FedRAMP
Government authorization · $250K+ · 12–24 months
- Controls
- NIST 800-53 baselines (Low ~156 / Moderate ~323 / High ~410)
- Recertification
- Continuous monitoring after authorization
- Oversight
- FedRAMP PMO; 3PAOs
- Common gaps
- System Security Plan, continuous monitoring, boundary definition
- Related
- NIST CSF, CMMC
- Public registry
- FedRAMP Marketplace ↗
What is FedRAMP?
FedRAMP is the US government's standardized program for authorizing cloud services. It is built on NIST 800-53 control baselines and is one of the most rigorous assurance programs a vendor can pursue.
Is FedRAMP a certification or an attestation?
It is a government authorization (ATO), assessed by an accredited third-party assessment organization (3PAO), with ongoing continuous monitoring rather than a static certificate.
Who needs FedRAMP?
Cloud service providers selling to US federal agencies.
What does it cost and how long does it take?
FedRAMP is materially more expensive and slower than SOC 2 — typically a six-figure, multi-quarter to multi-year effort.