The Federal Risk and Authorization Management Program (FedRAMP) is a US government-wide programme providing a standardised approach to security assessment, authorisation, and continuous monitoring for cloud products and services. Any cloud service that stores, processes, or transmits US federal government data must achieve FedRAMP authorisation — either a Provisional ATO (P-ATO) from the Joint Authorization Board (JAB) or an Agency ATO from a sponsoring federal agency.
FedRAMP Rev 5 (2023) aligns with NIST SP 800-53 Rev 5 and introduces updated baselines: Low (125 controls), Moderate (323 controls), and High (421 controls). A Third-Party Assessment Organisation (3PAO) — accredited by the American Association for Laboratory Accreditation (A2LA) — must conduct the initial assessment and annual assessments. For Indian cloud firms seeking to serve the US federal market, FedRAMP is a major market access requirement.