Federal and Defense Agencies are increasingly buying commercial cloud services to meet their mission requirements. Commercial cloud solution providers must obtain FedRAMP authorization prior to offering their services to agencies. The FedRAMP Kickoff Briefing Guidance is critical to help prepare for the authorization process.
The FedRAMP Marketplace continues to grow especially with the passage of the FedRAMP Act as part of the NDAA 2022.
Updated 5/24/2025 with transition of the DOD Cloud Computing Security Requirements Guide (SRG) from NIST SP 800-53 Rev 4 to Rev 5. US Government and Department of Defense agencies are continuing to modernize and transform operations using modern commercial cloud computing services. A recent report on the Federal Cloud Computing Market predicts that demand for commercial cloud computing goods and services will grow to nearly $19 Billion by 2024. A significant growth market in the next 5 years is going to be the US Department of Defense propelled by the recent award of the $9 Billion Joint Warfighting Cloud Capability (JWCC) contracts to Amazon Web Services (AWS), Google Cloud, Microsoft Corporation, and Oracle. JWCC is a multiple-award contract vehicle that will provide the DoD the opportunity to acquire commercial cloud capabilities and services. Commercial Cloud Service Providers (CSP) looking to offer services to Department of Defense (DoD) components must become
FedRAMP is a government-wide program that promotes the adoption of secure cloud services across the federal government by providing a standardized approach to security and risk assessment for cloud technologies and federal agencies. Commercial cloud service providers wanting to sell their services to US Federal Agencies, their contractors or suppliers that are part of the defense industrial base (through reciprocity) must obtain FedRAMP accreditation. The experts at stackArmor have developed a comprehensive guide for helping organizations prepare for their FedRAMP accreditation and assessment journey. This FedRAMP (Federal Risk and Authorization Management Program) Whitepaper provides an actionable resource for busy executives and project managers to understand and plan for a FedRAMP Authority To Operate (ATO). The Table of Contents of the Whitepaper include: Preparing for FedRAMP ………………………………………………………………………………………….. A Brief History ………………………………………………………………………………………………………… Finding a Sponsor: Two Paths to ATO………………………………………………………………………… Understanding FedRAMP Control Baselines (Based on NIST) ……………………………………… Getting Listed in the Marketplace
FedRAMP (Federal Risk and Authorization Management Program) is a government-wide program that streamlines the assessment, authorization and continuous-monitoring (ConMon) requirements for cloud-based IT services. It is how the federal government ensures that its cloud IT services do not put sensitive data or systems at unnecessary risk. Bottom line, Cloud Service Providers (CSPs) wanting to serve US government agencies must first obtain a FedRAMP Authorization to Operate (ATO). Designed to apply the National Institute of Standards and Technology’s (NIST) Risk Management Framework (RMF) approach to cloud solutions, the FedRAMP program embraces the concept that CSPs can build and verify their compliant Cloud Service Offerings (CSOs) once and use that verification to deliver it multiple times to multiple agencies. FedRAMP ATO Acceleration with AWS Amazon Web Services (AWS) offers IaaS and PaaS services that have been accredited at the FedRAMP High and Moderate levels. AWS offers two regions – East/West (Commercial) and
The Federal Risk and Authorization Management Program was established in 2011 to provide a cost-effective, risk-based approach for the adoption and use of commercial cloud services by the federal government and contractors supporting agencies. FedRAMP promotes the adoption of secure cloud services by providing a standardized approach to security and risk assessment for cloud technologies and federal agencies. FedRAMP mandates the use of numerous templates and documents in support of the compliance requirements required for certification. During the Continuous Monitoring phase of the FedRAMP authorization, a CSP must maintain and provide a FedRAMP POA&M artifact that follows the prescribed template. POA&M (aka POAM) stands for “Plan of Action and Milestones.” It is a document used to track and report on the progress of security controls implementation and compliance efforts for cloud systems and services. POAM management is required for any cloud service that is seeking FedRAMP certification. The POAM outlines
The FedRAMP Marketplace provides a searchable and sortable database of Cloud Service Providers (CSP) that have FedRAMP compliant services as well as a list of federal agencies using FedRAMP Authorized CSOs, and FedRAMP recognized auditors (3PAOs) that can perform a FedRAMP assessment. The FedRAMP Marketplace is maintained by the FedRAMP Program Management Office (PMO). The marketplace includes a searchable catalog of authorized products and services, that streamlines the process of finding and using cloud services in the federal government. The website is used extensively by Agencies and CSPs as a resource to: Research cloud services that have achieved a FedRAMP Marketplace designation Research agencies partnering with CSPs for a FedRAMP Authorization Identify agencies that are using FedRAMP Authorized CSOs, and Review FedRAMP’s community of recognized 3PAOs The FedRAMP Marketplace lists Cloud Service Offerings (CSO) along with their designations (or compliance status) which are either FedRAMP Ready, In-Process or Authorized. The
StateRAMP is an organization that has developed a cloud cybersecurity and compliance program that provides a state-level equivalent to the Federal Risk and Authorization Management Program (FedRAMP). It is a state-level certification program that allows cloud service providers to be assessed and authorized to operate in a state’s cloud environment. It is designed to be similar to FedRAMP, but tailored to the specific needs of individual states. StateRAMP allows cloud service providers to meet the security requirements of multiple states by obtaining a single certification, rather than having to go through a separate certification process for each state. The goal of StateRAMP is to make it easier for cloud service providers to do business with state governments and to increase the use of cloud services by state agencies. Unlike FedRAMP, which is managed and administered by a US Federal Agency, StateRAMP is a registered 501(c)(6) nonprofit membership organization comprised of service
FedRAMP (Federal Risk and Authorization Management Program) is a government-wide program that streamlines the assessment, authorization and continuous-monitoring (ConMon) requirements for cloud-based IT services. It is how the federal government ensures that its cloud IT services do not put sensitive data or systems at unnecessary risk. Bottom line, Cloud Service Providers (CSPs) wanting to serve US government agencies must first obtain a FedRAMP Authorization to Operate (ATO). The process of obtaining an ATO is commonly referred to as FedRAMP certification or FedRAMP compliance. Designed to apply the National Institute of Standards and Technology’s (NIST) Risk Management Framework (RMF) approach to cloud solutions, the FedRAMP program embraces the concept that CSPs can build and verify their compliant Cloud Service Offerings (CSOs) once and use that verification to deliver it multiple times to multiple agencies. The FedRAMP program was introduced in 2011 as a natural step in the government’s IT modernization efforts
Happy new year! US Federal Agencies are expected to spend nearly $19B on cloud services by 2024. In order to participate in the Federal and DOD marketplace, a key requirement for commercial cloud solution providers is the ability to obtain and maintain FedRAMP certification. The FedRAMP program is expected to continue to grow given the recent passage of the FedRAMP Authorization Act as part of the NDAA. For organizations planning to pursue FedRAMP certification in 2023, here are some helpful resources for further analysis and planning. FedRAMP Authorization Act: Implications for Cloud Service Providers Preparing for FedRAMP – Whitepaper Achieving DOD IL-4 ATO Lessons Learned How much does it cost to prepare for FedRAMP We hope you find these resources helpful. Please contact us to schedule a free consultation and planning discussion.
This is the first of a series of blogs on the evolving landscape of secure commercial cloud computing enabled by the FedRAMP program. The President signed into law H.R. 7776, the “James M. Inhofe National Defense Authorization Act for Fiscal Year 2023”, which includes the FedRAMP Authorization Act. The FedRAMP Authorization Act codifies the Federal Risk and Authorization Management (FedRAMP) Program, which is a Government-wide initiative that provides a standardized, reusable approach to security assessment and authorization for cloud computing products and services that process unclassified information used by agencies. The FedRAMP program is governed by the FedRAMP Program Management Office (PMO) within the General Services Administration (GSA). The FedRAMP Program was established in 2012 through an Office of Management and Budget (OMB) memorandum. The passage of the FedRAMP Authorization Act codifies this program into a law enacted by Congress with formal congressional scrutiny and oversight. This blog provides an
The Checkmarx One™ Application Security Platform is preparing to meet the rigorous requirements of FedRAMP alongside the currently authorized Checkmarx CxSAST ATLANTA, Oct. 31, 2022 /PRNewswire/ — Checkmarx, the global leader in developer-centric application security testing (AST) solutions, today announced that it has initiated the process to achieve Federal Risk and Authorization Management program (FedRAMP®) authorization status for its Checkmarx One™ Application Security Platform. FedRAMP promotes the adoption of secure cloud services across the federal government by providing a standardized approach to security assessment, authorization and continuous monitoring for cloud products and services. The company has engaged stackArmor, Inc., a leading provider of FedRAMP engineering and advisory services, to guide Checkmarx through the FedRAMP authorization process. For over 10 years, the experts at stackArmor have been guiding cloud service providers through the process of meeting government compliance standards including the Federal Information Security Modernization Act (FISMA), FedRAMP, and standards set
PINEHURST, NORTH CAROLINA, USA, December 22, 2022 /EINPresswire.com/ — TERIDA, the award-winning, women-owned-controlled-led, RegTech small business, today, announced the next stage of their Federal Risk and Authorization Management Program (FedRAMP®) journey – ‘FedRAMP In Process’ designation for their cloud platform, the Terida RegTech Framework – CLASsoft™. This ‘FedRAMP In Process’ status is FedRAMP confirmation that TERIDA is working to achieve FedRAMP authorization per the scheduled timetable. FedRAMP is a U.S. government program, established in 2011, that provides a standardized approach to security and risk assessment, and authorization and continuous monitoring for cloud technologies. And now, with the FedRAMP Act included within the 2023 National Defense Authorization Act, the “legislative framework” for critical cyber security requirements, authorization, compliance and government procurement of cloud solutions has been prioritized with bipartisan support. “Since moving to the cloud in 2017, we have been deliberate in our commitment to cyber security and privacy standards and
stackArmor’s ThreatAlert® ATO Accelerator helps ISVs and SaaS providers reduce the time and cost of FedRAMP authorizations December 21, 2022 14:16 ET | Source: stackArmor, Inc. TYSONS CORNER, Va., Dec. 21, 2022 (GLOBE NEWSWIRE) — stackArmor, Inc., a leading provider of Federal Risk and Authorization Management Program (FedRAMP®), Federal Information Security Modernization Act (FISMA), CMMC 2.0, and StateRAMP security & compliance acceleration solutions, announced today that it has advised MicroStrategy, in gaining FedRAMP authorization of the MicroStrategy Cloud for Government cloud service offering built on a high-performance cloud-native Kubernetes architecture. FedRAMP promotes the adoption of secure cloud services across the federal government by providing a standardized approach to security assessment, authorization, and continuous monitoring for commercial cloud products and services. For over 10 years, the experts at stackArmor have been guiding cloud service providers through the process of meeting government compliance standards, including FISMA, FedRAMP, and standards set by the National
stackArmor’s ThreatAlert® ATO Accelerator helps ISV’s and SaaS providers reduce the time and cost of FedRAMP authorizations TYSONS, Va., November 16, 2022–(BUSINESS WIRE)–stackArmor, Inc., a leading provider of Federal Risk and Authorization Management Program (FedRAMP®), Federal Information Security Modernization Act (FISMA), CMMC 2.0, and StateRAMP compliance acceleration solutions, announced today that it has assisted Forcepoint, a Global security leader, in expanding the FedRAMP authorization of the Forcepoint ONE all-in-one cloud platform. FedRAMP promotes the adoption of secure cloud services across the federal government by providing a standardized approach to security assessment, authorization and continuous monitoring for cloud products and services. stackArmor, Inc. has continued to support Forcepoint through their FedRAMP journey from initial authorization through the FedRAMP significant change and annual assessment process for Forcepoint ONE. Forcepoint ONE is the converged, cloud-delivered platform for Security Service Edge (SSE, the security component of SASE) that protects agency employees and contractors
Cloud Security Provider Names Ben McGucken to Head Federal Sales and Announces Support for AWS GovCloud (US) and Azure for US Government BOSTON & TEL AVIV, Israel, September 14, 2022–(BUSINESS WIRE)–Ermetic, the cloud infrastructure security company, today announced that it has initiated the process to achieve Authority to Operate (ATO) status under the Federal Risk and Authorization Management Program (FedRAMP). FedRAMP is a government-wide program that promotes the adoption of secure cloud services across the federal government by providing a standardized approach to security assessment, authorization, and continuous monitoring for cloud products and services. The company also announced the appointment of Ben McGucken as regional vice president of sales for US Federal and Latin America, who will lead the company’s FedRAMP certification. In addition, the Ermetic cloud security platform now supports AWS GovCloud (US) and Azure for US Government – which are designed to address specific regulatory and compliance
Understanding FedRAMP time to compliance is one of the first questions ISVs and SaaS companies looking to work with US Government agencies. Typical timelines can vary between 6 months to 24 months depending on the quality of preparation, agency backlog and complexity of the system. However, answering this question “how much time will it take? “in the quest for a Federal Risk and Authorization Management Program (FedRAMP) Authorization has many nuances and is critical for planning and budgeting purposes. The correct answer to this question is”¦ “it depends.” From low to high estimates, the journey can take anywhere from six months to two-plus years, with most efforts falling somewhere in between. The good news is the emergence of FedRAMP acceleration solutions (including compliant infrastructure as-a-service (IaaS) and platform as-a-service (PaaS) offerings) means cloud solutions are no longer starting from scratch when establishing FedRAMP compliance. Notional Timeline for FedRAMP ATO
In a previous Blog, stackArmor reviewed the process of obtaining an agency sponsored Federal Risk and Authorization Management Program (FedRAMP) Authority to Operate (ATO). Any cloud service provider (CSP) serving government agencies must have a FedRAMP Authorization. This blog will address the second, less common path to obtaining a FedRAMP Authorization: through a Joint Authorization Board (JAB) sponsorship. The JAB is FedRAMP’s primary governing body whose board includes Chief Information Officers (CIOs) from the following three federal organizations: Department of Defense (DoD) General Services Administration (GSA) Department of Homeland Security (DHS) A JAB authorization is slightly different than an agency authorization as it results in a Provisional ATO (P-ATO). It is provisional because the JAB cannot accept risk on behalf of any agency, only an agency can do that with their ATO. Agencies are still able to access and use the available P-ATO package to grant their own ATO, making
Providing cloud solutions to government agencies requires those cloud solutions to hold a Fedal Risk and Authorization Management Program (FedRAMP) Authorization to Operate (ATO). There are 2 paths to obtaining a FedRAMP ATO: Sponsorship by an Agency and a provisional ATO (P-ATO) through the Joint Authorization Board (JAB). This blog will cover the path to ATO through an agency sponsor since agency ATOs account for 70 percent of all FedRAMP ATOs. JAB PATOs will be covered in a separate blog. 1 – Find an agency willing to sponsor the cloud service offering (CSO). Finding an agency to sponsor and champion a Cloud Service Offering (CSO) through the FedRAMP process is probably the longest pole in the tent for getting the coveted FedRAMP Authorization. The issuance of an  agency ATO represents an acceptance of risk associated with the CSO on the part of the agency’s authorizing official (AO).A prime
There is an explosion of information out there on Federal Risk and Authorization Management Program (FedRAMP) timelines and authorization processes which can be overwhelming to sort through, adding unnecessary confusion to an already complex process. Many of the discussions around steps to FedRAMP Authorization largely gloss over one of the most important phases of a FedRAMP journey – the planning, analysis and preparation phase that precedes deployment and assessment. 1 – Planning for pursuit of a FedRAMP Authorization A FedRAMP journey has organization-wide impacts including but not limited to, technical implications, impacts to existing DevOps and DevSecOps programs; configuration management and versioning processes; employee security awareness and training; and even hiring guidelines – since most agencies have strict U.S. citizenship requirements for Cloud Service Provider (CSP) operators. Understanding why a cloud service offering (CSO) needs FedRAMP, how a FedRAMP Authorization works into broader company objectives, and what it will take
If you are an ISV or SaaS solutions provider looking to pursue US DOD and FedRAMP accreditations then please join our webinar discussion on DOD Impact Level 4 ATO and Lessons Learned. You can learn more by registering here. Date: Dec 7, 2022 02:00 PM in Eastern Time (US and Canada) The U.S. Department of Defense (DoD) has unique information protection requirements that extend beyond those established by the Federal Risk and Authorization Management Program (FedRAMP). Using the FedRAMP requirements as a foundation, the Defense Information Systems Agency (DISA) developed and maintains the DoD Cloud Computing Security Requirements Guide (CC SRG). The DoD CC SRG defines the standards for categorizing DoD information and information systems and breaks them into 4 Impact Levels (DoD ILs): – DoD IL 2 – Public or Non-Critical Mission Information – DoD IL 4 – Controlled Unclassified Information (CUI) or Non-CUI, Non-Critical Mission Information, Non-National Security Systems
As DoD agencies continue their migration of sensitive workloads to the cloud, there is a greater need to ensure those workloads are deployed around the rigorous DoD Cloud Computing Security Requirements Guide (SRG) at Impact Levels 4 and 5. Systems categorized at Impact Level 5 (IL5) are allowed to host non-public, unclassified National Security System (NSS) system data (i.e., U-NSI) or non-public, unclassified data. The work to support the path to IL5 is made easier by both stackArmor’s proprietary ThreatAlert® Authority To Operate (ATO) Accelerator and the company’s experience supporting the technical and architectural implementation of IL5 controls. ThreatAlert® ATO Accelerator provides a proven, independently audited secure digital platform that includes (1) a landing zone, (2) an “in-boundary” cloud general support system (GSS) and (3) compliance controls for the DOD IL5 package/SSP (System Security Plan). stackArmor provides our clients a suite of implemented security controls, evidentiary support and artifacts, and
When using containers, Cloud Service Providers (CSPs) are NOT precluded from adhering to host-based security guidelines and FIPS 140-2 (soon 140-3) encryption requirements
This is an older blog which has been superseded by the latest blog based on the official release of the Rev 5 baselines by the FedRAMP PMO. Since its inception, FedRAMP has used the National Institute of Standards and Technology Special Publication 800-53 (NIST 800-53) procedures and guidelines as the foundation for providing standardized security requirements and control definitions for cloud service providers wanting to serve the federal market. In fact, FISMA, RMF, FedRAMP, OSCAL, and SCF all use NIST as a gold-standard foundation for standardized compliance guidelines. To align with the updates in NIST’s final release of Rev. 5 (which was drafted in 2020 and open to public comment through October 1 of 2021,) FedRAMP has re-established their control baselines accordingly. In December of 2021, FedRAMP released their new Rev 5 baselines, re-aligning with the NIST Rev. 5 update. The new baselines are a result of close collaboration between the FedRAMP
