CMMCpedia
Work with me

Terms / Certification

FedRAMP

The Federal program that authorizes cloud services. A cloud service holding your CUI must meet the FedRAMP Moderate baseline or its equivalent.

Also called Federal Risk and Authorization Management Program, FedRAMP Moderate.

Official Source Material

If the Contractor intends to use an external cloud service provider to store, process, or transmit any covered defense information in performance of this contract, the Contractor shall require and ensure that the cloud service provider meets security requirements equivalent to those established by the Government for the Federal Risk and Authorization Management Program (FedRAMP) Moderate baseline (https://www.fedramp.gov/documents-templates/) and that the cloud service provider complies with requirements in paragraphs (c) through (g) of this clause for cyber incident reporting, malicious software, media preservation and protection, access to additional information and equipment necessary for forensic analysis, and cyber incident damage assessment.

Source: 48 CFR 252.204-7012(b)(2)(ii)(D), eCFR text current as of September 17, 2026

Practitioner Guidance

What it means in practice

A cloud service holding your controlled information has a bar to clear.

The clause requires security equivalent to the FedRAMP Moderate baseline. It also requires the provider to comply with the paragraphs on incident reporting, media preservation, and forensic access. Table 4 to 32 CFR 170.19(c)(2)(i) points at the same requirement for scoping. This is the sentence that decides which cloud products a defense contractor can use.

Equivalent is a real standard, and the evidence is a document you can ask for.

A provider either holds a FedRAMP Moderate authorization, which is published, or asserts equivalency, which the Department expects to be demonstrated. Ask which one applies and ask for the evidence in writing before you move data. A marketing claim that a product is suitable for defense work is not evidence, and it will not help you at an assessment.

Check the specific offering, not the brand.

Providers run separate environments, and the commercial version of a product and its Government version are different services with different authorizations. Confirm the tenant, the region, and the plan you are buying. AC.L2-3.1.20 makes controlling the connection to that external system your requirement. Companies regularly discover they are on the wrong version of a service they already pay for.

The requirement is about the service, and your configuration is still yours.

An authorized platform does not implement your requirements for you. The split appears in the customer responsibility matrix, and the rows marked shared or customer are your work. A FedRAMP authorization tells you the platform is sound. It says nothing about how you configured it.

What falls short

  • A cloud service selected on a claim with no authorization or equivalency evidence. The evidence belongs in your file.
  • The commercial version of a product used for controlled work when the Government version is the authorized one.
  • An authorization treated as covering your configuration. The inheritance is partial and the boundary is in the matrix.

Edge cases

  • Your provider holds an authorization at a higher baseline. That meets the bar, and the responsibilities still split the same way.
  • A service handles only security protection data. It is a security protection asset, and the FedRAMP requirement in the clause follows controlled information.
  • Your work is also export-controlled. ITAR adds constraints about who may administer the environment, and an authorization does not answer that question.

Over-engineering

  • Moving to the most restricted Government cloud offering by default. Match the environment to what your work actually requires.
  • Requiring an authorization from every vendor. The requirement follows the controlled information and the security data.