Glossary · Federal procurement

FedRAMP: Federal Risk and Authorization Management Program.

The standardised US federal programme for assessing, authorising, and continuously monitoring cloud products and services for federal government use.

FedRAMP, the Federal Risk and Authorization Management Program, was established in 2011 under OMB Memorandum M-11-29 to provide a standardised, government-wide approach to security assessment, authorisation, and continuous monitoring for cloud products and services consumed by US federal agencies. The programme is administered by the FedRAMP Program Management Office within the General Services Administration. Authorisation is a precondition for cloud service offerings to be acquired by most federal agencies, and authorised offerings are listed on the FedRAMP Marketplace.

FedRAMP defines three security baselines aligned to FIPS 199 impact levels: Low, Moderate, and High. The Moderate baseline is the default for the majority of federal use cases. The High baseline applies to systems handling sensitive data at agencies such as the Department of Defense and Department of Homeland Security. In May 2023 the programme moved to FedRAMP Rev 5, aligning the baselines with NIST SP 800-53 Rev 5 controls. The baselines map to approximately 156 controls at Low, 323 at Moderate, and 410 at High.

Two authorisation paths exist: an Agency Authority to Operate (Agency ATO), where a sponsoring federal agency reviews the cloud service provider's package and issues authorisation, and a Joint Authorization Board Provisional ATO (JAB P-ATO), issued jointly by the chief information officers of GSA, DHS, and DOD. Both paths require an independent security assessment performed by an accredited Third-Party Assessment Organization (3PAO). After authorisation, the cloud service provider is subject to continuous monitoring obligations, including monthly vulnerability reporting, annual assessment, and significant-change notifications.

Where this matters.

For internationally-headquartered cloud, software, or AI firms entering the US federal market, FedRAMP authorisation is often the gating commercial requirement. A cloud-delivered offering without authorisation cannot be acquired by most federal agencies. The authorisation timeline runs typically twelve to eighteen months from kick-off, with 3PAO engagement, package submission, and remediation cycles consuming the majority of the calendar. Foreign firms also face data-residency, US-cleared-personnel, and supply-chain provenance scrutiny that goes beyond the baseline control set, particularly at the High baseline. The commercial sequencing matters: pursuing FedRAMP without a sponsoring agency or a JAB prioritisation slot is a substantial investment with no guaranteed commercial return.

FedRAMP overlaps with adjacent procurement gates. CMMC applies to defense contractors handling Federal Contract Information or Controlled Unclassified Information. DFARS 252.204-7012 imposes incident-reporting and safeguarding requirements that interlock with FedRAMP for cloud-delivered defense systems. Further reading on the corridor architecture: German cyber, FedRAMP, and CMMC and cross-border cyber, AI, and ML US commercialisation.