FedRAMP · US federal cloud authorisation
FedRAMP compliance consulting for cloud services that US federal agencies can adopt with confidence.
FedRAMP is the gate a cloud service passes before US federal agencies trust it with their information. Sterling's expert and experienced consultants prepare cloud service providers for it: the right class and path, a defined boundary and security that proves itself continuously. We help our clients put it into practice and prove it.
- Fixed scope, one proposal: consulting, Effivity software, Sterling Academy access and internal auditor training, as applicable to your standard, in one proposal
- A team of expert and experienced cloud security consultants, with information security programmes consulting delivered across sectors and countries since 2003
- The Sterling Promise: 100% on-time completion, 100% success, 8,100+ client engagements. Sterling does not certify, authorise or assess; FedRAMP and your agency customers decide
8,100+ client engagements in 60+ countries.
NERC CIP client experience
What it is
What is FedRAMP and what is it used for?
FedRAMP is the US government programme that sets one security bar for cloud services used in federal agency information systems. Agencies are required by law and OMB policy to follow its rules when they use cloud services.
Two ideas organise it. The class sets how much assurance you supply, from Class A for pilots and low-risk use to Class D for most agency systems. The path sets how it is produced: FedRAMP 20x, built on Key Security Indicators validated persistently, or Rev5, built on NIST SP 800-53 Revision 5 controls. Certified services appear on the FedRAMP Marketplace, and each agency still grants its own Authority to Operate.
Current edition. The FedRAMP Consolidated Rules for 2026 took effect in July 2026 and become mandatory for all stakeholders on 1 January 2027. They rename "FedRAMP authorization" to "FedRAMP Certification" and replace the Low, Moderate and High impact levels with Classes A to D. New Rev5 applications close on 11 June 2027. Confirm current rules on fedramp.gov.
Who it is for
Who needs FedRAMP compliance?
FedRAMP applies to cloud service providers whose offering will hold federal information: software, platform and infrastructure providers. Enquiries usually start from one of four places:
- A federal agency wants to use your service. Ask which class its use case needs.
- A federal tender or contract vehicle requires it. The evaluator checks the Marketplace listing.
- A prime contractor or reseller asks for it. Integrators need each cloud component certified.
- A group company or your hosting platform already has it. That helps, but your own offering still needs its own certification.
Requirements
What are the main FedRAMP requirements?
The FedRAMP requirements are plain-language rules in the Consolidated Rules for 2026, grouped into rule sets; which bind you depends on your class and path.
- Marketplace Listing: the rules for appearing on the FedRAMP Marketplace.
- FedRAMP Certification: a target class and certification profile, with the relevant FedRAMP practices applied.
- Boundary rule sets: information resources, information flows and third-party resources in scope.
- Assurance rule sets: including vulnerability detection and response and collaborative continuous monitoring.
- Package rule sets: the Certification Package Overview and Security Decision Record, replacing the System Security Plan.
- Key Security Indicators (20x only): themes such as change management, identity and access management, incident response and supply chain risk.
- Rev5 Control Guidance (Rev5 only): NIST SP 800-53 Revision 5 controls.
- Ongoing Certification: the successor to continuous monitoring.
What does useful FedRAMP evidence look like?
Machine-readable evidence: packages move from Word and Excel to structured data. Behind it sit a boundary diagram matching the running system, pipeline change records, vulnerability findings with their response and logs someone reviewed. Evidence a script regenerates daily beats a screenshot taken the week before the assessor arrives.
Authorisation process
How do you get FedRAMP authorised?
FedRAMP calls the outcome a certification, but it is a government authorisation route, not an ISO-style certificate from an accredited body. FedRAMP grants it; agencies authorise their own use.
- 01Choose the class and confirm the path.The agency use cases you target set the class. On 20x no agency sponsor is needed; Rev5 generally needs one, and Class D on Rev5 always does.
- 02Gap analysis: compare your offering with the rules for that class.We map the boundary, test current security against the applicable rule sets and agree actions, owners and dates.
- 03Implement and automate the evidence.Close the gaps, build persistent validation, prepare the Certification Package and work towards a Marketplace listing.
- 04Complete the independent assessment.For Classes B, C and D, a FedRAMP Recognized assessor verifies and validates the offering, and its summary goes into the package.
- 05Submit, get certified and keep it current.FedRAMP reviews the package and grants the certification; Ongoing Certification and each agency's Authority to Operate follow.
Check the route before you sign. Assessors must be FedRAMP Recognized, and A2LA accredits third-party assessment organisations as inspection bodies under ISO/IEC 17020 and its FedRAMP-specific requirements. The recognised assessors are listed under the Assessors tab of the FedRAMP Marketplace; confirm yours there. The certification buyer's checklist
Cost
How much does FedRAMP compliance cost?
A FedRAMP budget is mostly engineering: making security measurable and automated.
| Cost component | What affects it |
|---|---|
| Advisory preparation | The target class, the size of the boundary, current maturity and whether you choose Design™ or Drive™ |
| Independent assessment | Scope and class, quoted by the FedRAMP Recognized assessor you engage |
| Engineering changes | Encryption, identity, logging, pipeline and configuration work needed to meet the rules |
| Tooling and data | Automation that produces machine-readable evidence and supports Ongoing Certification |
| Software and learning | Effivity and Sterling Academy access, itemised at no additional cost |
What moves the price
- The class you target and the path it puts you on
- How much of the boundary is already automated
- Reliance on an already certified hosting platform
What a Sterling proposal always shows
- Deliverables, assumptions and exclusions in writing
- Milestones tied to the readiness plan
- One all-inclusive proposal for our work
Timeline
How long does FedRAMP authorisation take?
The class, how much evidence your platform already produces automatically and the review queues set the pace. As an estimate, readiness takes six to twelve months before the independent assessment, and longer for Class D.
| Phase | What sets the pace |
|---|---|
| Class, path and gap analysis | A clear boundary and access to the engineers who own it |
| Implementation and automation | Engineering capacity and the number of rule gaps |
| Independent assessment | The assessor's availability and the time to fix what it finds |
| FedRAMP review and agency use | The review pipeline for your class and each agency's own ATO process |
Your engagement
What your FedRAMP engagement includes
Sterling OS™ runs every engagement. Sterling does not certify, authorise or assess: FedRAMP grants the certification, a FedRAMP Recognized assessor performs the independent assessment, and each agency issues its own Authority to Operate. Sterling is your advisor, a role kept separate from the assessor's.
Design™: guided support
Your engineers close the gaps and build the evidence; a Sterling consultant sets the method, checks each output against the rules and coaches the team.
Drive™: managed support
The alternative to Design™ for teams short of time: Sterling drafts the package content and evidence plan with your owners and runs the programme to the assessment.
Sustain™: after certification
Ongoing Certification support, change reviews before they become significant, and readiness for rule updates.
Automate™: Effivity
Your risk, policy, incident and audit records run in Effivity, included with the engagement at no additional cost.
Training for your people
Internal auditor training, as applicable to your standard, and preferential Sterling Academy access, including complimentary awareness training for your people as part of the engagement.
Certification decisions remain with FedRAMP, and authorisation decisions with each agency.
Often combined with
Standards organisations pair with FedRAMP
- ADHICS (Abu Dhabi)ADHICS compliance consulting for DoH-regulated healthcare entities in Abu Dhabi: patient information, systems and devices protected, with audit-ready evidence.
- CIS ControlsCIS Controls implementation and requirements: the 18 Controls and 153 Safeguards of v8.1, Implementation Groups, assessment with no certificate, cost and time.
- CMMC 2.0CMMC 2.0 certification consulting for defence contractors handling FCI and CUI: controls, SPRS score and evidence ready for self or C3PAO assessment.
- CSA STARCSA STAR certification consulting for cloud providers: CCM controls and evidence for a STAR Registry entry by self-assessment, certification or attestation.
- Cyber EssentialsCyber Essentials certification consulting: the five technical controls in place for your verified self-assessment, and Cyber Essentials Plus audit-ready.
- DESC ISR (Dubai)DESC ISR compliance consulting for Dubai government entities and suppliers: information security risks and incidents managed, with the evidence to show it.
Effivity · cloud security governance software, included in every engagement
How Effivity helps you fulfil, automate and simplify the requirements of FedRAMP.
Effivity is the ISO and GRC automation platform built by the Sterling group and used in 50+ countries. For a FedRAMP client, your consultant sets up a governance workspace within the agreed scope: policies, the asset and supplier inventory, risks, incidents, change decisions, training records and internal audits, each with an owner and a date. Your technical evidence still comes from your own cloud tooling; Effivity keeps the governance record around it, so the people side of the rules is as traceable as the configuration. Sterling consulting clients get their Effivity subscription included with the engagement, at no additional cost.
Policies and a living asset register
Security policies with owners and review dates, and an inventory of information resources that matches the boundary.
Third parties and their assurance
Suppliers and third-party resources recorded with their role in the boundary and the assurance you hold for each.
Change decisions with their reasoning
Proposed changes assessed, approved and linked to the security decision behind them.
Incidents from report to lessons learned
Security events logged, investigated and closed, with the actions that stopped a repeat.
Training that shows who knows what
Role-based and awareness training records for engineers and support staff, linked to Sterling Academy.
Recovery plans and their tests
Recovery objectives, test schedules and test results kept together, with follow-up actions tracked.
Internal audits and management review
Audit programmes, findings and review decisions dated and linked, alongside the logs your tooling keeps.
Forms and workflows that match your operation
Fields, approvals and reports configured without code, so the record follows your delivery teams rather than the other way round.
What this means at the audit
An assessor looking at a FedRAMP offering will ask who approved a change, which risk it touched and whether the incident it caused was closed. With Effivity, the decision, the risk and the closure are already linked and dated, beside the technical evidence from your pipeline.
In your engagement
- Subscription included with the engagement, at no additional cost
- Configured by your Sterling consultant within the agreed scope
- Your policies, registers and records migrated, not retyped
- Admin and user training for your team
- Modules for QMS, EMS, OHSMS, FSMS and more when you integrate other standards
Sterling Academy · security e-learning
Give engineers, operators and managers the same security habits.
Sterling Academy provides video lessons with practice checkpoints, a final exam and a numbered Certificate of Completion that can be verified online. Sterling consulting clients benefit from preferential Sterling Academy course access and special pricing through their Sterling consultant, including complimentary awareness training for their people as part of the engagement.
- Awareness training so every employee handles federal data the same careful way
- Internal auditor training, as applicable to your standard, as part of the engagement
- Completion records by team, ready for the assessor to sample
- New joiners trained on arrival, so records stay current between reviews
Keep exploring
Explore more about FedRAMP
Why Sterling
Want successful FedRAMP authorisation? Come to Sterling.
Cloud providers rarely hold only one attestation. Sterling builds FedRAMP readiness on the security programme you already run, so one set of controls and one body of evidence serves every customer.
60+ countries since 2003
Information security programmes built for technology firms and service providers, with offices in 21 countries.
All-inclusive proposal
Consulting, Effivity, training and Academy access in one proposal; assessor and engineering costs shown separately.
Evidence built to be regenerated
Readiness planned around automated, machine-readable evidence, the direction the 2026 rules set.
Expert and experienced consultants
Cloud security specialists who learn your architecture before they open the rule book.
The Sterling Promise
What our FedRAMP success guarantee means
We stay with you until your agreed FedRAMP readiness outcome is achieved, through implementation, the independent assessment and the closure of any findings.
The engagement identifies the programme, class, scope, outcome and responsibilities. Your organisation supplies accurate information and puts the agreed controls into use. The FedRAMP Recognized assessor assesses independently, FedRAMP retains its certification decision and each agency its authorisation decision. Our commitment concerns the agreed preparation support, not a promise of every future contract award or flawless operation.
FAQs
Frequently asked questions about FedRAMP
Do we need an agency sponsor for FedRAMP?
Not on the 20x path, which runs as a Program Certification without an agency sponsor. On Rev5 an agency sponsor is generally required, and it is always required for Class D.
Does SOC 2 or ISO 27001 count towards FedRAMP?
They help but do not replace it. FedRAMP suggests most new providers with a SOC 2 Type II start at Class A.
What happened to FedRAMP Low, Moderate and High?
Under the 2026 rules they gave way to Certification Classes A to D. FedRAMP says there is no direct correlation between a class and an impact level, so match the class to your agency customers' use cases.
Is FedRAMP Ready still available?
No. FedRAMP Ready became legacy on 28 July 2026, and no new FedRAMP Ready submissions are accepted after that date.
What is FedRAMP 20x?
FedRAMP 20x is the newer path to FedRAMP Certification, no longer a pilot but widely available. It runs as a Program Certification without an agency sponsor and rests on Key Security Indicators that are validated persistently; Classes A, B and C are open, with Class D planned for 2027.
Keep exploring
More on FedRAMP and related standards
More in Information security, cyber & cloud
Talk to a consultant
Plan your FedRAMP readiness around the class your agencies need.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice