Question · FedRAMP
What's the difference between an agency ATO and FedRAMP Certification?
FedRAMP is the government-wide program for security assessment and authorization of cloud services; by statute a FedRAMP authorization package is presumed adequate for an agency's own ATO.
01 / The answer
The short answer
An ATO is one agency's decision, made by its authorizing official, to accept the risk of operating a specific system under the NIST RMF and OMB Circular A-130. A FedRAMP certification is a government-wide determination that a cloud service meets FedRAMP's security requirements. Under the FedRAMP Authorization Act (44 U.S.C. 3613), the assessment in a FedRAMP package is presumed adequate for agency use, so agencies reuse it instead of reassessing, but each agency still issues its own ATO.
02 / The rule
What FedRAMP requires
FedRAMP is the government-wide program for security assessment and authorization of cloud services; by statute a FedRAMP authorization package is presumed adequate for an agency's own ATO. FedRAMP 20x, now in Phase 3, replaces document-heavy Rev5 reviews with automated, machine-readable validation and Class A to D certifications, and FedRAMP prioritized several generative AI services in 2025-2026.
- 01Cloud providers must obtain FedRAMP certification at the class or impact level matching the agency data.
- 02Implement and evidence the required controls, or the 20x key security indicators, and pass independent assessment.
- 03Perform continuous monitoring and report vulnerabilities and changes to FedRAMP and agencies.
- 04Agencies must reuse existing FedRAMP assessments where practicable and still issue their own ATO.
03 / Records
Records to keep
- 01FedRAMP Marketplace listing and certification letter
- 02System security plan or 20x machine-readable package
- 03Independent assessment report
- 04Monthly continuous monitoring deliverables
Optional evidence · where Planisphere fits
Keep a record anyone can check
When your team meets a duty, Planisphere can seal the event it reports as a receipt.
A disclosure shown, a review signed, a model change approved: the event your system reports.
The event becomes a sealed receipt, dated and attributed to whoever is signed in.
Paste the receipt into Verify. No account or key.
A record supports your compliance evidence process. It is not a legal finding or a certification. Systems that call Planisphere's gate API can also hold or refuse an action before it runs.
SOURCES
Go back to the source
FedRAMP (GSA)
FedRAMP (GSA)
Legal Information Institute (Cornell)
FedRAMP (GSA)
RELATED
Related: FedRAMP: the full guide · What is FedRAMP 20x and how does it change the FedRAMP Certification path? · How do I produce machine-readable KSI / continuous-monitoring evidence? · Is FedRAMP High enough for DoD, or do I also need an Impact Level?