fedramp-compliance

1# FedRAMP Compliance
2 
3Implement FedRAMP (Federal Risk and Authorization Management Program) requirements for cloud service providers serving US federal agencies.
4 
5## When to Use
6 
7- Pursuing FedRAMP authorization for a cloud service offering
8- Implementing NIST 800-53 security controls for federal workloads
9- Establishing continuous monitoring (ConMon) processes
10- Managing Plan of Action and Milestones (POA&M) tracking
11- Preparing for a Third-Party Assessment Organization (3PAO) audit
12- Operating a FedRAMP-authorized system and maintaining authorization
13 
14## Impact Levels
15 
16```yaml
17impact_levels:
18  low:
19    control_count: ~125
20    use_case: "Publicly available federal information"
21    examples:
22      - Public-facing websites with no sensitive data
23      - Open data portals
24      - Marketing and informational systems
25    data_types: "No PII, no CUI, publicly releasable only"
26    authorization_path: "FedRAMP Tailored (Li-SaaS) or standard Low"
27 
28  moderate:
29    control_count: ~325
30    use_case: "Most federal systems, including CUI"
31    examples:
32      - Email and collaboration platforms
33      - Case management systems
34      - Financial management systems
35      - HR and personnel systems
36    data_types: "CUI, PII, law enforcement sensitive (LES)"
37    authorization_path: "Agency or JAB P-ATO"
38    note: "~80% of FedRAMP authorizations are at Moderate"
39 
40  high:
41    control_count: ~425
42    use_case: "High-impact federal systems"
43    examples:
44…