Federal agencies rely heavily on cloud services, from email and collaboration tools to specialized software and infrastructure. To manage the security of those services consistently, the government created the Federal Risk and Authorization Management Program, known as FedRAMP. For companies that sell cloud services to agencies, FedRAMP is often a central requirement.
FedRAMP’s processes have evolved and continue to change, so check fedramp.gov for current requirements. This article provides general background.
What FedRAMP is
FedRAMP was established in 2011 to provide a standardized approach to security assessment, authorization and continuous monitoring for cloud products and services. The idea is “do once, use many times”: a cloud service that has been assessed and authorized can be reused by multiple agencies, reducing duplicated effort. The FedRAMP Authorization Act, enacted as part of the National Defense Authorization Act for fiscal year 2023, codified the program in law. The program is managed within the General Services Administration.
Impact levels
FedRAMP categorizes cloud services according to the potential impact if the confidentiality, integrity or availability of the information they handle were compromised. The levels are generally described as Low, Moderate and High, with a tailored approach available for certain low-impact software-as-a-service offerings. Each level corresponds to a baseline set of security controls drawn from NIST guidance, with more controls at higher levels.
Many federal cloud services fall in the Moderate category, but the right level depends on the data and the mission the service supports.
Paths to authorization
Historically, cloud service providers have pursued authorization primarily through agency sponsorship, in which an agency works with the provider to assess and authorize the service for its use, after which the authorization can be leveraged by other agencies. The program has also used other paths over time and has been developing new, more automated approaches. Because the available paths change, review current guidance before planning your approach.
In general, authorization involves documenting your security controls, undergoing an assessment by an accredited third-party assessment organization and addressing findings. After authorization, providers must perform continuous monitoring, reporting on vulnerabilities and changes over time.
Is FedRAMP right for your company now?
Pursuing FedRAMP authorization is a substantial investment of time and resources. Questions to consider include:
- Do target agencies require FedRAMP authorization for the service you offer?
- Is there an agency interested enough to sponsor your authorization?
- Do you have the engineering and compliance staff to meet and maintain the requirements?
- Could you partner with an authorized provider or build on an authorized platform in the meantime?
Where it fits in your federal strategy
FedRAMP authorization can be a significant differentiator, since agencies can more readily adopt authorized services. The FedRAMP Marketplace lists authorized services and those in process, and it is also a useful tool for researching competitors. Like other compliance programs, FedRAMP rewards early planning. Building security practices into your service from the start is generally easier than retrofitting them later.