Regulation & Policy
FedRAMP
Also known as: Federal Risk and Authorization Management Program, FedRAMP authorisation, FedRAMP High
FedRAMP, the Federal Risk and Authorization Management Program, is the US government programme that standardises how cloud services are security assessed, authorised and monitored for use by federal agencies. It is built on NIST security controls and issues authorisations at Low, Moderate and High impact levels. Authorised services are listed on the public FedRAMP Marketplace, which agencies use when choosing cloud tools.
What it is
FedRAMP provides a single, reusable security assessment process so that one agency's authorisation of a cloud service can be reused by others rather than repeated from scratch. Services are assessed by accredited third party assessment organisations against control baselines derived from NIST SP 800-53, then authorised at an impact level that reflects the sensitivity of the data involved. Authorisation is not a one off event, because providers must maintain continuous monitoring and reporting to keep it.
Why it matters
For anything sold into US federal agencies, FedRAMP status is often the first filter applied, so it shapes which AI tools and SaaS products agencies can even consider. That makes it a high intent research topic: procurement teams, security reviewers and assistants all look for a clear statement of authorisation status, impact level and sponsoring agency. Vague or missing compliance pages cause buyers and AI assistants alike to assume the answer is no.
How it works
Providers prepare a system security plan, work with an assessor, secure an agency sponsor or pursue the available authorisation path, then remediate findings and submit for review. Once authorised, the service appears on the FedRAMP Marketplace with its impact level, and the provider maintains monthly continuous monitoring deliverables. Many vendors reach federal customers faster by running inside an already authorised environment or partner platform rather than pursuing their own authorisation first.
When it applies
It applies whenever a cloud service processes US federal agency data, and by extension when you are marketing to agencies, defence customers or their contractors. It is also relevant to content strategy any time compliance status is a gating question in the buying process.
Examples
- A vendor publishes a page stating its FedRAMP Moderate authorisation, sponsoring agency and Marketplace listing link, so reviewers can verify it in seconds.
- An agency rules out an AI writing tool during shortlisting because it has no FedRAMP authorisation and holds no path to one.
- A startup launches inside a partner's authorised environment to serve federal pilots while its own authorisation work is in progress.
How it is measured
- Presence and accuracy of your authorisation status in AI assistant answers to questions such as is this product FedRAMP authorised
- Visits and conversions on your compliance and trust pages from government and contractor sources
- Number of security questionnaires completed per quarter and time to complete each one
- Opportunities disqualified at shortlisting for compliance reasons, tracked over time
Insights on FedRAMP
Related terms in Regulation & Policy
- AI complianceAI compliance is the work of making sure AI systems meet the laws, regulations, standards and internal policies that apply to them. It spans data protection, transparency, risk classification, documentation, human oversight and record keeping across the life of a system. In practice it combines legal interpretation, engineering controls and ongoing evidence gathering.
- AI governanceAI governance is the set of policies, roles, controls and review processes an organisation uses to manage how AI systems are built, bought and used. It covers risk assessment, documentation, human oversight, data handling and accountability. It applies both to AI a company develops and to third-party AI tools used by staff.
- AI privacyAI privacy is the set of practices, rights and obligations that govern how personal data is collected, used, stored and exposed when building or using AI systems. It covers training data, prompts and outputs, retention by AI vendors, and the transparency and control offered to the people whose data is involved. For marketing teams it shapes what customer data can safely be put into AI tools and what must be disclosed.
- AI safetyAI safety is the practice of designing, testing and operating AI systems so they cause less harm, behave predictably and resist misuse. It covers alignment with intended behaviour, evaluation and red teaming, content guardrails, and monitoring once a system is live. For marketers it shapes what models will say, how assistants handle brands, and what compliance teams expect before AI tools go into production.
- AI transparencyAI transparency is the practice of making clear how an AI system works, what sits behind it, and when content or an interaction involves AI. It covers regulatory disclosure duties as well as voluntary explanations such as model cards, labels on synthetic media and citations in AI generated answers. For publishers and marketers it sets expectations about when AI involvement should be declared and how clearly.
- Competition and Markets AuthorityThe Competition and Markets Authority (CMA) is the United Kingdom's competition and consumer protection regulator. It investigates mergers, anti-competitive conduct and market practices, and it holds specific powers over large digital firms under the Digital Markets, Competition and Consumers Act 2024. Its decisions shape how search engines, app stores and AI assistants operate in the UK market.
Primary research · August 2026
How ChatGPT Shortlists Software Brands
An audit across 10 categories and 60 buying questions. I recorded what ChatGPT reads, throws away and links to when a buyer asks it which software to buy, and what that decides.
- 60
- Questions asked
- 10
- Software markets
- 2,680
- Results read
- 367
- Links shown
Free download
Get the full report
35 pages · PDF · 536 KB. Enter your details and it downloads straight away.