Toolkit
FedRAMP readiness cheat sheet
A one-page summary to work from, not a substitute for the full guide or the official text.
Saves a one-page PDF straight to your device. It is put together by your browser, on this page — nothing is uploaded.
Who it's for. Cloud service providers (IaaS, PaaS or SaaS) that want US federal agencies to use their offerings.
Scope
- Applies per cloud service offering, not the whole company — check the FedRAMP Marketplace listing for what's actually authorised
- Rev5 (established model, NIST SP 800-53 Rev. 5 baselines) and FedRAMP 20x (automation-focused, go-forward model) currently run in parallel
- New Rev5 submissions are estimated to close 11 June 2027; 20x currently covers Low/Moderate-equivalent classes, with High still in development
Key requirements
- Decide your target impact level or 20x class, based on the data and mission your federal customers will actually use
- Find an agency sponsor — most paths still need one
- Under Rev5: build the system security plan, and have a 3PAO produce the security assessment plan and report
- Under 20x: invest in automated, machine-readable evidence against the published key security indicators
- Run continuous monitoring after authorisation — monthly scanning and POA&M updates under Rev5
- List the offering on the FedRAMP Marketplace once authorised, and keep its status current
Evidence to gather
- System security plan and supporting attachments (policies, inventory, interconnections, incident response and contingency plans)
- Security assessment plan and report (Rev5) or key security indicator evidence (20x)
- Plan of action and milestones
- Monthly vulnerability scan results and continuous monitoring deliverables
- Significant-change request records
Common gaps
- Calling a service 'FedRAMP compliant' without an actual Marketplace authorisation — readiness or in-process status isn't authorisation
- Underestimating the ongoing effort of continuous monitoring, which usually exceeds the initial package
- Starting at too high or too low an impact level for the data actually involved
- Confusing FedRAMP with GovRAMP (state/local government) or CMMC (defence contractors) — different programmes
This is general educational information, condensed by MajorCyber™ in its own words, not legal, audit or certification advice, and not a compliance assessment, certification or attestation of any kind. It is a starting checklist, not a complete statement of the framework's requirements — confirm anything material against the full FedRAMP guide, the official text, or a qualified adviser.