About FedRAMP Explained

FedRAMP Explained is an independent explainer. It answers common questions about the FedRAMP program in plain words. It is not affiliated with FedRAMP, and nothing here is official guidance.

If you sell cloud services to the federal government, this site helps you understand what the program asks for and what the road looks like.

PolicyCortex is a cloud governance and compliance automation platform. It uses 33 collectors that read live Azure configuration. It connects to Microsoft Azure and Amazon Web Services. It reads live settings such as conditional access, diagnostic settings, Defender posture, backup, and firewall configuration. It checks those settings against NIST 800-53 and NIST 800-171 controls. It turns that evidence into SSP, SAR, and POA&M documents. It re-checks controls after you fix them. It is strongest in commercial Azure.