Get audit-ready for FedRAMP
FedRAMP · Federal Risk and Authorization Management Program
US government program providing a standardized approach to security assessment, authorization, and continuous monitoring for cloud products and services used by federal agencies.
FedRAMPWhat is FedRAMP?
US government program providing a standardized approach to security assessment, authorization, and continuous monitoring for cloud products and services used by federal agencies.
Who it applies to
Cloud service providers selling to US federal agencies. Effectively a market-access requirement: without an authorisation, a federal agency cannot use the service.
How the standard is organised
Control baselines drawn from NIST SP 800-53, selected by impact level, with the evidence package assessed by an accredited third-party assessment organisation (a 3PAO).
Framework names, marks and abbreviations (ISO, SOC 2, PCI DSS, TISAX, HIPAA, GDPR and others) are trademarks of their respective standards bodies and are used here only to describe what the Bitkosh Readiness Platform helps you track and prepare for. The badges shown are original Bitkosh artwork, not the official marks. Bitkosh Technologies is not affiliated with, sponsored by, or endorsed by ISO, AICPA, the PCI Security Standards Council, ENX/VDA, or any other framework owner, and using this platform does not by itself confer or guarantee certification — certification/attestation is granted only by the relevant accredited third-party body.
FedRAMP on the Bitkosh platform
The 410 FedRAMP controls sit in one workspace with gap assessment, evidence collection and your readiness score, and shared controls count towards the equivalent requirement in the other 47 ready frameworks at the same time — so a second framework costs a fraction of the first.
How the platform worksSample controls
Six controls from the platform's control library, chosen because they are the most specific to this framework.
- SC-21Secure Name/Address Resolution Service (Recursive or Caching Resolver)
Low baseline: Request and perform data origin authentication and data integrity verification on the name/address resolution responses the system receives from authoritative sources.
System and Communications Protection - SC-7(8)Route Traffic to Authenticated Proxy Servers
Moderate baseline: Route [internal communications traffic] to [external networks] through authenticated proxy servers at managed interfaces.
System and Communications Protection - IA-5(7)No Embedded Unencrypted Static Authenticators
Moderate baseline: Ensure that unencrypted static authenticators are not embedded in applications or other forms of static storage.
Identification and Authentication - PE-11(1)Alternate Power Supply — Minimal Operational Capability
High baseline: Provide an alternate power supply for the system that is activated [one of.
Physical and Environmental Protection - SI-4(18)Analyze Traffic and Covert Exfiltration
Moderate baseline: Analyze outbound communications traffic at external interfaces to the system and at the following interior points to detect covert exfiltration of information: [interior points].
System and Information Integrity - IA-5(13)Expiration of Cached Authenticators
High baseline: Prohibit the use of cached authenticators after [time period].
Identification and Authentication
More information security & cybersecurity frameworks
Frequently Asked Questions
Who publishes FedRAMP, and who does it apply to?
How is FedRAMP conformance demonstrated?
How is FedRAMP structured?
Ready to get audit-ready for FedRAMP?
See how the Bitkosh Readiness Platform gets you audit-ready for FedRAMP — and the other 47 ready frameworks — from a single control library.