FedRAMP: Federal Risk and Authorization Management Program.

FedRAMP, the Federal Risk and Authorization Management Program, was established in 2011 under OMB Memorandum M-11-29 to provide a standardised, government-wide approach to security assessment, authorisation, and continuous monitoring for cloud products and services consumed by US federal agencies. The programme is administered by the FedRAMP Program Management Office within the General Services Administration. Authorisation is a precondition for cloud service offerings to be acquired by most federal agencies, and authorised offerings are listed on the FedRAMP Marketplace.

FedRAMP defines three security baselines aligned to FIPS 199 impact levels: Low, Moderate, and High. The Moderate baseline is the default for the majority of federal use cases. The High baseline applies to systems handling sensitive data at agencies such as the Department of Defense and Department of Homeland Security. In May 2023 the programme moved to FedRAMP Rev 5, aligning the baselines with NIST SP 800-53 Rev 5 controls. The baselines map to approximately 156 controls at Low, 323 at Moderate, and 410 at High.

Two authorisation paths exist: an Agency Authority to Operate (Agency ATO), where a sponsoring federal agency evaluations the cloud service provider's package and issues authorisation, and a Joint Authorization Board Provisional ATO (JAB P-ATO), issued jointly by the chief information officers of GSA, DHS, and DOD. Both paths require an independent security assessment performed by an accredited Third-Party Assessment Organization (3PAO). After authorisation, the cloud service provider is subject to continuous monitoring obligations, including monthly vulnerability reporting, annual assessment, and significant-change notifications.