Federal Risk and Authorization Management Program (FedRAMP)

Go up to Terms and Definitions

The Federal Risk and Authorization Management Program (FedRAMP) establishes a government-wide approach for evaluating cloud computing products and services used by United States federal agencies.

FedRAMP provides common security assessment rules, documentation expectations, evidence, and authorization-related information that federal agencies can use when making risk-based decisions about cloud services.

FedRAMP applies to cloud computing products and services within its defined scope. FedRAMP does not replace an agency's responsibility to make its own authorization and risk-management decisions.

Within Crucible documentation, FedRAMP provides a source for:

• Compliance Baselines
• Security controls
• Assessment criteria
• Security-control implementation information
• Compliance findings
• Compliance Evidence
• Authorization-supporting information

A United States government-wide program that provides a standardized approach to the security assessment and authorization of cloud computing products and services used by federal agencies.

Federal Risk and Authorization Management Program, FedRAMP.gov.

United States federal law and government-wide guidance governing the Federal Risk and Authorization Management Program.

The acronym FedRAMP means Federal Risk and Authorization Management Program.

FedRAMP supplies assessment and authorization information that federal agencies use when making authorization decisions. FedRAMP does not itself issue a government-wide Authorization to Operate (ATO) for every agency use of a cloud service.

A FedRAMP Compliance Baseline represents compliance criteria derived from an identified FedRAMP baseline or assessment framework.

Crucible defines a FedRAMP Compliance Baseline that identifies security controls, assessment criteria, required implementation information, and supporting Evidence for a cloud service deployment.