What is FedRAMP?

FedRAMP, the Federal Risk and Authorization Management Program, is the U.S. federal government's process for approving cloud services before agencies use them. If an AI vendor wants federal customers to put sensitive data into its product, FedRAMP authorization is usually part of the answer.

How it works

Instead of every agency auditing every vendor, a vendor goes through one standard security assessment. Independent assessors test the service against a published set of controls, covering things like access management, encryption, logging and incident response. When the service is authorized, agencies can reuse that work rather than starting over.

Think of it as a building inspection certificate. Each tenant does not re-inspect the wiring. They check the certificate.

Impact levels

Authorization comes at levels that match how bad a breach would be:

• Low for data where a breach would have limited effect.
• Moderate for data where a breach would have serious effect. This is the level many cloud services target.
• High for the most sensitive unclassified data, where a breach could be severe.

Higher levels mean more controls and a longer, costlier process. FedRAMP has been revising how it runs the program, so check fedramp.gov for the current rules and terminology.

What it means for AI buyers

An AI product's marketing page may say it is secure. FedRAMP is an outside check. When you see a vendor say a product is "pursuing" authorization, that is different from "authorized": the first means the work is in progress, the second means it has passed. Be careful to read which one you are looking at, and at which level.

It does not cover everything. FedRAMP applies to the cloud service and how it is run. It does not decide whether an AI model gives accurate answers, and it does not replace your own review of how data is used. Pair it with questions about zero data retention, logging and who can see your prompts.

Neighboring ideas

Government and regulated buyers often also ask about airgapping for the most sensitive work, and about AI guardrails that limit what a model can do. A vendor's API key handling and access controls are part of what assessors examine.

Common questions

Does FedRAMP apply to private companies? Not by law, but many buyers in regulated industries ask for it as proof of security. Does authorization last forever? No. Authorized services are monitored continuously and must keep meeting the requirements.