementation against FedRAMP requirements. The assessment follows the FedRAMP Security Assessment Plan (SAP) and produces a Security Assessment Report (SAR).

The assessment process includes:

• Document Review: Examination of policies, procedures, and configuration artifacts
• Technical Testing: Vulnerability scanning, penetration testing, and configuration validation
• Interviews: Verification with system administrators and security personnel

The resulting SAR identifies findings categorized as High, Moderate, or Low risk, and includes a Plan of Action and Milestones (POA&M) for remediation tracking. Only after the 3PAO attests to compliance can the authorization process proceed.

The ongoing set of activities that maintain a CSP's security posture after initial authorization. FedRAMP mandates that CSPs submit monthly vulnerability scan results, annual penetration tests, and significant change requests for any architectural modifications.

Core ConMon deliverables include:

• Monthly Continuous Monitoring Reports: Vulnerability scan summaries, incident reports, and deviation tracking
• Annual Security Assessments: Full re-evaluation of a subset of controls by the 3PAO
• POA&M Management: Regular updates on remediation progress with binding deadlines (30 days for High, 90 days for Moderate findings)

Failure to maintain ConMon requirements results in a revocation of the Provisional Authority to Operate (P-ATO). This lifecycle approach ensures that authorization is not a one-time event but a sustained operational commitment.

The public registry of all FedRAMP-authorized cloud services, maintained at marketplace.fedramp.gov. CSPs can pursue authorization through two primary paths:

• Joint Authorization Board (JAB) Provisional ATO: Prioritized for services with broad government-wide demand. The JAB—comprising CIOs from DOD, DHS, and GSA—conducts the review, resulting in a P-ATO that any agency can leverage
• Agency Authorization: A specific federal agency sponsors and authorizes a cloud service for its own use. The authorization package can then be listed on the Marketplace for other agencies to reuse

As of 2024, the Marketplace lists over 300 authorized services across IaaS, PaaS, and SaaS categories. Agencies are required to select from Marketplace offerings unless they issue an explicit waiver.

A streamlined authorization path designed specifically for Low-Impact Software-as-a-Service (LI-SaaS) applications that handle publicly releasable or low-sensitivity data. This framework reduces the control burden from 325+ to approximately 36 core controls.

Key characteristics:

• Self-Attestation Option: CSPs can self-assess and attest to compliance without a full 3PAO assessment, though a 3PAO review is still encouraged
• Readiness Assessment Report (RAR): A lighter-weight document demonstrating the CSP's capability to meet the Tailored baseline
• Continuous Monitoring Lite: Reduced reporting requirements appropriate for low-risk systems

This path enables collaboration tools, project management platforms, and other productivity SaaS to achieve FedRAMP compliance without the cost and timeline of a full Moderate authorization.