Learn About FedRAMP with Training Resources

Types of Resources Available

Learning is a core component of FedRAMP. FedRAMP provides online courses and videos to inform our stakeholders every step of the way. This page captures the various learning opportunities FedRAMP provides to the community.

Online Courses

Deep-dive courses on various elements of the authorization process and what’s required of specific stakeholder groups. These online courses are available to all stakeholders to better understand the FedRAMP Authorization process.

Browse Courses

Videos

Relevant and timely videos about FedRAMP requirements and program updates. Videos can be viewed on our YouTube channel.

Browse Videos

In-Person Trainings and Events

The FedRAMP Program Management Office (PMO) provides hands-on training opportunities on specific topics for all audiences. To receive announcements for in-person trainings, please subscribe for email updates.

Online Courses

These online courses consist of on-demand modules designed for specific stakeholder groups. Each course provides an in-depth focus around a specific step in the FedRAMP Authorization process. Throughout each course, stakeholders will gain a better understanding of roles and responsibilities, security requirements, and best practices.

Cloud Service Providers

These online modules are designed to help Cloud Service Providers (CSPs) understand the requirements of security package development and give a detailed overview of the required templates and their supporting documentation.

200-A: FedRAMP System Security Plan (SSP) Required Documents

This course provides CSPs with a deeper understanding of the detail and rigor required to complete the System Security Plan (SSP). The SSP is the main document of a security package in which a CSP describes all of the security controls in use on the information system and their implementation. This course will familiarize the CSP with the required documentation for initial package submission and give a detailed overview of FedRAMP’s SSP template and its supporting documents.

200-B: Security Assessment Plan (SAP)

This module is designed to help FedRAMP Assessors understand how to write specific sections of the Security Assessment Plan (SAP) documents which contain the test plan to assess the security controls of a system. In addition, this course will cover the program’s reporting requirements for the SAP.

200-C: Security Assessment Report (SAR)

This course is designed to help FedRAMP Assessors understand how to write specific sections of the Security Assessment Report (SAR). The SAR is required by FedRAMP to evaluate the system’s implementation of, and compliance with, the FedRAMP baseline security controls, and thus the system’s compliance with Federal Information Security Modernization Act (FISMA) security mandates.

200-D: Continuous Monitoring Overview

This course provides guidance on continuous monitoring and ongoing authorization in support of maintaining a security authorization that meets the FedRAMP requirements. This course is structured for a CSP going through the JAB path with a Third Party Assessment Organization (3PAO), or a 3PAO, conducting an assessment of the cloud system.

201-B: How to Write a Control

This course gives an overview for a CSP of how to properly write a control that will satisfy the program’s requirements. This course is designed for a CSP pursuing a JAB Authorization with a 3PAO, or a 3PAO conducting an assessment of the cloud system.

Third Party Assessors

Important Note: The 3PAO modules are currently under transition to a new training platform. If you are a new Assessor, please email us at info@fedramp.gov for next steps.

These online modules are required for all Third Party Assessment Organizations (3PAOs) and focus on specific functions, processes, procedures, policies, and/or guidance needed for 3PAOs to successfully complete their assessment of a CSP. At the end of each course, there is a mandatory quiz and a certificate of completion is provided to attendees who complete the course and pass the final quiz.

Updated 3PAO Requirements

This webinar replaces the previous 300-A course.

FedRAMP, in partnership with the American Association for Laboratory Accreditation (A2LA), updated the “R311 - Specific Requirements: FedRAMP,” which includes new and strengthened qualifications for existing and new 3PAOs.

In this recorded webinar on updated 3PAO requirements from November 2018, the Program Management Office (PMO) covered the following key updates:

Incorporation of the R346 – Specific Requirements: Baltimore Cyber Range (BCR) Cybersecurity Technical Proficiency Activity Information, which requires all 3PAO assessors to take a hands-on proficiency exercise, conducted by the Baltimore Cyber Range (BCR), at initial accreditation and annually thereafter
Accreditation to ISO/IEC 17020, under the A2LA Cybersecurity Inspection Body Program, for a period of one year as evidence of implementation of a 3PAO’s quality management system
Forty hours of Continuing Professional Education (CPE) or equivalent for each 3PAO assessment team member
Regular FedRAMP PMO touch-points with 3PAOs and CSPs for feedback on deliverables and customer experience
Guidance for non U.S. based 3PAO personnel and/or OCONUS operations

300-B: 3PAO Security Assessment Plan (SAP) Guidance

This course provides 3PAOs with guidance on FedRAMP requirements for creating a robust SAP. A SAP contains the test plan to assess the security controls of a system and functions as a detailed roadmap of the approach and methodology for the assessment of a CSP’s cloud service offering.