FedRAMP
The Federal Risk and Authorization Management Program — the standardized US government process for authorizing cloud services for federal agency use, built on NIST SP 800-53 controls at Low, Moderate, or High impact levels.
Before FedRAMP, every federal agency separately assessed the same cloud products, an expensive and duplicative process. FedRAMP standardizes that assessment once, so an authorization can be reused ("leveraged") across multiple agencies. A cloud service provider's system is categorized as Low, Moderate, or High impact under FIPS 199, which determines which tier of NIST SP 800-53 controls applies — High impact systems (handling the most sensitive federal data) face the most controls and the deepest continuous-monitoring obligations.
Authorization traditionally runs through one of two paths: an Agency Authorization, sponsored by a specific federal agency that will use the service, or the legacy JAB (Joint Authorization Board) provisional authorization process. In 2025, the FedRAMP Program Office launched "FedRAMP 20x," a modernization initiative aimed at substantially compressing the time and cost of achieving authorization — cloud providers evaluating FedRAMP should confirm the current process directly with the FedRAMP PMO, since this is an area of active reform.
Who is impacted
Cloud service providers (CSPs) that want to sell cloud products or services to US federal agencies, and the agencies themselves, which are generally required to use FedRAMP-authorized cloud services for federal data.
Requirements
A System Security Plan mapped to the applicable NIST SP 800-53 control baseline for the system's impact level; an independent assessment by a FedRAMP-recognized Third Party Assessment Organization (3PAO); a Plan of Action and Milestones for any gaps; and ongoing continuous monitoring — including monthly vulnerability scanning and annual reassessment — once authorized.
Executive guides & research
FedRAMP: The Complete Executive Guide
How the federal cloud security authorization program actually works — impact levels, authorization boundaries, 3PAO assessment, and continuous monitoring.
Glossary
3PAO
Third Party Assessment Organization — an independent, FedRAMP-recognized assessor that performs the security assessment a cloud provider needs for FedRAMP authorization.
FIPS 199 Impact Level
The Low/Moderate/High categorization (based on Federal Information Processing Standard 199) that determines which NIST SP 800-53 control baseline a federal information system — including a FedRAMP cloud system — must meet.
Related
Stay ahead of FedRAMP changes
Get Regulatory Alerts the moment something about FedRAMP changes — new deadlines, guidance updates, enforcement actions.