FedRAMP High
What is FedRAMP High?
FedRAMP High baseline, based on NIST SP 800-53 Revision 5, includes all 421 security controls with FedRAMP-specific tailoring and implementation guidance.. It comprises 417 controls organised across 1 domains, and applies in the United States.
How FedRAMP High maps to other frameworks
All 417 controls, each one mapped to the equivalent requirement in other standards, with the evidence that carries across and the mappings that were judged and rejected shown alongside. No account needed to look.
See the control mappings →The 1 domains FedRAMP High groups its controls into
Frameworks that share controls with FedRAMP High
Each of these has at least one control mapped to a control in FedRAMP High. The number is how many FedRAMP High controls are shared, counted from the mapping graph.
Implementation guides for frameworks that overlap FedRAMP High
Training on frameworks that overlap FedRAMP High
There is no course on FedRAMP High itself. These cover frameworks that share controls with it, so the material carries across even though the standard named is different.
Where FedRAMP High overlaps with the standards you already hold
What FedRAMP High means in your sector
What FedRAMP High means for your job
Questions people ask about FedRAMP High
What is FedRAMP High?
How many controls does FedRAMP High have?
Where does FedRAMP High apply?
What frameworks does FedRAMP High map to?
How do I get started with FedRAMP High compliance?
Query FedRAMP High programmatically
FedRAMP High, its 417 controls and every mapping into other standards are available over a REST endpoint and an MCP server, so an agent can read them directly. The free tier is 10 calls a day and needs no signup.
FedRAMP High API reference and MCP config →What FedRAMP High requires, control by control
Each page carries the requirement text for one FedRAMP High control and what an assessor expects to see as evidence.
- AC-1 Policy and Procedures
- AC-11 Device Lock
- AC-12 Session Termination
- AC-14 Permitted Actions Without Identification or Authentication
- AC-17 Remote Access
- AC-18 Wireless Access
- AC-19 Access Control for Mobile Devices
- AC-2 Account Management
- AC-20 Use of External Systems
- AC-21 Information Sharing
How much of another standard FedRAMP High already covers
Each crosswalk is judged control by control, and the mappings that were rejected are kept alongside the ones that held.
How ready are you for FedRAMP High?
Answer 25 questions and get a professional readiness report with gap analysis, maturity scores, and prioritised action items. Results in 5 minutes.