A New Hope For An Expedited FedRAMP Process

The Federal Risk and Authorization Management Program, or FedRAMP, is a government-wide program to assess, monitor, and pre-authorize cloud-based products and services. Agencies often include in their solicitations a requirement for FedRAMP certification, and cloud service providers (CSPs) must obtain this certification before implementation of any services. FedRAMP uses Third Party Assessment Organizations (3PAOs) to perform initial and periodic cybersecurity assessments of CSPs, based on a baseline set of controls established by the National Institutes of Science and Technology (NIST).

The first question we typically field from clients seeking to go through the FedRAMP certification process is: "How long will this take?" As the number of contractors seeking certification has increased, the process has been getting slower, even as more 3PAOs have become available to conduct assessments.