FedRAMP, the Federal Risk and Authorization Management Program, is the U.S. government’s standardized framework for evaluating and authorizing cloud services that handle federal data. It sets uniform security requirements that a cloud service provider must meet before any executive branch agency can use its product, and it operates on a simple principle: authorize once, reuse across government. A single authorization can clear the same cloud offering for use at dozens of agencies without each one running its own security review from scratch.
The program began in 2011 as an OMB policy directive tied to the federal Cloud First initiative. It was written into federal law in December 2022, when Congress passed the FedRAMP Authorization Act as part of the National Defense Authorization Act for Fiscal Year 2023, adding Section 3608 to Title 44 of the United States Code.1Office of the Law Revision Counsel. 44 USC 3608 – Federal Risk and Authorization Management Program OMB Memorandum M-24-15, issued in July 2024, replaced the original 2011 framework with updated guidance under the new statute and introduced a “presumption of adequacy” rule: when a cloud service already holds a FedRAMP authorization, other agencies must accept it unless they can show a specific need for additional requirements or point to substantial deficiencies in the existing package.2The White House. Modernizing the Federal Risk and Authorization Management Program
What FedRAMP Covers
FedRAMP applies to every cloud deployment model an agency might use, whether public, private, community, or hybrid, and to all service types including Software as a Service, Platform as a Service, and Infrastructure as a Service. OMB Circular A-130 requires agencies to follow FedRAMP whenever they acquire cloud-based services.3CIO.GOV. Circular A-130 If a federal agency wants to put its data in your cloud, you go through FedRAMP.
Security Impact Levels
Every cloud offering evaluated by FedRAMP is placed into an impact level based on Federal Information Processing Standards Publication 199, which measures potential harm to confidentiality, integrity, and availability.4National Institute of Standards and Technology (NIST). FIPS PUB 199 Standards for Security Categorization of Federal Information and Information Systems The provider self-categorizes its offering before beginning the authorization process.5FedRAMP.gov. Understanding Baselines and Impact Levels in FedRAMP
- Low is for data intended for public consumption or systems where a breach would cause limited harm. It requires roughly 125 security controls.
- Moderate is the most common level, covering services where a breach could cause serious harm such as significant financial loss or major disruption. It requires approximately 325 controls.
- High is reserved for the most sensitive unclassified data, including law enforcement and emergency services systems where a breach could be catastrophic. It requires around 421 controls.
A streamlined baseline called LI-SaaS (Low-Impact SaaS, sometimes called Tailored) is available for simple, low-risk SaaS products. To qualify, the service must operate in a cloud environment, be fully operational, meet the NIST definition of SaaS, store no personally identifiable information beyond basic login credentials, and run inside a platform or infrastructure that already holds FedRAMP authorization. LI-SaaS carries approximately 156 controls.
Who Runs FedRAMP
Several organizations share responsibility for the program.
The FedRAMP Board, which replaced the former Joint Authorization Board in May 2024, sets policies, requirements, and guidelines that apply across government. It includes representatives from the Department of Defense, the Department of Homeland Security, and the General Services Administration, along with officials such as CISA’s technical director for cybersecurity. OMB and GSA each designate a non-voting chair and vice chair.6U.S. General Services Administration. FedRAMP Board Launched to Support Safe, Secure Use of Cloud Services in Government
The Program Management Office sits within GSA and runs day-to-day operations: technical reviews of authorization packages, the secure documentation repository, official templates, and the review that determines whether an agency-issued authorization is fit for reuse across government.
Third-Party Assessment Organizations, or 3PAOs, are private firms accredited to independently test whether a provider’s security claims hold up. A 3PAO runs vulnerability scans, verifies control implementation, and produces the assessment reports the government relies on. Accreditation runs through the American Association for Laboratory Accreditation under the ISO/IEC 17020 standard, with annual reviews and a full on-site reassessment every two years.7FedRAMP Help. How Does a Company Become a FedRAMP Recognized Third Party Assessment Organization (3PAO)
Federal agencies play a dual role. They consume authorized services, and they also sponsor authorizations by reviewing packages and issuing an Authority to Operate (ATO) for a specific use case. Under the current framework, agency authorization is the only active path to a Rev 5 FedRAMP authorization.8FedRAMP.gov. FedRAMP in 2025 Once an agency issues an ATO, the PMO reviews the package and, if the quality bar is met, the provider earns the “FedRAMP Authorized” designation.
How a Cloud Service Gets Authorized
The traditional authorization process moves through preparation, assessment, agency review, and ongoing monitoring.
Preparation is document-heavy. The provider assembles a security package built around a System Security Plan (SSP) that can run to hundreds of pages, describing how every required control is implemented across the system boundary, network architecture, and data flows. The provider also drafts a Security Assessment Plan that lays out the testing methodology, tools, and scripts the 3PAO will use. Official templates for these documents live on the FedRAMP website.
The 3PAO then conducts the assessment and produces a Security Assessment Report (SAR) that flags vulnerabilities and gaps. The provider pairs that with a Plan of Action and Milestones (POA&M) documenting how each identified risk will be remediated and on what timeline.9FedRAMP.gov. FedRAMP Continuous Monitoring Playbook
The sponsoring agency’s Authorizing Official reviews the complete package and decides whether to accept the residual risk and issue the ATO. After the ATO is issued, the provider and 3PAO upload current versions of all deliverables and submit the FedRAMP Initial Authorization Package Checklist so the PMO can confirm the package is suitable for reuse.
Authorization is not the end of the work. Providers enter continuous monitoring for the life of the authorization, with monthly vulnerability scans, updated POA&Ms, and system inventories submitted to the FedRAMP repository, an annual 3PAO reassessment, tight incident reporting timelines, and a formal significant-change process for anything that could affect the system’s security state. Failing to keep up with those obligations can lead to revocation.
What FedRAMP 20x Changes
FedRAMP 20x is a ground-up rework of the program. Where the traditional Rev 5 process leans on lengthy written narratives, 20x shifts toward automated demonstration of secure configurations. Pilot participants have received authorization in under two months, compared with the year-plus timelines typical of the traditional path.10FedRAMP.gov. FedRAMP 20x Overview
Under 20x, providers do not need an agency sponsor; FedRAMP reviews initial authorization requests directly. Providers are encouraged to submit their commercial cloud offerings rather than build government-specific versions, and they no longer need advance permission from government customers to make routine improvements.
The rollout is phased. Phase 1, now complete, tested the automation-based approach at Low impact. Phase 2 is active through mid-2026 and extends the approach to Moderate. Phase 3, in late 2026, formalizes 20x Low and Moderate requirements, including 3PAO accreditation criteria, with wide-scale agency training. Phase 4, in early 2027, pilots a 20x path for High authorizations targeting hyperscale infrastructure providers and requires all Rev 5 providers to transition to machine-readable authorization data. Phase 5, in late 2027, stops accepting new Rev 5 agency authorizations and sets transition timelines for legacy authorized offerings.
For providers on the Rev 5 path, consolidated rules taking effect by December 31, 2026 will govern all cloud service providers through December 31, 2028. The FedRAMP Ready designation is being retired on July 28, 2026, after which no new FedRAMP Ready submissions will be accepted.11FedRAMP.gov. Initial Outcome from RFC-0023 Rev5 Program Certifications
What Authorization Costs and How Long It Takes
FedRAMP authorization is expensive and slow, particularly through the traditional Rev 5 path. The biggest cost drivers are the 3PAO assessment and the internal engineering and compliance work needed to document and implement hundreds of controls.
Third-party assessment fees vary by impact level. Moderate 3PAO assessments typically run between $125,000 and $195,000. High-impact assessments cost more, and even LI-SaaS assessments carry meaningful fees. Providers also need dedicated engineering and compliance staff for months of preparation and continuing staffing for monitoring after the ATO.
Timelines scale with impact level as well. Low and LI-SaaS authorizations generally take around 12 months from preparation through ATO. Moderate typically runs 12 to 18 months. High can stretch from 18 months to three years. The 20x path promises much faster timelines but is still rolling out and has not yet reached full-scale availability at every impact level.
The FedRAMP Marketplace
FedRAMP maintains a public marketplace where agencies can search for cloud services evaluated under the program. Listings carry one of two designations. FedRAMP Ready means a recognized 3PAO has attested to the provider’s security capabilities and the PMO has accepted a Readiness Assessment Report; the status is available only at Moderate and High and signals technical readiness for a full authorization. FedRAMP Authorized means the provider has completed the full process and holds an active ATO that other agencies can reuse.12FedRAMP.gov. About Marketplace Ready is being retired in July 2026.
For cloud providers selling to the federal government, a marketplace listing is a real competitive advantage. Agencies strongly prefer products that already hold FedRAMP authorization because adopting a pre-authorized product avoids the months of review needed to authorize a new one. A single authorization can open the door to contracts across dozens of agencies.