What Is FedRAMP?

FedRAMP is the United States programme that standardises security assessment and authorisation for cloud services used by federal agencies. A cloud provider obtains authorisation once and agencies may then reuse it.

For a software vendor it is a market access requirement rather than a security framework: without it, federal agencies generally cannot buy the service.

Impact levels

Low, moderate and high, determined by the sensitivity of the data the service will handle and the consequence of compromise. The control baseline grows substantially at each level.

Moderate covers most agency use and is where most vendors aim. A streamlined path exists for low-impact services with limited functionality, which is considerably cheaper and correspondingly narrower in what it permits.

The two authorisation routes

An agency sponsorship route, where a federal agency acts as sponsor and issues the authorisation. This requires finding an agency with both the need and the willingness to invest in the process.

A programme-level route producing a provisional authorisation recognised across agencies. This does not require a sponsor and is more competitive to enter. Either way an accredited assessment organisation performs the assessment.

Cost and timeline are substantial

Authorisation commonly takes one to two years and costs run to seven figures for moderate impact when internal effort, remediation, assessment fees and advisory support are combined.

Continuous monitoring afterwards is an ongoing obligation with its own cost: monthly scanning and reporting, annual assessment, and significant change notification. This is not a one-off investment.

What it demands architecturally

Boundary definition, so that what is authorised is unambiguous. Use of authorised underlying services, since building on an unauthorised platform undermines the whole assessment.

Validated cryptography, comprehensive logging, and personnel requirements including screening and in some cases citizenship constraints. Several of these have architectural consequences that are expensive to retrofit.

The related programmes

State-level programmes exist with reciprocity arrangements recognising federal authorisation. Defence cloud requirements add further impact levels above the civilian baselines.

FISMA is the underlying statutory obligation on agencies; this programme is how cloud services are assessed against it consistently rather than agency by agency.

Continuous monitoring is the ongoing obligation

Authorisation is the beginning. Monthly vulnerability scanning with reporting against remediation timeframes, annual assessment of a subset of controls, and notification of significant changes before they are made are all continuing requirements.

Remediation timeframes are prescribed by severity and are shorter than many commercial organisations operate to. Sustaining that cadence is an operational commitment that outlasts the authorisation project and needs staffing accordingly.

Reuse is the whole economic argument. Once authorised, the package is available in a repository for other agencies to review and accept, which means the second and subsequent agency adoptions cost a fraction of the first. A vendor with one authorisation and no further federal customers has paid for the hardest part and captured the least value from it.

Where to start

Establish whether federal revenue justifies the investment, and whether an agency sponsor is realistically available. Those two answers determine whether this is a project or an aspiration.

See the authorisation path for SaaS providers. GuardsArm delivers FedRAMP compliance.