Government contractor teams use FedRAMP controls by routing federal data through FedRAMP-certified cloud platforms and aligning their own systems with the NIST SP 800-53 baselines those platforms were assessed against. The practice has four parts: select certified infrastructure, inherit the controls the provider already operates, map the remaining controls to NIST SP 800-171 and CMMC, and keep monitoring running between assessments.

The inherited controls are the cheap part. Physical security, encryption at the infrastructure layer, and core hardening come with the platform, already tested by an independent assessor. The controls that stay with you are where teams get caught, because a certified platform arrives unconfigured and nothing about the certification covers how your people use it.

Below we cover what FedRAMP controls are, who has to work with them, which control families a contractor team touches most, how inheritance actually divides responsibility, how FedRAMP relates to the other frameworks you run, how to verify a platform on the Marketplace, how to recognize a claim that will not hold up, and what the ongoing practice looks like.

How Do Teams Use FedRAMP Controls?

Teams use FedRAMP controls in four ways: selecting cloud platforms that already hold certification, inheriting the controls those platforms operate, mapping the controls that remain to the frameworks their contracts name, and maintaining continuous monitoring rather than treating security as a one-time audit. Each step depends on the one before it.

Selection comes first because it determines how much work the other three require. A platform certified at the class your contract needs arrives with hundreds of controls already implemented and independently tested. A platform without certification leaves every one of those controls for you to implement, document, and defend, which is rarely worth the effort when certified alternatives exist.

Mapping is where contractor teams spend the most time. FedRAMP governs the cloud platform, NIST SP 800-171 governs your own systems with its 110 requirements across 14 families, and CMMC verifies that you implemented them. One environment, three vocabularies, and a single set of underlying safeguards doing the work. Running them as one effort rather than three is what a well-built compliance program is for.

What Are FedRAMP Controls and What Are They Required to Follow?

FedRAMP controls are the security requirements a cloud service must implement to hold certification, and they follow NIST Special Publication 800-53. FedRAMP selects a subset of that catalog for each baseline and adds cloud-specific parameters that NIST leaves open, such as scan frequencies, boundary definitions, and the evidence an assessor must collect.

Which subset applies is set by sensitivity rather than by preference. Federal Information Processing Standard 199 categorizes a system by how much damage a loss of confidentiality, integrity, or availability would cause, and that category selects the baseline. Contract language naming Controlled Unclassified Information points at the middle baseline as the floor.

How Many FedRAMP Controls Are There?

There are 156 FedRAMP controls at the Low baseline, 323 at Moderate, and 410 at High, all drawn from the same 17 control families. Depth separates the baselines rather than breadth, so a higher baseline means more requirements inside the same families rather than new categories of security. Older sources still circulate counts of 125, 325, and 421, which came from the earlier Revision 4 baselines and no longer match what an assessment tests.

Terminology shifted in 2026 as well. The Consolidated Rules for 2026 replaced the Low, Moderate, and High labels with Certification Classes, where Class B covers the former Low, Class C the former Moderate, and Class D the former High, with a new Class A entry tier. Existing certifications carried forward at the matching class with the same control sets.

Does FedRAMP Use NIST?

Yes, FedRAMP uses NIST. The control catalog comes from NIST SP 800-53, the sensitivity categories come from FIPS 199, and the overall approach follows the NIST Risk Management Framework. FedRAMP is the program that applies those standards to cloud services and issues a decision; NIST supplies the standards themselves and issues nothing.

Who Needs to Comply With FedRAMP?

FedRAMP applies to cloud service providers that store, process, or transmit federal data, and reaches contractors through their contracts rather than directly. Your company does not earn a FedRAMP certification. Your contract requires that the platforms holding federal data have one, and the duty to select and verify those platforms is yours.

Scope has published limits. Federal policy names categories outside FedRAMP, including search engines, social media platforms used under agency policy, single-agency systems not offered as shared services, and low-risk ancillary services. Everything else holding federal data in the cloud falls inside, which covers most of the tools a project team uses without thinking about it.

Is FedRAMP Required for Government Contractors?

FedRAMP is required for government contractors indirectly, and the requirement arrives through contract clauses. For defense work, DFARS 252.204-7012 requires a contractor using an external cloud service provider for covered defense information to require that the provider meets security requirements equivalent to the FedRAMP Moderate baseline, now Class C.

Flow-down carries the obligation down the supply chain. A subcontractor receiving Controlled Unclassified Information from a prime inherits the same cloud requirement the prime holds, regardless of tier or company size. That pattern is how most government contractors discover the requirement, usually when a prime asks a question mid-project.

Why Do Companies Need FedRAMP?

Companies need FedRAMP because federal agencies are prohibited from putting federal data on uncertified cloud services, which makes certification the entry condition for selling cloud products to the government. For contractors buying rather than selling, certification is what makes a platform usable for federal work at all.

Reuse is the second reason, and it explains the program's design. One certification serves every agency, so a provider assessed once can be adopted repeatedly without a fresh review each time. FedRAMP Marketplace data shows fiscal year 2025 produced 350 reuse authorizations against 131 new ones, meaning reuse carried nearly three times the volume of new work.

What Are FedRAMP Control Families?

FedRAMP control families are the 17 groupings that organize the baseline, covering areas such as access control, audit and accountability, configuration management, contingency planning, identification and authentication, incident response, risk assessment, and system and communications protection. Four of them account for most of what a contractor team actually operates.

The table below reflects the FedRAMP Rev5 baselines and the NIST SP 800-53 Revision 5 catalog they draw from, with ownership shown as it typically falls when a certified platform is in use.

Control FamilyWhat It RequiresWho Typically Owns ItAudit and Accountability (AU)Logging user activity and system events, protecting logs from alteration, and reviewing them regularlyShared: the platform logs, you review and retainConfiguration Management (CM)Baseline configurations, controlled changes, and monitoring for unauthorized driftShared: the platform hardens itself, you configure your tenantIncident Response (IR)Documented plans, assigned roles, tested procedures, and reporting within required windowsShared: the provider reports to you, you report onwardSecurity Assessment and Authorization (CA)Periodic evaluation by an independent assessor and current security documentationProvider for the platform, you for your own systemsAccess Control (AC)Least-privilege access, separation of duties, and removal of access when roles changeYours, almost entirelyIdentification and Authentication (IA)Multifactor authentication and managed credentials for every accountYours, using capabilities the platform supplies

Audit and Accountability

Audit and accountability controls require that user activity and system events are logged, that logs resist tampering, and that someone reviews them on a defined schedule. A certified platform generates the logs. Reviewing them is a separate activity that the certification does not perform for you.

Three properties decide whether a logging setup survives an assessment. Coverage means every component inside the boundary writes logs, including identity systems and administrative actions. Integrity means logs are centralized where the people being logged cannot alter them. Review means something examines them continuously rather than on request, which is where network monitoring and compliance stop being separate projects.

Configuration Management

Configuration management controls require documented baseline configurations, controlled change processes, and monitoring for unauthorized changes. The provider hardens the platform itself. Your tenant settings, integrations, and endpoints remain entirely yours.

Certified platforms commonly ship with permissive defaults, which surprises teams who assume certification means secure out of the box. It means the platform can be operated securely, not that it arrives that way. The same discipline applies to the systems around it, where routine patch management is the difference between a documented baseline and a drifting one.

Incident Response

Incident response controls require documented procedures, defined roles, tested processes, and reporting inside specified windows. Defense contractors carry a hard deadline on top: DFARS 252.204-7012 requires cyber incident reporting within 72 hours of discovery.

Shared ownership creates the gap here. Your provider reports incidents affecting the platform to you, and you report incidents affecting your contract to the government. A plan that covers one direction and not the other fails at the worst possible moment, which is why a tested incident response plan has to name who receives a provider notification and what happens in the next hour.

Security Assessment and Authorization

Security assessment and authorization controls require periodic independent evaluation and current security documentation. For the platform, that is the provider's assessor and the provider's documentation. For your own systems, it is whatever your contract specifies, which for defense work typically means a self-assessment scored in the Supplier Performance Risk System.

Documentation changed shape in 2026. The Consolidated Rules for 2026 replaced the System Security Plan with a Security Decision Record, a maintained record of the security decisions a provider makes across the life of the offering rather than a document written once and refreshed annually. Asking a vendor for that record is now a reasonable request during vendor review, and the same expectation applies when you prepare for a compliance audit of your own environment.

What Is Control Inheritance and How Do Teams Use It?

Control inheritance is the practice of relying on a certified cloud provider's already-assessed controls instead of implementing and proving those controls yourself. Physical security of the data center, hardening of the underlying infrastructure, and encryption at the platform layer are inherited. You identify them, document that you inherit them, and move on.

Inheritance is not the same as delegation. An assessor checks that you identified correctly, which means an inherited control still appears in your documentation with the provider named. Claiming inheritance for something the provider does not actually cover is the most common finding in this area, and it is entirely avoidable.

What Is a Customer Responsibility Matrix?

A customer responsibility matrix is the document a certified provider publishes showing which controls it operates, which are shared, and which belong entirely to the customer. It is the authoritative answer to the ownership question and the first artifact to request from any provider holding federal data.

Shared controls deserve the most attention. A provider may supply multifactor authentication capability while leaving enforcement to you, or generate audit logs while leaving retention and review to you. On paper the control is covered; in practice half of it is unimplemented until somebody acts. Reading the matrix line by line is a short exercise that prevents a long one.

Which Controls Stay Yours?

Certain controls stay with you no matter which platform you select, because they describe how your organization behaves rather than how the platform is built:

• User access and offboarding. Who has an account, what they can reach, and how fast access ends when someone leaves.
• Device security. The laptops and phones reaching the platform, including encryption, updates, and what happens when one goes missing.
• Tenant configuration. The settings the platform exposes and ships permissively, including sharing defaults and external access.
• Workforce training. Whether people know what federal data is and where it is allowed to go.
• Your side of incident reporting. Receiving a provider notification is not the same as meeting your own reporting obligation.
• The boundary itself. Knowing every place federal data lives, and keeping it out of everywhere else.

The last one causes the most damage and gets the least attention. A team that downloads a document from a certified platform and uploads it into an unlisted tool to finish a task has moved federal data outside the boundary the certification established, and no amount of provider certification covers that movement. Boundary discipline is a people-and-process problem that no SaaS platforms decision can solve on its own.

How Does FedRAMP Help With CMMC Compliance?

FedRAMP helps with CMMC compliance by supplying assessor-ready evidence for the cloud portion of your environment. When an assessment maps everywhere Controlled Unclassified Information is created, stored, processed, or transmitted, any platform inside that boundary has to demonstrate it meets the applicable security requirements, and a certified platform demonstrates it directly.

Uncertified platforms reverse the burden. You then have to prove the platform is adequately secure through your own documentation and testing, which is expensive enough that most contractors choose a certified alternative instead. Clean separation between what the platform proves and what you prove is the foundation of defensible DFARS compliance for any company holding federal data in the cloud.

How FedRAMP Compares to the Other Frameworks Teams Run

Most contractor teams run several frameworks against the same systems, so the boundaries between them have to be clear before anyone evaluates a vendor. FedRAMP certifies cloud platforms, NIST SP 800-53 supplies the control catalog, FIPS 199 sets sensitivity categories, NIST SP 800-171 governs your own systems, and SOC 2 reports on a provider's commitments to its commercial customers.

What Are the Key Differences Between NIST 800-53 and FedRAMP?

The key differences between NIST 800-53 and FedRAMP are scope and authority. NIST SP 800-53 is a control catalog for federal information systems with no assessment or decision attached to it. FedRAMP selects controls from that catalog, requires independent assessment, and issues a government decision on a specific cloud service offering.

A platform can align with 800-53 and hold no FedRAMP standing at all, which is why alignment claims deserve a follow-up question. The same separation applies to your internal systems, where NIST compliance work runs under 800-171 rather than 800-53.

What Are the Key Differences Between FIPS and FedRAMP?

The key differences between FIPS and FedRAMP are function and sequence. FIPS 199 categorizes how sensitive a system's data is, and FedRAMP certifies whether a cloud service is secure enough for that category. FIPS answers how bad a breach would be; FedRAMP answers whether the platform is good enough.

A second FIPS standard appears inside the controls. FIPS 140 validation governs cryptographic modules, and FedRAMP baselines require validated cryptography for data in transit and at rest. One FIPS standard sizes the problem and the other certifies part of the solution.

What Are the Key Differences Between SOC 2 Compliance and FedRAMP?

The key differences between SOC 2 compliance and FedRAMP are who sets the bar and who accepts the result. SOC 2 is a voluntary attestation against criteria a provider selects, reported by an accounting firm to that provider's customers. FedRAMP is a government program with a fixed baseline, an assessor the government recognizes, and a certification the government grants.

Overlap is real and useful. Providers reuse SOC 2 and ISO 27001 work when pursuing certification, and the 20x model was designed to align with commercial frameworks for that reason. For a buyer, though, the distinction is absolute: a provider holding SOC 2 but no FedRAMP certification has demonstrated security maturity and nothing about federal eligibility.

What Is the FedRAMP Marketplace and How Do Teams Use It?

The FedRAMP Marketplace is the official public directory of cloud service offerings assessed against FedRAMP requirements, along with the recognized assessors and the agencies that have issued authorizations. It is operated by the General Services Administration and it is the authoritative place to confirm a provider's status, class, and certification date.

Teams use it as a procurement gate rather than a reference library. Before federal data moves into a platform, somebody checks the listing and records what they found. The Marketplace listed 537 certified cloud service offerings as of October 5, 2026, up from roughly 350 across the program's first decade, so the odds of finding a certified tool that fits the work are considerably better than they were.

How Do Teams Use the FedRAMP Marketplace?

Teams use the FedRAMP Marketplace by checking five specific details before a platform touches federal data, rather than by trusting a vendor badge. Work through them in order:

1. Search for the exact cloud service offering by name, since certification attaches to one offering and most vendors certify a government edition rather than the commercial product.
2. Confirm the listing shows a live certification rather than an in-process or implementation listing, neither of which satisfies a contract requirement.
3. Match the Certification Class against what your contract requires, because a Class B listing does not cover a Class C obligation.
4. Verify that the specific modules and features you plan to use sit inside the certified boundary, since partial-product certifications are common.
5. Capture the evidence, including the listing, the certification date, and written vendor confirmation that your tenant runs in the certified environment.

Re-checking matters as much as checking. A provider's standing can change through remediation or expiry, and nothing notifies you when it does, so the verification belongs on a schedule alongside the rest of your vendor risk assessment work.

How Do I Get on the FedRAMP Marketplace?

You get on the FedRAMP Marketplace by entering one of FedRAMP's defined lifecycle stages and having the program confirm your status. That path changed substantially in 2026 and is now considerably more open than it was.

Three changes matter to a provider planning entry. Since July 6, 2026, offerings in the Initial Implementation Phase can be listed before holding any certification, turning the pre-certification period into market visibility. The FedRAMP Ready designation retired on July 28, 2026, with existing listings renamed Legacy FedRAMP Ready and beginning to expire around November 17, 2026. And a Program Certification path now allows submission directly to FedRAMP without a pre-committed agency sponsor at the lower classes, which removed the barrier that had kept capable smaller providers out of the federal market entirely.

What Does FedRAMP In Process Mean?

FedRAMP In Process means a cloud service offering is actively working toward certification and has not achieved it. It signals genuine commitment and satisfies no contract requirement. The same is true of an Initial Implementation listing, which shows a provider early in implementation.

For a buyer, that distinction decides whether a platform is usable today. In Process is a reason to keep a vendor on a watch list, not a reason to put federal data in their system. In July 2026 the Marketplace held 585 offerings, of which 451 were Authorized, 69 In Process, and 65 Ready, so roughly a quarter of listings at that point were not usable for federal data.

FedRAMP Authorized Versus FedRAMP Compliant

FedRAMP Authorized, now FedRAMP Certified, is a verifiable status granted after independent assessment and recorded on the Marketplace, while FedRAMP compliant is informal marketing language with no federal standing. Only the first survives a contract review.

The phrases to watch are predictable once you know them: FedRAMP compliant, FedRAMP aligned, FedRAMP ready in the generic sense, built on FedRAMP-authorized infrastructure, and meets FedRAMP standards. None is necessarily dishonest. A platform built on certified infrastructure genuinely inherits something. But inheritance at the infrastructure layer says nothing about the application running on top of it, and that application is what holds your data.

One phrase sits between the two and deserves care. FedRAMP Moderate equivalency is a real standard with a defined evidence package behind it, requiring full compliance with the baseline assessed by a recognized assessor, with the documentation delivered to you. Equivalency is legitimate and it shifts the validation burden onto your team, since there is no public listing to point at.

Can a Vendor Say It Is FedRAMP Compliant?

A vendor can say it is FedRAMP compliant, because the phrase is unregulated marketing language rather than a protected designation. What a vendor cannot do is produce a Marketplace listing for a claim that has no certification behind it, which is exactly why the listing is the thing to ask for.

One follow-up question resolves most ambiguity: which cloud service offering holds the certification, at what class, and on what date. A vendor with real standing answers in a sentence and points at the listing. A vendor without it changes the subject to its security program, which is a different and lesser claim.

How to Comply With FedRAMP

For a contractor, complying with FedRAMP means inventorying every cloud service that touches federal data, verifying each one's certification and class against the contract, documenting what you inherit and what stays yours, and re-checking on a schedule. Certification is the provider's job. Proof is yours, and it is the part that gets examined.

Huntsville's concentration of primes and Tennessee Valley subcontractors means most companies here hold several contracts with different clauses and staggered option dates. That turns one verification question into a recurring calendar item rather than a project with an end.

Building that cadence is the practical work. A schedule that names who checks which platforms, how often, and where the evidence lands is worth more than any single audit, and it is what ongoing compliance support exists to carry.

What Are the Steps Involved in the FedRAMP Process?

The steps in the FedRAMP process, for a provider pursuing certification, run from categorizing the system and implementing the baseline controls, through independent assessment, remediation of findings, a certification decision, and continuous monitoring afterward. Under the modernized path, much of the evidence is reported by the system itself rather than written up by hand.

For a contractor the process looks different and shorter. You scope the boundary, select certified platforms, record what you inherit from each, implement the controls that remain yours, and keep the documentation current. Nothing in that sequence requires an assessor to visit you on FedRAMP's behalf, though a CMMC assessment will examine the result.

How Long Does the FedRAMP Process Take?

The FedRAMP process historically took 12 to 18 months or longer for a provider, and it is now considerably faster. The General Services Administration reported 114 authorizations in fiscal year 2025, more than double the prior year, with average agency review time falling to roughly five weeks, and pilot participants under the modernized path reached certification in weeks to a few months.

For a contractor verifying platforms rather than certifying one, the timeline is measured in hours. The expensive version happens when verification is skipped at the start and discovered during an assessment, at which point the cost is a platform migration rather than an afternoon on the Marketplace.

What Are the Continuous Monitoring Requirements?

Continuous monitoring requires ongoing vulnerability scanning, regular review of audit logs, management of configuration changes, and incident reporting, performed continuously rather than assembled before an assessment. Providers carry their own monitoring obligations to keep certification; contractors carry monitoring obligations across everything outside the provider's boundary.

This is where a reactive technology model breaks down. Break-fix support arrives after something has already gone wrong, and compliance evidence has to exist before anyone asks for it. Logs reviewed only when requested, configurations checked only at audit time, and access lists cleaned up only during remediation all produce the same result: a team that is probably secure and cannot prove it. We built our all-inclusive, preemptive managed cybersecurity model around that gap, with monitoring, documentation, and evidence maintained continuously as part of the service.

Frequently Asked Questions

Which Companies Are Approved by FedRAMP?

Companies are not approved by FedRAMP; specific cloud service offerings are. A vendor appearing on the Marketplace does not mean every product it sells is certified, since certification attaches to one named offering, usually a government edition of a commercial product. The Marketplace lists every certified offering and is the only reliable place to check.

What Is a FedRAMP Boundary?

A FedRAMP boundary is the defined set of components, services, and connections that a certification covers. Anything inside it was assessed; anything outside it was not. For contractor teams the practical version is your own data boundary: every place federal data is created, stored, processed, or transmitted, which is what an assessor maps first.

Can You Use a Non-FedRAMP Tool for Federal Data?

No, you cannot use a non-FedRAMP tool for federal data when your contract requires the baseline. The alternatives are narrow: select a certified service, accept documented equivalency and validate it yourself, isolate federal data in a separate compliant environment, or host the system internally and carry the full control burden under NIST SP 800-171 instead.

What Is FedRAMP Moderate Equivalency?

FedRAMP Moderate equivalency means a cloud service offering achieved full compliance with the FedRAMP Moderate baseline through an assessment by a FedRAMP-recognized assessment organization, with the documentation delivered to the contractor. There is no public listing behind it, so you collect and validate the evidence yourself and retain it for your own audit.

How Often Does FedRAMP Require Vulnerability Scanning?

FedRAMP requires monthly vulnerability scanning of operating systems, databases, and web applications inside the authorization boundary, with results reported to the authorizing agency and findings tracked through remediation. Annual assessment sits on top of the monthly cycle, and significant system changes trigger review outside the normal schedule.

What Is a System Security Plan, and What Replaced It?

A System Security Plan is the document describing a system's architecture and how each security control is implemented, historically the central artifact in a FedRAMP package and commonly running past 300 pages. The Consolidated Rules for 2026 replaced it with the Security Decision Record, a maintained record of security decisions across the life of the offering rather than a document refreshed once a year.

The Bottom Line

Contractor teams use FedRAMP controls by letting certified platforms carry the controls they were assessed against and taking clear ownership of everything else. Selection determines how much work remains, the customer responsibility matrix determines who owns what, and the Marketplace determines whether the provider's claim is real. The four families most teams touch daily are audit and accountability, configuration management, incident response, and security assessment, and in every one of them the platform does part of the job and you do the rest.

The failures we see are rarely technical. A certified platform configured permissively, a shared control nobody picked up, a tool added for one task that quietly moved data outside the boundary, or a logging setup nobody reviews until an assessor asks. Those are process problems, and they look the same whether the framework is FedRAMP, CMMC, HIPAA, or PCI, which is why the government contractors, manufacturers, healthcare organizations, and financial firms we work with around Huntsville and North Alabama solve them once rather than once per regulation.

If you want help mapping which platforms sit inside your federal data boundary and which controls are genuinely covered, the team at Interweave Technologies is glad to work through it with you. Give us a call at 256.837.2300.

‍