Skip to content

FedRAMP

What is FedRAMP?

The Federal Risk and Authorization Management Program, a US government programme that standardises security assessment and authorisation for cloud services used by federal agencies.

Cloud

Related terms

Cloud Security

Frameworks that govern fedramp

CSA CCM v4View framework →ISO 27001:2022View framework →NIST SP 800-53 Rev 5View framework →

What the standards actually require on fedramp

Requirements naming fedramp across 6 standards, quoted from the control text.

FedRAMP Rev 534 controls

Every provider, wherever it is in its journey, completes the CSP Information Form, which generates a unique FedRAMP ID for the cloud service offering that remains its identifier through the life cycle even if the company or product name changes, and triggers a...

fedramp-rev-5::A.1 · A.1 CSP Information Form and FedRAMP ID →
IRS Publication 10755 controls

Section 9.4 of IRS Publication 1075 establishes specific requirements for cloud services and addresses the prohibition on offshore processing of FTI.

IRSPub1075-Section94-Cloud-FedRAMP-Offshore-Prohibition-CSP-USRegion-PrivateGovCloud-AzureGov-AWSGov · IRS Pub 1075 Section 9.4 + Cloud Services + FedRAMP Authorisation Required + Offshore Prohibition + AWS GovCloud + Azure Government + Oracle US Federal + Google Workspace Federal + US-Region Data Residency →
MARS-E3 controls

Coordinate MARS-E compliance with adjacent federal programmes and audit regimes. IRS Publication 1075 (Safeguarding Federal Tax Information) compliance for Federal Tax Information (FTI) processing under IRC Section 6103 + Safeguard Procedures Report (SPR) ever...

MARS-E-Cross-Program-Coordination-IRS-Pub-1075-FedRAMP-CMS-ARS-HHS-OIG-Joint-Audit-3PAO · MARS-E Cross-Program + IRS Pub 1075 + FedRAMP + CMS ARS + HHS OIG + Joint Audit + 3PAO →
ISMAP (Japan)2 controls

ISMAP Assessment positions ISMAP within the comprehensive Japanese and international cloud security regulatory landscape. (1) External Assessment by ISMAP-Approved Auditor: CSP must undergo annual third-party assessment by an audit organisation on the ISMAP Pr...

ISMAP-Assessment-ExternalAuditor-AnnualReview-CustomerTransparency-Coord-FedRAMP-IRAP-GCloud-PIPA-ISO27017 · ISMAP Assessment - External ISMAP-Approved Auditor + Annual Review + Customer Information and Transparency + Coordination FedRAMP/UK G-Cloud/Australia IRAP/Singapore MTCS + ISO 27017 + PIPA + Japan Digital Agency →
US Executive Order 14144 - Strengthening and Promoting Innovation in the Nation's Cybersecurity2 controls

GSA, through the FedRAMP Director and with NIST and CISA, develops FedRAMP policies and practices that incentivize or require cloud service providers in the FedRAMP Marketplace to produce baselines with specifications and recommendations for how agencies shoul...

us-executive-order-14144-strengthening-and-promoting-innovation-in-the-nations-cybersecurity::3(d) · Sec. 3(d) (now 3(b)) Provide agency configuration baselines for cloud services (FedRAMP) →
FedRAMP High124 controls

Detect network services not authorized; audit or alert FedRAMP-defined personnel.

SI-4(22) · Unauthorized Network Services →

Questions people ask about fedramp

What is FedRAMP?
The Federal Risk and Authorization Management Program, a US government programme that standardises security assessment and authorisation for cloud services used by federal agencies.
Why is FedRAMP important for compliance?
FedRAMP is a key concept in Cloud. Understanding fedramp helps organizations meet regulatory requirements, reduce risk, and demonstrate due diligence during audits. Our compliance platform maps 1,016 frameworks with 316K cross-framework control mappings.
What concepts are related to FedRAMP?
Key concepts related to FedRAMP include Cloud Security. Understanding these interconnected concepts provides a more comprehensive view of Cloud requirements and helps organizations build holistic compliance programs.
Which compliance frameworks address FedRAMP?
FedRAMP appears in the requirement text of FedRAMP Rev 5, IRS Publication 1075, MARS-E, ISMAP (Japan), US Executive Order 14144 - Strengthening and Promoting Innovation in the Nation's Cybersecurity. Across these standards we have identified 170 controls that name it directly, each linked to the control text on the compliance platform.
Where can I learn more about FedRAMP?
Explore our compliance framework pages to see how fedramp applies across different standards and regulations. Our implementation guides provide step-by-step guidance, and the compliance platform offers AI-powered analysis of how this concept maps across 1,016 frameworks.

See how FedRAMP applies across compliance frameworks

Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.

Explore on Platform
Written and maintained by Gerard Blokdyk, The Art of Service.