Menu
Key facts
- Controls
- NIST SP 800-53 Rev 5 baselines: Low ~156, Moderate ~323, High ~410 controls
- Recertification cycle
- Annual assessment plus continuous monitoring
- Ongoing oversight
- Monthly vulnerability scans, quarterly POA&M updates, annual ConMon assessment
- Public registry
- FedRAMP Marketplace ↗
- Common gap categories
- Authorization boundary definition; Continuous monitoring program (CA-7); Incident response (IR); Configuration management (CM); Supply chain risk (SR)
- Related standards
What is FedRAMP?
The Federal Risk and Authorization Management Program (US GSA / OMB, current baseline Rev 5 aligned to NIST SP 800-53 Rev 5) is the mandatory federal cloud security authorization framework for cloud service providers (CSPs) selling to US federal agencies.
Is FedRAMP a certification or an attestation?
FedRAMP issues an Authorization to Operate (ATO), not a certification. The ATO is granted by a federal agency Authorizing Official after a Third-Party Assessment Organization (3PAO) assessment. The FedRAMP PMO reviews the package and lists authorized services on the Marketplace.
Who needs FedRAMP?
Required for any SaaS, PaaS, or IaaS vendor pursuing US federal agency contracts. Roughly 80% of authorizations are at Moderate impact, covering systems processing CUI, PII, or agency financial data.
What does FedRAMP cost and how long does it take?
Low: $250K–$500K / ~12 months. Moderate: $1M–$2M+ / 12–18 months. High: $2M–$3M+ / 18–36 months. Excludes ongoing continuous monitoring of $50K–$400K+/year.
FedRAMP 20x (a modernized, automated authorization path) is being piloted but is not expected to open broadly until FY26 Q4. Current ranges reflect the Rev 5 agency-authorization path.