How FedRAMP works in practice
FedRAMP follows a structured, repeatable process designed to evaluate both technical controls and operational maturity.
Security requirements are based on NIST SP 800-53 controls and are grouped into low, moderate, and high impact levels, depending on the sensitivity of the data involved.
To enter the program, cloud service providers must be sponsored by a federal agency and complete an independent security assessment conducted by an accredited Third-Party Assessment Organization, or 3PAO. These assessments validate that required controls are in place and working as intended.
Authorization isn’t the end of the journey. Continuous monitoring ensures that security remains effective over time, even as systems evolve, users change, and threat landscapes shift.
What “FedRAMP in Process” means for agencies
A FedRAMP “In Process” designation means a cloud service provider has formally entered the authorization journey and is actively progressing through required assessments and agency reviews.
Solutions with this status are listed in the FedRAMP Marketplace, the official public registry of cloud services approved or under evaluation for federal use.
For agencies, this designation provides early visibility into solutions that are aligning with federal security requirements and preparing for broader adoption. It also signals that a provider has made a meaningful investment in meeting federal-grade security and compliance standards.