Securing Cloud Services

The first step of the process is for a Cloud Service Provider (CSP) to find a federal agency to partner with. Once an agency is identified and has agreed to partnership the CSP and agency begin working together towards an authorization starting with a full security assessment and finishing with an authorization process. Once the authorization process is complete, a CSP must engage in continuous monitoring to ensure that the risk accepted at the time of authorization remains acceptable. An agency ATO signifies the agency partner reviewed the security package and deemed the risk acceptable for their use. Upon completion of the agency ATO, the package is then reviewed by FedRAMP and when deemed acceptable for government-wide reuse it is granted FedRAMP Authorization on the marketplace.