FedRAMP,explained

What FedRAMP is

FedRAMP, the Federal Risk and Authorization Management Program, gives US federal agencies a consistent way to adopt cloud services securely. Rather than each agency assessing a cloud product from scratch, FedRAMP provides a standard process and a reusable authorisation.

It is aimed squarely at cloud service providers that want to sell to the US federal government, so it is a go-to-market requirement for that market rather than a general best practice.

Baselines and impact levels

FedRAMP uses NIST 800-53 controls organised into baselines at low, moderate, and high impact, with FedRAMP-specific parameters. There is also a tailored baseline for low-impact software-as-a-service. The baseline you target depends on the sensitivity of the data your service will handle.

Authorisation and assessment

A cloud service is assessed by an accredited third-party assessment organisation (a 3PAO), which tests the controls and documents the results. Authorisation is then granted by the government, either by an individual agency issuing an Authorisation to Operate, or through the FedRAMP process. The provider does not authorise itself.

Continuous monitoring

FedRAMP does not stop at authorisation. Providers must maintain continuous monitoring: regular vulnerability scans, a plan of action and milestones to track and close weaknesses, and ongoing reporting to the authorising official. Staying authorised is an ongoing obligation.

How to approach it

1. 1Confirm the impact level and baseline your service needs.
2. 2Implement the 800-53 baseline controls and document them in a system security plan.
3. 3Engage a 3PAO for assessment and remediate findings.
4. 4Pursue an agency authorisation or the FedRAMP process.
5. 5Operate the continuous-monitoring programme to stay authorised.