National Institute of

Standards and Technology

Information Technology Laboratory

Overview of the

Federal Risk and Authorization 

Management Program

(FedRAMP)

briefing for 

Visiting Committee on Advanced Technology (VCAT)

Chuck Romine, Director, ITL

February 8, 2012
National Institute of

Standards and Technology

Information Technology Laboratory

ISIMC: Federal CIO Council 

sponsored Information 

Security and Identity 

Management Committee

FedRAMP

• Government-wide program

– OMB Policy Memo (12/8/2011)

– For cloud products and services 

• Provides a standardized 

approach 

– security assessment

– authorization

– continuous monitoring 

• Re-uses existing security 

assessments across agencies

Assess once; Use many
National Institute of

Standards and Technology

Information Technology Laboratory 3

CSP

Current Assessment /Authorization Model Applied to Cloud

Assessment

Assessment

Assessment

Authorization

Authorization

Authorization

Agency 1

Agency 2

Agency 3

Authorization

Authorization

Authorization

Agency 1

Agency 2

Agency 3

List of 

Provisionally 

Authorized 

Cloud 

Providers

$

$

$

$

FedRAMP Model

Note: Difference between FedRAMP standard control set and FedRAMP set can be accommodated.

CSP
National Institute of

Standards and Technology

Information Technology Laboratory

NIST Role

• NIST Cloud Computing Program: build a U.S. 

Government Cloud Computing Roadmap 

• Technical Advisor on FedRAMP

– Collaborated with Federal CIO Council Security 

Working Group to develop FedRAMP concept

– Collaborate with GSA to develop and implement a 

formal conformity assessment program 

consistent independent, third-party assessments of 

security controls implemented by Cloud Service 

Providers

– Technical Experts regarding FISMA compliance

• Special Publications (SP) 800-53 and 800-37

• Federal Information Processing Standards (FIPS) 

199 and 200

– Advise Joint Authorization Board on compliance 

requirements
National Institute of

Standards and Technology

Information Technology Laboratory

FedRAMP

requirements 

for Provisional 

Authorization

ISO/IEC 17020 

+ FedRAMP 

competency 

requirements

ISO/IEC 17011 

+ technical 

requirements

FedRAMP Program Built on 

International Standards

Cloud Service 

Providers

Third Party Assessment 

Organization

(Inspection Body/ies)

Accreditor(s)

FedRAMP 

PMO

ISO/IEC 17011; Conformity assessment -- General requirements for accreditation bodies accrediting conformity assessment bodies 

ISO/IEC 17020; General criteria for the operation of various types of bodies performing inspection

Oversight &

Communication
National Institute of

Standards and Technology

Information Technology Laboratory

FedRAMP Phases and Timeline

Phased evolution towards sustainable operations allows for risk management, capture of lessons learned, and incremental rollout.

FY12

FY12 FY12 FY13 Q2 FY14

Pre-Launch Activities Initial Operational 

Capabilities (IOC)

Full Operations Sustaining 

Operations

Finalize Requirements and 

Documentation in 

Preparation of Launch

Launch IOC with Limited 

Scope and Cloud 

Service Provider (CSP)s

Execute Full Operational

Capabilities with Manual

Processes

Move to Full 

Implementation with 

On-Demand 

Scalability 

Key 

Activities

• Publish FedRAMP 

Requirements (Security 

Controls, Templates, 

Guidance)

• Publish Agency 

Compliance Guidance 

• Accredit 3PAOs

• Establish Priority Queue

• Authorize CSPs

• Update CONOPS, 

Continuous Monitoring 

Requirements and CSP 

Guidance

• Conduct Assessments 

& Authorizations

• Scale Operations to 

Authorize More CSPs 

• Implement 

Electronic 

Authorization 

Repository

• Scale to Steady 

State Operations

Outcomes • Initial List of Accredited 

3PAOs

• Launch FedRAMP into 

Initial Operating 

Capabilities

• Initial CSP 

Authorizations

• Established 

Performance 

Benchmark

• Multiple CSP 

Authorizations

• Defined Business 

Model

• Measure Benchmarks

• Authorizations 

Scale by Demand

• Implement 

Business Model

• Self-Sustaining 

Funding Model 

Covering 

Operations

• Privatized

Accreditation Board

Gather Feedback and Incorporate Lessons Learned

http://FedRAMP.gov