United States (federal) · statute
FedRAMP: what it requires, and the records to keep
FedRAMP is the government-wide program for security assessment and authorization of cloud services; by statute a FedRAMP authorization package is presumed adequate for an agency's own ATO. FedRAMP 20x, now in Phase 3, replaces document-heavy Rev5 reviews with automated, machine-readable validation and Class A to D certifications, and FedRAMP prioritized several generative AI services in 2025-2026.
01 / What it requires
What FedRAMP requires
Federal agencies using cloud services, and cloud service providers (including AI SaaS providers) that host federal information.
- 01Cloud providers must obtain FedRAMP certification at the class or impact level matching the agency data.
- 02Implement and evidence the required controls, or the 20x key security indicators, and pass independent assessment.
- 03Perform continuous monitoring and report vulnerabilities and changes to FedRAMP and agencies.
- 04Agencies must reuse existing FedRAMP assessments where practicable and still issue their own ATO.
- 05From January 1, 2027, follow the Consolidated Rules for 2026 to keep certification.
02 / AI work
Where it touches AI work
AI cloud services used by agencies need FedRAMP coverage; FedRAMP's 2025 AI Prioritization Initiative fast-tracked OpenAI, Google and Perplexity services, which were certified in early 2026, with a criterion that training on customer data stays in the customer environment.
03 / Dates
The dates that matter
FedRAMP Authorization Act enacted in the FY2023 NDAA
FedRAMP 20x Phase 3, wide-scale adoption, began
20x Class B and C certification pipeline opened
Consolidated Rules for 2026 become mandatory
FedRAMP stops accepting new Rev5 certifications
04 / Enforcement
Who enforces it
GSA's FedRAMP office and agency authorizing officials; certifications can be suspended or revoked. No statutory fines.
05 / Records
Records an organisation keeps
What an auditor or an inquiry usually asks to see. Your obligations depend on your role and your facts.
- 01FedRAMP Marketplace listing and certification letter
- 02System security plan or 20x machine-readable package
- 03Independent assessment report
- 04Monthly continuous monitoring deliverables
Optional evidence · where Planisphere fits
Keep a record anyone can check
When your team meets a duty, Planisphere can seal the event it reports as a receipt.
A disclosure shown, a review signed, a model change approved: the event your system reports.
The event becomes a sealed receipt, dated and attributed to whoever is signed in.
Paste the receipt into Verify. No account or key.
A record supports your compliance evidence process. It is not a legal finding or a certification. Systems that call Planisphere's gate API can also hold or refuse an action before it runs.
QUESTIONS
The questions that come next
What is FedRAMP 20x and how does it change the FedRAMP Certification path?+
FedRAMP 20x is GSA's replacement for the document-heavy Rev5 process. It validates security through Key Security Indicators, machine-readable evidence and automated checks instead of long narrative packages. Rules are final for Class A, B and C certifications; the 20x Class B and C pipeline opened August 31, 2026, and a Class D (High) pilot is planned for FY27. The Consolidated Rules for 2026 become mandatory January 1, 2027, and FedRAMP stops accepting new Rev5 certifications on June 11, 2027. Agencies still issue their own ATOs. Read the full answer
How do I produce machine-readable KSI / continuous-monitoring evidence?+
Generate it from your systems automatically rather than writing it up. For each Key Security Indicator that applies to your certification class, collect the underlying data, such as configurations, scan results, logs and change records, through tooling; validate it on a recurring schedule; and publish it in the machine-readable form FedRAMP's Consolidated Rules for 2026 call for, with timestamps and integrity protection so agencies can check it. For an AI service, include repeatable evaluation results and record what changed between runs. Read the full answer
What's the difference between an agency ATO and FedRAMP Certification?+
An ATO is one agency's decision, made by its authorizing official, to accept the risk of operating a specific system under the NIST RMF and OMB Circular A-130. A FedRAMP certification is a government-wide determination that a cloud service meets FedRAMP's security requirements. Under the FedRAMP Authorization Act (44 U.S.C. 3613), the assessment in a FedRAMP package is presumed adequate for agency use, so agencies reuse it instead of reassessing, but each agency still issues its own ATO. Read the full answer
Is FedRAMP High enough for DoD, or do I also need an Impact Level?+
Usually not, for DoD data above IL2. DoD applies its Cloud Computing SRG Impact Levels on top of FedRAMP: a FedRAMP authorization can support IL2, but IL4, IL5 and IL6 need a DoD Provisional Authorization from DISA, based on FedRAMP plus DoD-specific requirements such as a Boundary Cloud Access Point connection and DoD PKI for IL4 and IL5. FedRAMP does not cover classified (IL6) data. The DoD mission owner then issues its own ATO. Read the full answer
SOURCES
Go back to the source
FedRAMP (GSA)
FedRAMP (GSA)
Legal Information Institute (Cornell)
FedRAMP (GSA)
CHANGE LOG
What changed, and when
Rebuilt from primary sources; facts checked on this date.
Related: FedRAMP for defense AI workflows · NIST AI RMF · OMB M-25-21/22 · DoW RAI S&IP · EO 14179 · FIPS 140-3 · SHA-256 / FIPS 180-4