Federal Risk and Authorization Management Program (FedRAMP)

FedRamp (Federal Risk and Authorization Management Program) is a risk assessment program created to help US Federal Agencies select cloud service providers and cloud products.

FedRAMP continuously monitors cloud products and services, to create and manage a core set of processes that the agencies can use to ensure cloud security. This standardizes government agencies approach to security assessment and authorization.

“FedRAMP is mandatory for Federal Agency cloud deployments and service models at the low, moderate, and high-risk impact levels.

Private cloud deployments intended for single organizations and implemented fully within federal facilities are the only exception.” – Fedramp.gov

FedRamp Objectives:

Help accelerate government adoption of cloud, and cloud products.

Increase confidence in cloud solutions through security assessments.

Build and maintain a set of agreed-upon standards for cloud product approval inside or outside of FedRAMP.

FedRamp Governance

What is the need for FedRamp?

Not just the United States, but governments all over the world have stringent regulations about collecting user data, where (location) they are stored, who stores it (companies based in the homeland vs foreign) and how securely they are stored.

FedRAMP is a US intiative to make sure that US federal agencies and providers of cloud products and services to the agencies have a clear set of guidelines to follow, and keep the data secure. Before FedRamp, individual agencies had their own risk assessment methodologies and approval process based on the Federal Information Security Management Act of 2002.

FedRAMP addressed this crucial gap by standardizing risk assesment and approval process. The do it once and use it many times by different agencies approach helps reduce cost, time and labor hours, while also making life easier for companies building cloud products, as they now have a set of clear, spelled out guidelines to meet.

List of FedRAMP Authorised Cloud Service Providers

Data collected on 3rd February 2019. Please visit Fedramp.gov for up to date information.