Questions / Answer
FedRAMP Ready vs FedRAMP Authorized: What Is the Difference?
Your cloud product wants federal customers, and the FedRAMP labels are confusing.
Here is the difference between Ready and Authorized in plain language.
What does FedRAMP stand for?
FedRAMP means Federal Risk and Authorization Management Program.
It is the United States program that judges if a cloud service is secure enough for federal agencies.
A cloud service in this article is any product delivered over the internet. A cloud service provider (CSP) is the company selling it.
What is FedRAMP Ready?
FedRAMP Ready is a starting badge, not a finish line.
An independent audit firm approved by FedRAMP checks your service. This firm is called a Third-Party Assessment Organization (3PAO).
The 3PAO writes its findings in a Readiness Assessment Report (RAR). FedRAMP's program office reviews the RAR. If the office approves it, your service is listed as FedRAMP Ready on the FedRAMP Marketplace.
Ready sends one message. An independent auditor thinks your service can likely pass the full authorization process.
Ready does not let any agency use your service yet.
What is FedRAMP Authorized?
FedRAMP Authorized is the finish line. It means your service completed the full authorization process.
The service holds one of two authorizations. One is a Provisional Authorization to Operate (P-ATO) from the Joint Authorization Board (JAB), a group of government reviewers. The other is an Authorization to Operate (ATO) from a federal agency.
Other agencies can reuse that authorization. That is the whole point of the program: authorize once, use many times.
Who grants each designation?
The Ready designation comes from FedRAMP's program office after it approves the RAR. The 3PAO performs the assessment, but the office decides.
Authorization comes from a different hand. Either the JAB grants a P-ATO, or a federal agency grants an ATO.
What evidence goes into each?
For Ready, the key evidence is the RAR itself.
The 3PAO checks your technical security controls. It looks at vulnerability management, logging, incident response, and change management. A finished System Security Plan (SSP) is not required at this stage. The check focuses on what your system does, not on how much paperwork you wrote.
For Authorized, the evidence is a full security package.
That includes the SSP and a security assessment plan and report. It also includes a plan of action and milestones for any weak spots, plus continuous monitoring artifacts. The 3PAO assesses your system against the full FedRAMP control baseline.
What is the path from Ready to Authorized?
- Pick an accredited 3PAO from the FedRAMP Marketplace list.
- The 3PAO runs the readiness assessment and writes the RAR.
- FedRAMP reviews the RAR. Approval earns the Ready designation and a Marketplace listing.
- Find a federal agency to sponsor your authorization, or pursue the JAB path. Ready is required before entering the JAB P-ATO process.
- Write the full SSP and build the complete security authorization package.
- Your 3PAO performs the full security assessment against every control.
- Fix what the assessors find. Track the rest in a plan of action and milestones.
- The agency issues an ATO, or the JAB grants a P-ATO. Your service is now FedRAMP Authorized.
Which one should a startup aim for first?
Aim for Ready first. It is an early step that gets you listed on the Marketplace, where agencies can find you.
If an agency already wants to sponsor you, move toward authorization directly. Ready is still worth doing first, because the RAR shows your gaps before the big assessment.
Ready never replaces authorization. No agency can put a merely Ready service into production.
A note on wording
FedRAMP does not recognize labels like "FedRAMP Compliant" or "FedRAMP Equivalent". Those phrases have no legal meaning in the program.
Use only the official designations: Ready, In Process, or Authorized.
Where do tools fit in?
Collecting the evidence is the hard part of both stages.
Tools that pull live configuration data from your cloud environment cut down the manual work of proving each control. PolicyCortex is one such tool. Its 33 collectors read live Azure configuration. The product is evaluated against NIST 800-53 and NIST 800-171. It generates SSP, SAR (Security Assessment Report), and POA&M (Plan of Action and Milestones) output from collected evidence. It supports re-verification after remediation. It is strongest in commercial Azure, and it covers AWS too.
To see how automated evidence collection works, visit policycortex.com.
Sources
- FedRAMP FAQ, "What is the difference between FedRAMP Ready and FedRAMP Authorized?", https://www.fedramp.gov
- FedRAMP Marketplace, https://marketplace.fedramp.gov
- FedRAMP documentation: designations for cloud service offerings, https://github.com/fedramp/docs/blob/HEAD/tools/site/content/rev5/playbook/agency/authorization/marketplace.md
- FedRAMP documentation: the agency authorization path, https://github.com/fedramp/docs-legacy/blob/HEAD/content/playbook/csp/authorization/agency-authorization-path.md