The FedRAMP Authorization Checklist

FedRAMP authorization is often seen as slow and bureaucratic. But for most cloud service providers, it’s also the most direct way to work with federal agencies and expand into the public sector.
‍

If you’re considering FedRAMP authorization, use this checklist to navigate the process efficiently and set your organization up for long-term success. It includes details on what to expect during each step of the process, required documentation, and best practices to avoid delays. 

‍

FedRAMP categorization levels

FedRAMP authorization requirements differ depending on your level of impact. In other words, as you work with more sensitive data, you’ll need to implement more robust security measures and controls. Traditionally, most cloud service providers pursue Moderate authorization. 
‍

Here’s an overview of the different impact levels, common use cases, and your standard expected timeline to authorization. 

‍

‍

You can find a full record of all cloud service providers with FedRAMP authorization, as well as their level, on the FedRAMP Marketplace.

‍

Is the FedRAMP 20x Pilot right for my organization? 

FedRAMP 20x is a new, fast-track authorization pilot that streamlines the process. Phase One focuses on Low authorization, with Phase Two planned for Moderate.
‍

If you plan to pursue FedRAMP Low authorization, consider the 20x Pilot program (check out Vanta’s learnings from the pilot here). If you plan to pursue a higher authorization, follow the steps below. 

‍

Checklist: Steps to achieve FedRAMP authorization

Interested in becoming FedRAMP authorized? Here’s an overview of the process.

{{fedramp="/checklists"}}