FedRAMP is a standardized program for assessing and authorizing cloud services for federal use. Its purpose is reuse: one rigorous assessment, accepted by many agencies, instead of every agency assessing the same service independently.
Vendors describe their status loosely. The terms have precise meanings and the differences matter.
The statuses, and what each means
FedRAMP Authorized
The service has completed assessment by an accredited third-party assessor and holds an authorization. Its package is available for agencies to review and reuse. This is the status that lets an agency move quickly.
In Process
The service is actively working toward authorization with a sponsoring agency or through the program's process. Genuine progress — and not the same as being authorized. Timelines commonly run twelve to twenty-four months, and not every in-process service completes.
If a vendor says "we are FedRAMP," ask which of these they mean. It is the single most useful clarifying question in the conversation.
Ready
An assessor has confirmed the service is prepared to begin the process. It signals seriousness. It is not authorization.
"FedRAMP equivalent" or "aligned"
These are vendor claims, not program statuses. They typically mean the vendor believes their controls resemble FedRAMP requirements without having gone through assessment. Treat them as marketing until evidence is produced — and understand that accepting such a claim shifts the assessment burden onto you.
Impact levels
Authorization is at a level reflecting the sensitivity of the data: Low, Moderate, or High, with a tailored Low baseline for certain low-risk services. Moderate covers the majority of federal systems.
A service authorized at Low is not authorized for Moderate data. Check the level against your data classification, not just the presence of an authorization.
What buyers should actually verify
- Look it up yourself in the FedRAMP Marketplace rather than accepting a logo on a slide. Status, impact level, and sponsoring agency are all listed.
- Confirm the specific offering. Vendors often have several products and only some are authorized. The authorization names a service boundary — confirm the thing you are buying is inside it.
- Check the boundary itself. Which components, which regions, which features. Functionality outside the boundary is outside the authorization.
- Request the package. As a prospective agency customer you can typically review the security package under appropriate agreements. Your security team will want the control implementation summary and the plan of action.
What it does and does not do for you
Authorization substantially reduces your assessment burden — you inherit a large share of controls and can reuse the package. It does not eliminate your responsibility. You still authorize your own use, document your inherited controls, and manage the parts that are yours: configuration, access control, and the data you put in.
That distinction is where agencies get caught. "It is FedRAMP authorized" is not a complete answer to "is our use of it secure," and an assessor will ask about your configuration regardless.
Why so few services are authorized
Worth understanding, because it explains a lot of vendor behavior. Authorization is a substantial undertaking — commonly a year or more of work and a significant investment in assessment, remediation, and continuous monitoring.
The practical consequences for a buyer:
- Smaller vendors often are not authorized, and the absence is a cost barrier rather than a judgment on their security.
- Some pursue it only with a sponsoring agency, which is why "In Process" can stall — sponsorship is a real dependency.
- Deploying inside an already-authorized environment is frequently the pragmatic route, letting you inherit controls without the vendor holding their own authorization.
For state and local buyers
FedRAMP is a federal program, but many SLED entities reference it as a benchmark, and GovRAMP (formerly StateRAMP) exists specifically for that audience with a similar structure. If your statement of work requirements reference FedRAMP without a federal mandate, be clear about whether you are requiring it or using it as a quality signal — the two lead to very different vendor pools.
This sits inside broader authorization work; see what an ATO involves for the wider process, and our cloud and infrastructure and cybersecurity practices for the delivery side.
Evaluating a cloud service against a compliance requirement? We will check the boundary with you.