U.S. flag

An official website of the United States government

Rev5 Agency Authorization

Pursuing a FedRAMP® Agency Authorization

In the Agency Authorization path, agencies work directly with a Cloud Service Provider (CSP) for authorization. CSPs that make a business decision to work directly with an agency to pursue an Authority to Operate (ATO) will work with the agency throughout the FedRAMP Authorization process.

FedRAMP Stakeholders

FedRAMP’s stakeholders include both industry and federal agencies, and both play an important role in modernizing service delivery for the public.

Federal Agencies

  • Partner with cloud service providers to achieve FedRAMP Authorization
  • Use 3PAO assessments as the basis for making informed, risk-based authorization decisions for the use of cloud products and services
  • Provide ATOs to FedRAMP
  • Leverage the FedRAMP Marketplace to research cloud offerings that are FedRAMP Authorized or are In Process
  • Reuse security packages from existing FedRAMP Authorized cloud providers to inform an ATO decision
  • Integrate the FedRAMP requirements into agency specific policies and procedures and partner with FedRAMP to modernize
  • Resources

    The resources below provide additional guidance on the Agency Authorization path. Additional technical guidance as well as FedRAMP templates are located on our Documents & Templates page under resources.

    • Agency Authorization Playbook

      A compilation of best practices, tips, and step-by-step guidance for Agencies seeking to implement ATOs.

    • Package Access Request Form

      Form that must be completed to gain access to a FedRAMP security assessment package.

    • Reusing Authorizations for Cloud Products Quick Guide

      This quick guide outlines steps and guidance to help agencies quickly and efficiently reuse authorized cloud products within the FedRAMP Marketplace.

    • ATO Letter Template

      The FedRAMP ATO Template is optional for Agencies to use when granting authorizations for CSOs that meet the FedRAMP requirements.