thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Governance, Risk, Audit & Privacy · Intermediate

FedRAMP

Federal Risk and Authorization Management Program, the US government-wide approach to security assessment and authorization of cloud services.

Definition

FedRAMP, codified by the FedRAMP Authorization Act of 2022, uses NIST SP 800-53 based baselines (Low, Moderate, High, and LI-SaaS) and independent 3PAO assessments so an authorization can be reused by multiple agencies. Authorization occurs primarily through agency sponsorship, with the FedRAMP Board providing governance after the JAB was retired. FedRAMP 20x, launched in 2025, is modernizing the process toward automated, outcome-based validation.

Example

A SaaS provider pursues a FedRAMP Moderate authorization sponsored by the Department of Energy.

Exam tip

FedRAMP is for cloud services used by federal agencies; FISMA is the underlying law.

Related terms