Authorize your cloud service for the US government

What is FedRAMP?

The Federal Risk and Authorization Management Program (FedRAMP) is a US government program that standardizes the security assessment, authorization, and continuous monitoring of cloud products used by federal agencies. Established in 2011 and operated by GSA in partnership with NIST, FedRAMP allows a cloud service to be authorized once and reused by any agency, dramatically reducing duplicate work.

FedRAMP is built on the NIST 800-53 control catalog, with specific baselines for Low, Moderate, and High impact levels. Assessments are performed by accredited Third-Party Assessment Organizations (3PAOs), and authorizations are issued by a sponsoring federal agency as an Authority to Operate (ATO). The Joint Authorization Board (JAB) provisional-authorization path has been retired — FedRAMP now uses a single "FedRAMP Authorized" designation, and the 2025 FedRAMP 20x initiative is modernizing assessment and continuous monitoring with greater automation and reuse of commercial security evidence.

A brief history of FedRAMP

FedRAMP launched in 2011, operated by GSA under Office of Management and Budget policy. For its first decade the program ran on policy memos rather than statute — it existed because agencies kept re-assessing the same cloud services, and a "do it once, reuse it everywhere" model promised to end that duplication.

That changed in December 2022, when Congress passed the FedRAMP Authorization Act as Section 5921 of the FY2023 National Defense Authorization Act — codifying FedRAMP into law for the first time. Three provisions are worth knowing:

• Presumption of adequacy. An agency must presume that a cloud service already authorized by another agency has adequate security, making it far easier to reuse an existing authorization instead of starting over.
• A FedRAMP Board of senior government officials was established to oversee and accelerate authorizations, replacing the Joint Authorization Board (JAB) and its provisional-authorization path.
• A Federal Secure Cloud Advisory Committee was created to bring industry and agency input into improving the process.

Together these moves pushed FedRAMP toward its founding promise — authorize once, reuse everywhere — and set up the automation-first direction now playing out in FedRAMP 20x.

FedRAMP and NIST 800-53

FedRAMP doesn't invent its own controls — it's built directly on NIST 800-53, the federal catalog of security and privacy controls. Each FedRAMP baseline is a tailored selection from that catalog: a defined subset of controls, plus FedRAMP-specific parameter values and a small number of additional controls layered on top. When you implement a FedRAMP baseline, you're implementing 800-53 controls with FedRAMP's parameters and assignments filled in — not a separate standard.

That relationship matters for two reasons. First, work you've already done toward 800-53 — or frameworks that map to it — carries over directly. Second, it connects FedRAMP to the broader federal control family: contractors handling Controlled Unclassified Information (CUI) for the Department of Defense work from NIST 800-171, a CUI-focused derivative of the same catalog. Understand 800-53 and you understand the backbone of FedRAMP.

The impact levels: Low, Moderate, High

FedRAMP defines three baselines, set by the potential impact of a confidentiality, integrity, or availability breach on the data the system handles (the FIPS 199 categorization). The control count grows with the level — each baseline is a tailored selection from the NIST 800-53 Rev 5 catalog, plus a handful of FedRAMP-specific additions:

The large majority of commercial SaaS targets Moderate — it's the level most agency buyers expect. High is reserved for the most sensitive non-classified federal data and carries a substantially heavier engineering and evidence burden.

FedRAMP Tailored (Li-SaaS)

For low-impact, low-risk SaaS — collaboration tools, productivity apps, and similar — FedRAMP offers a tailored Low path known as Li-SaaS. It covers the same 156 Low controls, but splits how they're validated: roughly 66 are independently tested by a 3PAO, while the remaining 90 are satisfied through documented CSP attestation. It's a lighter lift for services that genuinely qualify, without dropping the underlying control set.

The FedRAMP authorization process

FedRAMP authorization follows a defined arc, and the order matters:

1. Secure an agency sponsor. This is the gating step. Since the JAB provisional path was retired, an Authority to Operate (ATO) comes from a federal agency willing to sponsor and authorize your service. No sponsor, no authorization — and many CSPs underestimate how long building that relationship takes.
2. Prepare and document. Categorize your system's impact level, define the authorization boundary, and document how each control is implemented in your System Security Plan (SSP).
3. Assessment. An accredited Third-Party Assessment Organization (3PAO) independently tests your controls and produces a Security Assessment Report (SAR).
4. Authorization decision. The sponsoring agency reviews the full package — SSP, SAR, and POA&M — and, if satisfied, issues the ATO.
5. Continuous monitoring. The ATO is not the finish line; you move into ongoing ConMon to keep the authorization in good standing.

The pattern to internalize: a clean boundary and a solid SSP come first, independent assessment second, the agency decision third, and then continuous operation. Rushing the boundary or the SSP is the most common way to add months to the back half.

Readiness Assessment Report (RAR)

Before the full assessment, mature CSPs commission a Readiness Assessment Report (RAR) — a lighter-weight evaluation by a 3PAO of whether your service is genuinely ready for authorization. A positive RAR signals to potential agency sponsors that you're a credible candidate, which makes sponsorship conversations far easier. It also surfaces gaps while they're still cheap to fix, before the formal SAR locks them in as findings. A RAR isn't mandatory on every path, but jumping straight to a full assessment when you aren't ready is an expensive way to learn what a RAR would have told you.

The role of the 3PAO

A Third-Party Assessment Organization (3PAO) is the independent assessor that tests whether your controls actually work the way your SSP claims. They examine evidence, interview your team, and run technical checks, then document the results in the SAR. The independence is the whole point: an agency relies on the 3PAO's testing rather than re-verifying everything itself, which is what makes the "authorize once, reuse everywhere" model possible. Choosing a 3PAO with real experience in your type of service — and engaging them early enough to shape your readiness — tends to make the assessment far smoother than treating it as a final exam you cram for.

Authorization artifacts: SSP, SAR, POA&M

Three documents carry a FedRAMP authorization, and they build on each other:

• System Security Plan (SSP). The foundational document — it describes your system, its boundary, and exactly how each control in your baseline is implemented. The SSP is what the assessor tests against and what the agency reads to understand your posture.
• Security Assessment Report (SAR). The 3PAO's findings after testing your implementation against the SSP. It documents what works, what doesn't, and the risk of any gaps.
• Plan of Action & Milestones (POA&M). The living tracker of open findings — each with an owner, a remediation plan, and a target date. Agencies expect the POA&M to shrink over time, not sit static.

The trap most teams fall into is treating these as one-time Word documents maintained separately from how the system actually runs. The moment your environment changes, those binders drift out of date — and the next assessment surfaces the gap. The healthier model treats the SSP, SAR inputs, and POA&M as live artifacts driven by real control evidence, so the documentation reflects the system as it is, not as it was at submission.

Continuous Monitoring (ConMon)

An ATO is the start of your obligations, not the end. FedRAMP requires ongoing continuous monitoring (ConMon) to keep an authorization in good standing, and it runs on a monthly cadence:

• Vulnerability scanning of your infrastructure, web applications, and databases, with results reported and tracked.
• POA&M updates showing progress on open findings and any new ones.
• Deviation requests when you need to document a risk-based exception to how a finding is expected to be handled.
• Significant Change Requests (SCRs) before you make material changes to the authorized system, so the agency can assess the security impact first.

ConMon is where many CSPs underestimate the sustaining effort. Authorization is a sprint with a clear finish; ConMon is the standing operational load that follows for as long as you hold the ATO. Teams that build it into normal engineering and security operations — rather than treating it as a separate monthly fire drill — keep their authorizations far more cheaply than those who scramble each cycle.

Who needs FedRAMP

Any cloud service offered to a federal agency typically requires FedRAMP authorization at the appropriate impact level. Authorization is also increasingly used as a procurement filter by state and local governments, defense primes, and international public-sector buyers.

In practice, that pulls in several kinds of cloud service provider:

• SaaS selling directly to a federal agency — the clearest case; the agency typically can't buy without authorization at the right impact level.
• Services embedded in a larger federal system — if your product runs inside another vendor's authorized boundary, you inherit obligations through them.
• Vendors whose enterprise buyers serve the government — increasingly, commercial customers with public-sector business push FedRAMP-aligned requirements down to their own suppliers.

If any of these describe where your revenue is heading, FedRAMP stops being optional — and the adjacent programs below may apply too.

FedRAMP vs StateRAMP vs DoD Impact Levels

FedRAMP sits among several programs that are easy to confuse:

The short version: FedRAMP authorizes cloud services for federal civilian agencies. StateRAMP applies the same idea to state and local government, with its own process. The DoD Impact Levels build on a FedRAMP authorization and add controls based on how sensitive the defense data is — IL2 for public-facing data up through IL5/IL6 for the most sensitive. And CMMC, which draws on NIST 800-171, is a separate requirement aimed at contractors that handle Controlled Unclassified Information in their own environments — related in spirit, but not a substitute for FedRAMP. Knowing which program your buyers actually require keeps you from over-scoping toward the wrong one.

FedRAMP 20x and what's changing

FedRAMP 20x is the program's 2025–2026 modernization effort, and it changes how authorization works. Instead of static annual assessments and lengthy written narratives, 20x is built around Key Security Indicators (KSIs) — machine-readable summaries of a cloud service's security capabilities, mapped to NIST 800-53 controls and validated through automation in near real time. The goal is continuous assurance rather than a once-a-year snapshot, with greater reuse of the commercial security evidence CSPs already produce.

It's rolling out in phases:

• Phase 1 — 20x Low pilot (FY25 Q3–Q4, ~Apr–Sep 2025): a proof of concept built on 56 KSIs for the Low baseline. FedRAMP received 26 submission packages and granted the first pilot authorizations in under two months — far faster than the traditional path.
• Phase 2 — 20x Moderate pilot (FY26 Q1–Q2): extended the model to Moderate (61 KSIs) with a limited group of CSPs from the Low pilot.
• Phase 3 — wide-scale adoption (FY26 Q3–Q4): currently underway — formalizing the Low and Moderate requirements and training agencies for broad adoption.

As of mid-2026, 20x Low and Moderate are not yet fully generally available to all CSPs — Phase 3 is still in progress. But the direction is unmistakable: faster authorizations, continuous validation, and automation in place of binders.

Timeline

A typical FedRAMP Moderate authorization takes 12–18 months from kickoff to ATO. What moves you within — or beyond — that range:

• Sponsorship timing. The time spent finding and onboarding an agency sponsor often dominates the schedule and is the least predictable part.
• Boundary size and complexity. A tightly scoped, cloud-native system assesses faster than a sprawling one with many components and inherited services.
• Engineering remediation. Gaps found during readiness or assessment have to be fixed and re-evidenced, which adds months if the starting posture is weak.

FedRAMP 20x aims to compress this materially — pilot authorizations were granted in under two months — but for the traditional path, plan for a year-plus.

Common FedRAMP challenges

FedRAMP is achievable, but a few things reliably make it hard:

• Finding an agency sponsor. With the JAB path gone, no sponsor means no authorization. Building a relationship with an agency that has both the need and the bandwidth to sponsor you is often the single longest pole.
• Scoping the authorization boundary. Draw it too wide and you balloon the control and evidence burden; too narrow and you create findings or miss real data flows. Getting the boundary right is genuinely difficult — and expensive to change late.
• Sustaining ConMon. The monthly cadence is a standing operational commitment. Teams that treat it as an afterthought burn out or fall out of compliance.
• The engineering lift of Moderate. 323 controls is a serious investment, and many are operational rather than one-time — they require evidence that you do something consistently, month after month.

None of these are reasons to avoid FedRAMP if your market needs it. But they're why it's a program-level commitment rather than a checkbox — and why starting with a realistic picture of the effort beats discovering it mid-assessment.

Getting FedRAMP ready

If FedRAMP is on your roadmap, a sensible order of operations:

1. Pick your impact level. Let your target agencies and the sensitivity of their data decide Low, Moderate, or High — don't over-scope.
2. Adopt the 800-53 baseline for that level as your working control set, with FedRAMP's parameters applied.
3. Build the SSP from real evidence. Document how each control is actually implemented, drawn from how your system runs — not aspirational policy.
4. Run a readiness assessment. Use a RAR to find gaps while they're cheap and to strengthen your pitch to potential sponsors.
5. Line up sponsorship and a 3PAO. Start the sponsor conversation early — it's the long pole — and engage an experienced 3PAO to shape readiness, not just to grade it.
6. Stand up ConMon from day one. Build the monthly cadence into operations before the ATO, so continuous monitoring is a habit rather than a scramble.

The teams that do well treat FedRAMP as an engineering and operations program with a compliance output — not a document exercise bolted on at the end.

How episki helps

FedRAMP is a marathon. episki treats the System Security Plan, POA&M, and continuous monitoring deliverables as live artifacts driven by your real control evidence — not parallel documents you maintain alongside the platform. When a control's evidence changes, the SSP narrative changes with it.