Federal Risk and Authorization Management Program

Description of FedRAMP

FedRAMP Moderate is one of the three security impact levels defined by the Federal Risk and Authorization Management Program (FedRAMP). It is the most common authorization level for Cloud Service Providers (CSPs) seeking to do business with the U.S. federal government, as it covers approximately 80% of current cloud service applications.

Core definition and sensitivity

The "Moderate" impact level is designated for systems where a security breach would result in serious (but not catastrophic) harm. This typically involves:

• Controlled Unclassified Information (CUI): Data that requires safeguarding or dissemination controls pursuant to and consistent with law, regulations, and government-wide policies.
• Sensitive data: This includes Personally Identifiable Information (PII), legal documents, and proprietary financial data.
• Consequences of breach: A loss of confidentiality, integrity, or availability would have a serious adverse effect on an agency's operations, assets, or individuals.

Key requirements and their importance

To achieve a FedRAMP Moderate authorization, a service provider must implement a baseline of security controls derived from NIST Special Publication 800-53.

• Security controls: It currently requires adherence to 325+ security controls. These range from technical safeguards like encryption to operational procedures like personnel screening and physical security Egnyte.
• Independent assessment: CSPs must undergo a rigorous audit by an accredited Third-Party Assessment Organization (3PAO) to verify that all controls are implemented correctly.
• Continuous monitoring: Authorization is not a one-time event; providers must perform monthly vulnerability scans and annual assessments to maintain their "Authority to Operate" (ATO).