Why is FedRAMP important?

In response to the federal government’s Cloud First Policy (now Cloud Smart Strategy), the Office of Management and Budget (OMB) issued the FedRAMP Policy Memo established FedRAMP to provide a standard path for agencies to comply with their obligations under FISMA 2002. FedRAMP is mandatory for all US federal agencies and all cloud services. FedRAMP is important because it increases: Consistency and confidence in the security of cloud solutions using National Institutes of Standards & Technology (NIST) and FISMA defined standards Transparency between US government and cloud providers Automation and near real time continuous monitoring Adoption of secure cloud solutions through reuse of assessments and certifications

What are the requirements for FedRAMP compliance?

All federal agencies are required to use the FedRAMP process to conduct security assessments, certifications, and continuous monitoring of cloud services. The FedRAMP Program Management Office (PMO) has outlined the following requirements for FedRAMP compliance: The cloud service provider (CSP) has achieved FedRAMP Certification. The CSP meets the FedRAMP security control requirements as described in the National Institutes of Standards & Technology (NIST) 800-53, Rev. 5 security control baseline for moderate or high impact levels. The CSP must be assessed by a FedRAMP Recognized Independent Assessment Service (formerly 3PAO) . The CSP must submit a complete FedRAMP Certification Package to the FedRAMP PMO.

How do CSPs meet FedRAMP compliance?

Agency Authorization: To receive a FedRAMP Agency Authority to Operate (ATO), a CSP is reviewed by a customer Agency CIO or Delegated Authorizing Official(s). An agency ATO issued by a customer agency is verified by the FedRAMP Program Management Office (PMO) .

As a part of the recently announced FedRAMP 20x initiative, the FedRAMP Program Management Office (PMO), industry stakeholders, and agency experts are working to redesign the FedRAMP assessment process. According to the FedRAMP PMO, the goal of FedRAMP 20x is to streamline and enhance the compliance process by: Streamlining Continuous Monitoring: Revisiting the approach to continuous monitoring, emphasizing ongoing, automated assessments to ensure compliance is maintained effectively over time. Automating Assessments: Developing mechanisms to automate security requirement validations, reducing the time and resources required for manual reviews. Leveraging Existing Frameworks: Allowing CSPs to use existing commercial security frameworks, minimizing duplicative efforts and enhancing compatibility with federal requirements. Enabling Continuous Reporting: Enhancing communication between CSPs and federal agencies by providing real-time reporting and monitoring capabilities. To facilitate these improvements, working groups have been established to discuss these topics and gather input from stakeholders. These groups will help shape the future of FedRAMP. For more information about FedRAMP 20x, please visit the FedRAMP 20x and FedRAMP 20x Working Groups pages.

What are the FedRAMP Consolidated Rules for 2026 (CR26)?

The FedRAMP Consolidated Rules for 2026 (CR26) are published regulations that modernize how cloud service providers communicate changes and maintain ongoing compliance with FedRAMP. CR26 introduces standardized processes including Significant Change Notifications (SCN) for how providers communicate reportable changes to agency customers, and Collaborative Continuous Monitoring (CCM) for ongoing compliance reporting. Under CR26, "FedRAMP Authorized" is updated to "FedRAMP Certified," reflecting compliance validated on an ongoing basis. For more information, visit the FedRAMP Consolidated Rules for 2026 page .

What are Significant Change Notifications (SCN)?

Under the FedRAMP Consolidated Rules for 2026 (CR26), when a cloud service provider makes a reportable change to a FedRAMP-certified Cloud Service Offering, the provider issues a Significant Change Notification (SCN) to agency customers. SCNs provide agencies with details about the nature of the change and its potential security impact, enabling agencies to make informed risk-based decisions. For full details on SCN requirements and change classifications, visit the FedRAMP Consolidated Rules for 2026 page . Agency customers can request access to AWS SCN documentation by completing a Package Access Request Form and submitting it to package-access@fedramp.gov .

How does an agency leverage the AWS FedRAMP certification?

Under CR 2026, the FedRAMP PMO defines core security requirements, grants FedRAMP Certifications consistent with FedRAMP Board direction, and performs continuous monitoring oversight including review of Ongoing Certification Reports. The PMO also establishes standards and provides guidance, serving as the central point of contact between agencies and the commercial cloud sector. Agencies must still issue their own Authority to Operate (ATO) through the Risk Management Framework for systems that incorporate FedRAMP Certified services — the agency ATO is the agency’s responsibility, while FedRAMP Certification is the CSP’s. Agencies are required to review Ongoing Certification Reports, notify FedRAMP upon authorization, and must not impose additional security requirements on Certified CSPs unless a demonstrable need exists and FedRAMP is notified. CSPs achieve and maintain FedRAMP Certification (replacing the former “Authorization”) by meeting NIST 800-53 Rev 5 controls, undergoing annual independent assessment by a FedRAMP Recognized Independent Assessment Service (formerly 3PAO), performing continuous monitoring and vulnerability management, publishing quarterly Ongoing Certification Reports, and issuing Significant Change Notifications to agencies for material changes to any AWS cloud service offerings the agency uses.

AWS Cloud Security

Federal Risk and Authorization Management Program

(FedRAMP)

Overview

The US Federal Government is dedicated to delivering its services to the American people in the most innovative, secure, and cost-efficient fashion. Cloud computing plays a key part in how the federal government can achieve operational efficiencies and innovate on demand to advance their mission across the nation. That is why many federal agencies today are using AWS cloud services to process, store, and transmit federal government data.

FAQs
25

FAQs

Open all

The Federal Risk and Authorization Management Program (FedRAMP) is a US government-wide program intended to standardize the security assessment, certification, and continuous monitoring for cloud products and services used by federal agencies. The governing bodies of FedRAMP include the FedRAMP Board, the FedRAMP Program Management Office (PMO), the FedRAMP Technical Advisory Group (TAG), and Federal Secure Cloud Advisory Committee (FSCAC).

Cloud Service Providers (CSPs) that want to offer their Cloud Service Offerings (CSOs) to the US government must demonstrate FedRAMP compliance. FedRAMP uses the NIST Special Publication 800 series and requires cloud service providers to complete an independent security assessment conducted by a FedRAMP Recognized Independent Assessment Service (formerly 3PAO) to ensure that certifications are compliant with the Federal Information Security Management Act of 2002 (FISMA 2002). For more information, see the FedRAMP website.

In response to the federal government’s Cloud First Policy (now Cloud Smart Strategy), the Office of Management and Budget (OMB) issued the FedRAMP Policy Memo established FedRAMP to provide a standard path for agencies to comply with their obligations under FISMA 2002. FedRAMP is mandatory for all US federal agencies and all cloud services. FedRAMP is important because it increases:

Consistency and confidence in the security of cloud solutions using National Institutes of Standards & Technology (NIST) and FISMA defined standards
Transparency between US government and cloud providers
Automation and near real time continuous monitoring
Adoption of secure cloud solutions through reuse of assessments and certifications

All federal agencies are required to use the FedRAMP process to conduct security assessments, certifications, and continuous monitoring of cloud services. The FedRAMP Program Management Office (PMO) has outlined the following requirements for FedRAMP compliance:

The cloud service provider (CSP) has achieved FedRAMP Certification.

Federal Risk and Authorization Management Program

Overview

FAQs

What is FedRAMP?

Why is FedRAMP important?

What are the requirements for FedRAMP compliance?