FedRAMP
The Federal Risk and Authorization Management Program, a U.S. federal government cloud service security authorization program established in 2011. Based on the NIST SP 800-53 framework, it requires cloud service providers to be audited by third-party assessment organizations before providing services to federal agencies.
Core Facts
Timeline (last 90 days)
Claude for Government is generally available starting September 30 and has received FedRAMP authorization. Anthropic estimates the discount could save the government $1 billion, and about 500 U.S. federal, state and local agencies currently use Claude.
For Claude to cover federal agencies, its underlying cloud environment will very likely need to obtain or inherit an existing FedRAMP authorization, which is also a common implicit threshold in government AI procurement.
Governments generally require vendors to pass specific security certifications (such as FedRAMP in the United States and the Multi-Level Protection Scheme evaluation in China) and to meet requirements on data localization, audit logs and access control.
U.S. federal government procurement of cloud services requires FedRAMP authorization; the framework was launched in 2011, and the authorization process typically takes 12 to 18 months.
Without FedRAMP authorization, U.S. federal agencies generally cannot procure cloud services; state and local governments often refer to similar frameworks such as StateRAMP.
For AI coding tools, data residency and isolation of model training data are key points of FedRAMP review.
FedRAMP authorization is divided into three impact levels—low, moderate and high—based on the NIST SP 800-53 series of security control requirements.
When an AI product is marked by DHS as prohibited for use, the GSA procurement catalog, FedRAMP authorization reviews and state IT policies may successively follow suit, forming a de facto compliance chain reaction.
Department of Defense cloud security requirements (such as the FedRAMP authorization process) set higher standards for supply chain transparency of cloud service providers.
The U.S. federal government's acquisition of AI tools typically must go through reviews such as FedRAMP authorization, FISMA security requirements and the NIST AI Risk Management Framework.
6 more timeline events
All Facts (19)
The rise of sovereign AI demand is closely related to localization legislation such as the EU's GDPR, China's Data Security Law, and India's Personal Data Protection Bill.
75%Unverified美国军方的软件采购通常需要经过FedRAMP、CMMC以及DISA STIGs等安全认证体系
90%UnverifiedFedRAMP certification is a prerequisite for entering the U.S. federal government market, and the review cycle often takes 12 to 18 months
70%UnverifiedClaude for Government is generally available starting September 30 and has received FedRAMP authorization. Anthropic estimates the discount could save the government $1 billion, and about 500 U.S. federal, state and local agencies currently use Claude.
50%UnverifiedFor Claude to cover federal agencies, its underlying cloud environment will very likely need to obtain or inherit an existing FedRAMP authorization, which is also a common implicit threshold in government AI procurement.
50%UnverifiedGovernments generally require vendors to pass specific security certifications (such as FedRAMP in the United States and the Multi-Level Protection Scheme evaluation in China) and to meet requirements on data localization, audit logs and access control.
50%UnverifiedWithout FedRAMP authorization, U.S. federal agencies generally cannot procure cloud services; state and local governments often refer to similar frameworks such as StateRAMP.
50%UnverifiedU.S. federal government procurement of cloud services requires FedRAMP authorization; the framework was launched in 2011, and the authorization process typically takes 12 to 18 months.
50%UnverifiedFedRAMP authorization is divided into three impact levels—low, moderate and high—based on the NIST SP 800-53 series of security control requirements.
50%UnverifiedFor AI coding tools, data residency and isolation of model training data are key points of FedRAMP review.
50%UnverifiedDepartment of Defense cloud security requirements (such as the FedRAMP authorization process) set higher standards for supply chain transparency of cloud service providers.
50%UnverifiedThe U.S. federal government's acquisition of AI tools typically must go through reviews such as FedRAMP authorization, FISMA security requirements and the NIST AI Risk Management Framework.
50%UnverifiedSince its launch in 2011, FedRAMP has become the threshold for cloud services entering the government market, but it primarily targets IaaS and SaaS and has shortcomings in its applicability to AI models.
50%UnverifiedThe U.S. government has established the FedRAMP (Federal Risk and Authorization Management Program) certification system for cloud service procurement.
50%UnverifiedFedRAMP was established by the U.S. federal government in 2011 and is divided into three baseline levels—Low, Moderate, and High—with FedRAMP High requiring compliance with 421 security controls.
50%UnverifiedFedRAMP is based on the NIST SP 800-53 security control standard and is divided into three impact levels—Low, Moderate, and High—according to data sensitivity.
50%UnverifiedFedRAMP is a standardized security assessment, authorization, and continuous monitoring framework established by the U.S. federal government in 2011, specifically targeting cloud products and cloud services.
50%Unverified美国FedRAMP认证流程耗时6-18个月，美国联邦政府的Technology Modernization Fund自2017年设立以来仅获批约10亿美元拨款
50%UnverifiedWhen an AI product is marked by DHS as prohibited for use, the GSA procurement catalog, FedRAMP authorization reviews and state IT policies may successively follow suit, forming a de facto compliance chain reaction.
50%