fedramp-compliance – DevOps & Infrastructure skill for AI agents

FedRAMP Compliance

Implement FedRAMP (Federal Risk and Authorization Management Program) requirements for cloud service providers serving US federal agencies.

When to Use

• Pursuing FedRAMP authorization for a cloud service offering
• Implementing NIST 800-53 security controls for federal workloads
• Establishing continuous monitoring (ConMon) processes
• Managing Plan of Action and Milestones (POA&M) tracking
• Preparing for a Third-Party Assessment Organization (3PAO) audit
• Operating a FedRAMP-authorized system and maintaining authorization

Resolve the Applicable Program First

This is an illustrative Rev5 evidence-planning guide, not a current certification checklist. Record the service boundary, agency customers, selected Rev5 or 20x path, class, rule version and effective date before mapping controls. In the 2026 transition, FedRAMP uses certification and Classes A–D terminology; the timeline permits early adoption before January 2027 mandatory adoption, with area-specific effective dates. Legacy Low/Moderate/High labels below provide historical context only. Do not select a category from a data-type example alone: assess confidentiality, integrity and availability impact with the responsible agency and current rules.

Use the current official baseline and templates, not the illustrative subset below. JAB P-ATO is not a required route for High systems; JAB authorizations transitioned to the single FedRAMP designation. An agency’s authorization to operate remains a separate decision.

Historical Impact Labels (Illustrative)

impact_levels:
  low:
    baseline: "Resolve current applicable official baseline"
    use_case: "Publicly available federal information"
    examples:
      - Public-facing websites with no sensitive data
      - Open data portals
      - Marketing and informational systems
    data_types: "No PII, no CUI, publicly releasable only"
    path: "Resolve current program/class and eligibility"

  moderate:
    baseline: "Resolve current applicable official baseline"
    use_case: "Most federal systems, including CUI"
    examples:
      - Email and collaboration platforms
      - Case management systems
      - Financial management systems
      - HR and personnel systems
    data_types: "CUI, PII, law enforcement sensitive (LES)"
    path: "Resolve current program/class and eligibility"

  high:
    baseline: "Resolve current applicable official baseline"
    use_case: "High-impact federal systems"
    examples:
      - Law enforcement and criminal justice systems
      - Emergency services and public safety
      - Financial systems with significant impact
      - Healthcare systems with PHI
    data_types: "Unclassified high-impact federal information; classified systems require a separate regime"
    path: "Resolve current program/class and eligibility"

NIST 800-53 Control Families

control_families:
  AC:
    name: "Access Control"
    key_controls:
      AC-2: "Account Management - manage system accounts lifecycle"
      AC-3: "Access Enforcement - enforce approved authorizations"
      AC-6: "Least Privilege - employ principle of least privilege"
      AC-17: "Remote Access - establish usage restrictions for remote access"
    implementation_notes: "Map to IAM policies, RBAC, MFA enforcement"

  AU:
    name: "Audit and Accountability"
    key_controls:
      AU-2: "Audit Events - define auditable events"
      AU-3: "Content of Audit Records - ensure records contain required info"
      AU-6: "Audit Review, Analysis, and Reporting"
      AU-12: "Audit Generation - generate audit records"
    implementation_notes: "Map to CloudTrail, CloudWatch Logs, SIEM"

  AT:
    name: "Awareness and Training"
    key_controls:
      AT-2: "Security Awareness Training - provide training to users"
      AT-3: "Role-Based Security Training - for personnel with security roles"
    implementation_notes: "Annual security training, role-specific training"

  CM:
    name: "Configuration Management"
    key_controls:
      CM-2: "Baseline Configuration - develop and maintain baseline"
      CM-6: "Configuration Settings - establish mandatory settings"
      CM-7: "Least Functionality - restrict to essential capabilities"
      CM-8: "Information System Component Inventory"
    implementation_notes: "Map to AWS Config, SSM, hardened AMIs"

  CP:
    name: "Contingency Planning"
    key_controls:
      CP-2: "Contingency Plan - develop and maintain plan"
      CP-4: "Contingency Plan Testing - test plan annually"
      CP-9: "Information System Backup"
      CP-10: "Information System Recovery and Reconstitution"
    implementation_notes: "Map to DR plan, backup strategy, failover testing"

  IA:
    name: "Identification and Authentication"
    key_controls:
      IA-2: "Identification and Authentication (Org Users)"
      IA-5: "Authenticator Management"
      IA-8: "Identification and Authentication (Non-Org Users)"
    implementation_notes: "Map to SSO, MFA, certificate-based auth, PIV/CAC"

  IR:
    name: "Incident Response"
    key_controls:
      IR-2: "Incident Response Training"
      IR-4: "Incident Handling - implement incident handling capability"
      IR-6: "Incident Reporting - follow applicable agency/program communications procedures"
      IR-8: "Incident Response Plan"
    implementation_notes: "Resolve recipient, severity/class and effective rules; maintain timed incident evidence"

  MA:
    name: "Maintenance"
    key_controls:
      MA-2: "Controlled Maintenance"
      MA-4: "Nonlocal Maintenance - authorize nonlocal maintenance"
    implementation_notes: "Patching procedures, remote maintenance controls"

  MP:
    name: "Media Protection"
    key_controls:
      MP-2: "Media Access - restrict access to media"
      MP-6: "Media Sanitization - sanitize media prior to disposal"
    implementation_notes: "Encryption at rest, secure disposal procedures"

  PE:
    name: "Physical and Environmental Protection"
    key_controls:
      PE-2: "Physical Access Authorizations"
      PE-3: "Physical Access Control"
      PE-6: "Monitoring Physical Access"
    implementation_notes: "Inherit from CSP for IaaS/PaaS, document inheritance"

  PL:
    name: "Planning"
    key_controls:
      PL-2: "System Security Plan (SSP)"
    implementation_notes: "SSP is the core FedRAMP deliverable"

  PS:
    name: "Personnel Security"
    key_controls:
      PS-3: "Personnel Screening"
      PS-4: "Personnel Termination"
      PS-5: "Personnel Transfer"
    implementation_notes: "Background checks, access revocation on termination"

  RA:
    name: "Risk Assessment"
    key_controls:
      RA-3: "Risk Assessment - conduct risk assessment"
      RA-5: "Vulnerability Scanning"
    implementation_notes: "Annual risk assessment, monthly vulnerability scans"

  CA:
    name: "Security Assessment and Authorization"
    key_controls:
      CA-2: "Security Assessments"
      CA-6: "Security Authorization"
      CA-7: "Continuous Monitoring"
    implementation_notes: "Annual assessment by 3PAO, ConMon program"

  SC:
    name: "System and Communications Protection"
    key_controls:
      SC-7: "Boundary Protection"
      SC-8: "Transmission Confidentiality and Integrity"
      SC-12: "Cryptographic Key Establishment and Management"
      SC-13: "Cryptographic Protection - currently acceptable CMVP-validated"
      SC-28: "Protection of Information at Rest"
    implementation_notes: "currently acceptable CMVP-validated modules required"

  SI:
    name: "System and Information Integrity"
    key_controls:
      SI-2: "Flaw Remediation"
      SI-3: "Malicious Code Protection"
      SI-4: "Information System Monitoring"
      SI-5: "Security Alerts, Advisories, and Directives"
    implementation_notes: "Patching SLAs, antimalware, IDS/IPS, SIEM"

  SA:
    name: "System and Services Acquisition"
    key_controls:
      SA-4: "Acquisition Process - security requirements in contracts"
      SA-9: "External Information System Services"
      SA-11: "Developer Security Testing"
    implementation_notes: "Supply chain risk management, SBOM"

  PM:
    name: "Program Management"
    key_controls:
      PM-1: "Information Security Program Plan"
      PM-9: "Risk Management Strategy"
    implementation_notes: "Organization-wide security program"

System Security Plan (SSP) Outline

ssp_sections:
  section_1: "Information System Name and Title"
  section_2: "Information System Categorization (FIPS 199)"
  section_3: "Information System Owner"
  section_4: "Authorizing Official"
  section_5: "Other Designated Contacts"
  section_6: "Assignment of Security Responsibility"
  section_7: "Information System Operational Status"
  section_8: "Information System Type (cloud service model)"
  section_9: "General System Description"
  section_10: "System Environment and Special Considerations"
  section_11: "System Interconnections"
  section_12: "Laws, Regulations, Policies Applicable"
  section_

… (full content is in the download package)