Guide
FedRAMP explained for small cloud and SaaS firms
What FedRAMP is, the impact levels and paths to authorization, what it means for small SaaS vendors wanting to sell to US federal agencies, and alternatives such as partnering.
If you sell cloud software and want US federal agencies as customers, you'll run into FedRAMP, the Federal Risk and Authorization Management Program. It's the gate for federal cloud use.
What FedRAMP is
FedRAMP sets a standard approach to assessing and authorizing cloud services for federal use. Cloud services are assessed against security controls based on NIST SP 800-53, at an impact level that matches the sensitivity of the data:
- Low and Low Impact SaaS (LI-SaaS): for low-risk data.
- Moderate: the most common level, for most government data that isn't classified.
- High: for highly sensitive data, such as law enforcement or health.
An independent third-party assessment organization (3PAO) assesses the service. Once authorized, the service is listed on the FedRAMP Marketplace and agencies can reuse the authorization.
Paths to authorization
- Agency authorization: an agency sponsors you and grants an authorization to operate, which FedRAMP then reviews.
- FedRAMP 20x: a newer approach the program has been rolling out to make authorization faster and more automated, starting with lower-impact services. Check fedramp.gov for its current status, because the program has been changing quickly.
What it takes for a small firm
Traditional FedRAMP authorization has typically taken many months and a significant budget for preparation, the 3PAO assessment and continuous monitoring afterwards. You'll need documented controls, a system security plan, and ongoing monthly reporting. Newer approaches aim to reduce this, but it's still a major commitment.
Alternatives and stepping stones
- Build on an authorized platform. Hosting on a FedRAMP-authorized infrastructure provider means you inherit many controls, though your service still needs its own authorization.
- Partner or resell through a firm whose platform is already authorized.
- Sell services, not SaaS. Consulting, development and support for agencies' own cloud environments don't need FedRAMP for your firm.
- Start with state and local government, which often accept SOC 2, ISO 27001 or GovRAMP (formerly StateRAMP).
See selling IT to government in the US and SaaS terms for public sector buyers.
Common questions
Do I need FedRAMP to sell to the US government?
Only if you're providing a cloud service that federal agencies use to process government data. Services like consulting or development usually don't need it.
How long does FedRAMP take?
Traditionally, a year or more from preparation to authorization. FedRAMP 20x aims to shorten this significantly for qualifying services.
What is GovRAMP?
GovRAMP, formerly StateRAMP, is a separate program modelled on FedRAMP that many US state and local governments use to check cloud vendors' security.