The Compliance Atlas·Volume VIII
Volume VIII · FedRAMP · Edition 2026.1

The Compliance Atlas

Authoritative refs
FedRAMP PMO (GSA) · FedRAMP Rev 5
NIST SP 800-53 Rev 5 · OMB M-24-15
Verified May 12, 2026

FedRAMP isn't an audit, certification, or attestation — it's an authorization. A federal Authorizing Official accepts risk on behalf of the government in exchange for the right to use a cloud service. The output isn't a report; it's an ATO. The framework underneath it is NIST 800-53 Rev 5 — the federal control catalog itself.

Reading the Atlas

Internal — CSP External — 3PAO · FedRAMP PMO · AO Bridge / hand-off

Highest cost in the Atlas. Typical Moderate authorization runs 12–18 months, $500K–$1M+; High runs 18–24 months and $1M+. The 2024 OMB Memo M-24-15 and FedRAMP 20x initiatives are modernizing the program toward automation and machine-readable evidence.

I.
Layer 01 — Lifecycle

From Pre-Auth to ATO to Continuous Monitoring

FedRAMP Authorization Boundary
NIST RMF (SP 800-37r2)

The full FedRAMP path — readiness through authorization through ConMon

12–24 MONTH AUTHORIZATION JOURNEY → Strategy Readiness SSP development 3PAO assessment Authorization ConMon Reauth · 3yr INTERNAL — CLOUD SERVICE PROVIDER (CSP) EXTERNAL — 3PAO · FedRAMP PMO · JAB / AGENCY AO Path decision JAB or Agency P-ATO vs Agency ATO Impact level High · Mod · Low · LI-SaaS FIPS 199 categorization Authorization boundary scope · interconnections CSO / data flows Implement controls 800-53 Rev 5 baseline + FedRAMP parameters Submit auth package SSP · SAP · SAR · POA&M to AO via PMO Ongoing ConMon monthly + annual vuln scans · POA&M · IR Significant Change Req major arch changes SCR review by AO Sponsoring agency if Agency ATO path contract drives sponsor Readiness assessment RAR by 3PAO "FedRAMP Ready" listed Inheritance mapping parent IaaS/PaaS controls CRM document SSP drafting often 1,000+ pages High implementation per ctrl Remediate findings close gaps from SAR High/Mod risks pre-ATO Marketplace listing Ready · In Process · Auth. public-facing status Reauthorization ~3 yr cycle full re-assessment by 3PAO 3PAO selection FedRAMP-accredited list A2LA accredited Readiness Assessment RAR delivered to PMO advisory only SAP submitted 3PAO test plan methodology · sample Independent assessment examine · interview · test + pen test required SAR delivered findings · risk ratings High/Mod/Low risks AO authorization JAB or Agency ATO letter issued Annual Assessment subset retested by 3PAO core controls + change Independence checks no consult + assess 3PAO QMS verified PMO review RAR feedback "Ready" decision Sample selection 800-53A test methods examine · interview · test Pen test (CSP-funded) FedRAMP Pen Test Guide unique attack vectors Risk assessment PMO + AO review accept · reject · POA&M Reciprocity other agencies leverage P-ATO is reusable ConMon submissions monthly to PMO scans + POA&M + sigs THE AO ACCEPTS THE RISK No certificate. ATO is a federal-officer signed letter. SSP → 3PAO tests against remediated findings → SAR finalized marketplace status → reciprocity unlocked RAR feedback → advise CSP fixes

JAB P-ATO vs Agency ATO — two paths, very different mechanics

PATH 1 · JAB PROVISIONAL ATO P-ATO DoD · DHS · GSA CIOs jointly authorize Issued by: Joint Authorization Board Reusability: High — any agency can leverage Selection: competitive · CSP nominates self · JAB picks ~12/yr Effort: 12–24 months typical Fit: broadly applicable cloud services USE WHEN — You target multiple agencies / wide federal market — Large CSP with established federal customer pipeline — Willing to wait in JAB queue for prioritization — Service has clear cross-agency utility — Note: FedRAMP 20x is reshaping these paths in 2025+ PATH 2 · AGENCY AUTHORIZATION Agency ATO single sponsoring agency authorizes Issued by: Agency AO (CIO or designee) Reusability: Lower — others must do additional review Selection: customer-driven · agency contract drives sponsorship Effort: 9–18 months typical Fit: specific agency mission alignment USE WHEN — Existing federal contract drives FedRAMP requirement — Single agency is anchor customer — Faster path to first ATO than JAB queue — Most authorized CSPs use this path — Can later pursue JAB upgrade for broader market

Why FedRAMP feels like a different animal

The output is a federal authorization, not a private-sector report. Every other framework in the Atlas produces an opinion (SOC 2), certificate (ISO 27001), assessment (HITRUST), or attestation (HIPAA self-claims). FedRAMP produces an ATO letter — a federal Authorizing Official's signed acceptance of risk on behalf of the U.S. government. This isn't a check-the-box document; it's a personal liability decision by a senior federal official who can be questioned by Congress about why they accepted a particular system.

The 800-53 Rev 5 control catalog is the engine. FedRAMP isn't its own control framework — it's a process for authorizing cloud services against NIST 800-53 with FedRAMP-specific parameter values, additional control selections, and prescriptive testing methodologies. Where SOC 2 says "the entity restricts access" and ISO says "implement A.5.15," 800-53 specifies AC-2 with sub-controls AC-2(1) through AC-2(13), parameter values, and assessment objectives traceable to 800-53A. The prescriptiveness exceeds even PCI DSS.

The cast of players is unusually large. The CSP (you), the 3PAO (your independent assessor), the FedRAMP PMO at GSA (program operator), the JAB or Agency AO (the decision-maker), the agency CISO and ISSO/ISSM (review the package), and — for JAB authorizations — the JAB Technical Reviewers (technical due-diligence team). Coordinating across all of these takes program management as serious as the technical work.

You don't pass FedRAMP. You convince a federal official to sign their name to your risk.

FedRAMP 20x and OMB M-24-15 are reshaping the program. The July 2024 OMB Memo M-24-15 directed FedRAMP to modernize — moving toward automated continuous authorization, machine-readable evidence (OSCAL), and faster assessment cycles. FedRAMP 20x (announced 2024) targets 80%+ control evidence automation and significantly compressed authorization timelines. As of 2026, the older heavily-document-driven model coexists with new automation paths. CSPs preparing for authorization should track current PMO guidance closely — the rules are visibly evolving.

The reciprocity model has trade-offs. JAB's P-ATO is the most reusable authorization — any federal agency can leverage it without doing fresh work. But fewer than ~50 P-ATOs exist at any time, and the JAB selects only ~12 new sponsorships annually. Agency ATOs are the more common path (~250+ in marketplace) — faster to first authorization, but each subsequent agency must do its own ATO review (often 60-120 days) before they can use the service. Most successful CSPs start with Agency, expand through additional Agency ATOs, and eventually pursue JAB if the federal book of business justifies it.

II.
Layer 02 — Control universe

800-53 Rev 5 — twenty families across three impact baselines

NIST SP 800-53 Rev 5
FedRAMP Rev 5 Baselines

The control families and their FedRAMP baseline counts

20 CONTROL FAMILIES · LOW 156 · MOD 323 · HIGH 410 FAMILY DOMAIN LOW MOD HIGH FAMILY SIZE AC Access Control Identification, authorization, account mgmt 12 22 28 25 AT Awareness & Training Workforce training, role-based, retention 4 5 5 6 AU Audit & Accountability Logging, monitoring, retention, integrity 10 14 20 16 CA Assessment, Auth & Monitoring Auth boundary, ConMon, plan-of-action 6 8 10 9 CM Configuration Management Baselines, change control, inventory 10 21 25 14 CP Contingency Planning DR, backups, alternate sites 6 19 25 13 IA Identification & Authentication User & device IDs, MFA, credentials 11 16 18 12 IR Incident Response Detection, response, reporting, IR plan 7 10 14 10 MA Maintenance Authorized maintenance, tools, personnel 4 8 10 7 MP Media Protection Sanitization, marking, transport 4 10 13 8 PE Physical & Environmental Protect. Facility access, fire, power, env hazards 9 17 22 23 PL Planning SSP, PII, baseline tailoring 5 7 7 11 PM Program Management CSP-wide program (not system-specific) — — — 32 PS Personnel Security Background checks, sanctions, transfer 8 8 9 9 PT PII Processing & Transparency PII-specific privacy controls (Rev 5 new) 2 3 3 8 RA Risk Assessment Risk analysis, vuln scans, threat models 7 10 12 10 SA System & Services Acquisition SDLC, supply chain, dev practices 8 22 28 23 SC System & Communications Protect. Boundary protection, crypto, transmission 14 31 38 51 SI System & Information Integrity Flaw remediation, malware, monitoring 11 21 28 23 SR Supply Chain Risk Mgmt (Rev 5 new) SCRM strategy, supplier assessment 3 7 10 12 CONTROL COUNTS ARE APPROXIMATE Counts shown are FedRAMP Rev 5 baseline implementations. Numbers vary slightly between FedRAMP releases as new controls are added or retired. Within each control family, FedRAMP also requires Control Enhancements — sub-controls that strengthen the base. SC and AC are the two largest families by depth. PM is excluded from baseline counts because Program Management controls apply to the CSP organization, not specific systems. PT and SR are new families introduced in Rev 5 (vs Rev 4) — both increasing in importance through 2025–2026.

What 800-53 actually demands

The control catalog is the engine. 800-53 Rev 5 contains ~1,189 controls plus enhancements across 20 families. FedRAMP doesn't add new controls — it selects subsets via baseline tailoring. Low picks 156 controls, Moderate 323, High 410. Each baseline includes specific enhancements that strengthen the parent control. "We implement AC-2" isn't enough; FedRAMP Moderate requires AC-2(1) account management automation, AC-2(2) automated temporary/emergency accounts, AC-2(3) automated disable, etc.

Parameter values are FedRAMP-specific. 800-53 leaves many control parameters open ("[Assignment: organization-defined frequency]"). FedRAMP fills these in with prescribed values. The most-cited example is AC-2(3): "automatically disable accounts" — FedRAMP Moderate requires 35 days; High requires 35 days; not the more flexible "organization-defined." A SAR finding doesn't say "your 90-day disable is reasonable"; it says "your 90-day disable doesn't meet FedRAMP's 35-day parameter." There is no compensating control logic.

800-53 tells you what to do. FedRAMP tells you the precise parameters. The 3PAO tells you whether you did it.

SC and AC dominate effort. System and Communications Protection (SC) is the largest family at 51 base controls; AC (Access Control) is 25. Together they account for ~30% of authorization effort. Most CSP implementation gaps surface in SC (boundary protection, FIPS-validated crypto, denial-of-service protection, transmission integrity) or AC (least-privilege automation, dynamic separation-of-duties, account monitoring).

Two new families in Rev 5 reshape the program. PT (PII Processing & Transparency) brings privacy-by-design into the security catalog — explicit consent, purpose specification, data-minimization controls. SR (Supply Chain Risk Management) makes supply-chain controls first-class citizens, requiring documented SCRM strategies, supplier assessments, and provenance tracking. Both are responses to executive orders (14028 on cybersecurity, 14117 on supply chain) and are increasing in audit emphasis through 2025–2026.

The Customer Responsibility Matrix (CRM) is critical. A CSP running on AWS GovCloud, Azure Government, or another FedRAMP-authorized parent inherits dozens of controls. The CRM documents which controls the CSP fully implements, which the parent provider implements, which are shared (both contribute), and which the customer agency must implement on their own deployment. Inheritance is what makes FedRAMP economically feasible for SaaS — without it, every SaaS would re-test every infrastructure control.

III.
Layer 03 — Authorization Package

SSP, SAP, SAR, POA&M — and what ConMon expects

FedRAMP templates · 800-53A
OSCAL · ConMon Strategy

The four core authorization documents

DOCUMENT 1 · CSP-AUTHORED SSP System Security Plan — System description & boundary — FIPS 199 categorization — Inventory · users · interconnections — Per-control implementation — Inheritance and CRM — Architecture diagrams SCALE High: 1,000–2,500 pages Moderate: 600–1,200 pages Low: 300–600 pages FedRAMP TEMPLATE Mandatory format · DOCX OSCAL output (Rev 5+) Living document — updated on every change DOCUMENT 2 · 3PAO-AUTHORED SAP Security Assessment Plan — Assessment scope & objectives — Test methodology per control — Sample population & size — Schedule & team assignments — Pen test scope & rules — Independence affirmations SCALE Typically 200–500 pages Largely template-driven Customized to system PMO REVIEW PMO + AO review SAP before testing begins "Approved to test" gate decision DOCUMENT 3 · 3PAO-AUTHORED SAR Security Assessment Report — Per-control test results — Findings (Low/Mod/High) — Risk-adjusted ratings — Pen test executive summary — Evidence references — 3PAO sign-off SCALE High: 1,500+ pages Moderate: 800–1,200 pages Low: 400–800 pages DRIVES THE DECISION SAR is the primary input to AO authorization. High findings typically block ATO until remediated. DOCUMENT 4 · CSP-AUTHORED POA&M Plan of Action & Milestones — Each finding from SAR — Remediation plan — Owner · target close date — Evidence on closure — Updated monthly — Living document SLAs High: 30 days to remediate Moderate: 90 days Low: 180 days CONMON HEARTBEAT POA&M submitted monthly to PMO during ConMon Open Highs are red flags to AOs reviewing CSP

Continuous Monitoring — the ATO is not a one-time event

CONMON CADENCE — MONTHLY · QUARTERLY · ANNUAL EVERY MONTH Monthly ConMon — Authenticated vuln scans (OS, DB, web) — Updated POA&M submitted to PMO — Inventory updates (Integrated Inventory Workbook) — Significant Change Requests (if any) — Incident reports (any > Low impact) — Deviation Request approvals Skip a month · risk losing ATO EVERY QUARTER Quarterly Assessments — Quarterly summaries to AO + PMO — Trend analysis (POA&M aging, vuln backlog) — SSP version control review — Personnel change reporting — Subset of controls reassessed — Customer agency communications Pattern detection by AO EVERY YEAR Annual Assessment — 3PAO returns for full reassessment — Subset of controls retested (~⅓) — SSP refresh published — Pen test redone — New SAR delivered — AO re-affirms or revokes ATO 3-year cycle culminates in re-auth Authorization isn't pass/fail — it's continuous. CSPs that drift see "stop work" letters before formal revocation.

Where authorization packages go wrong

The SSP is the most-underestimated artifact in compliance. A FedRAMP Moderate SSP is typically 800-1,500 pages of detailed control implementation narrative — every selected control gets multiple paragraphs describing exactly how the CSP satisfies it, with cross-references to architecture diagrams, configuration documents, and operational procedures. Most first-time CSPs underestimate SSP authoring effort by 3-5x; experienced CSPs hire dedicated SSP authors or specialty firms.

Inheritance accuracy determines economic viability. A SaaS running on AWS GovCloud can inherit dozens of controls (physical security, environmental controls, much of network protection) from AWS's existing FedRAMP authorization. Get the inheritance right in the SSP/CRM and your control burden drops by 30-50%. Get it wrong — claim inheritance you don't have, or fail to claim inheritance you do — and the 3PAO will surface every gap in the SAR. The CRM is the most-scrutinized appendix in the package.

SAR risk ratings are negotiable but bounded. Findings come out of testing as "the control wasn't fully met." The 3PAO assigns initial Low/Moderate/High ratings, but CSPs can submit Risk Adjustment requests if they believe a finding's severity is overstated relative to the system's risk. The PMO and AO ultimately decide. Common pattern: 3PAO marks something High based on textbook severity; CSP demonstrates compensating controls + low exposure; PMO accepts a Moderate rating. Don't accept initial ratings as final — but be ready to back up adjustments with technical detail.

The ATO is the start, not the end. ConMon failures revoke ATOs as surely as initial assessment failures deny them.

POA&M aging is the early-warning indicator AOs watch. Newly opened High findings get attention. Aged High findings get scrutiny. High findings older than 30 days get questions. High findings older than 90 days get suspension warnings. The pattern AOs look for isn't "are there findings?" — every system has findings — but "is this CSP closing findings on schedule, and are repeat findings emerging?" Programs that treat POA&M as a paperwork exercise instead of a real remediation tracker eventually have ATOs revoked.

Significant Change Requests are how you avoid surprise re-assessments. Major architectural changes (new region, new authentication method, new third-party integration handling federal data, new product capability) require an SCR submitted to the AO before deployment. The AO determines whether the change is "significant" (requires fresh 3PAO testing) or "non-significant" (can be documented in regular ConMon). Skipping SCR review and deploying a major change is a fast path to losing ATO.

IV.
Layer 04 — Cross-framework

FedRAMP / 800-53 — the prescriptive engine others borrow from

800-53 Rev 5 Family Mappings
NIST control mapping references
800-53 family SOX SOC 2 (TSC) ISO 27001:2022 NIST CSF 2.0 PCI DSS v4.0.1 HITRUST v11 Shared evidence
AC — Access Control ITGC — Access CC6.1 – CC6.3 A.5.15 · A.5.18 · A.8.2 · A.8.3 PR.AA-05 Req 7 · Req 8 01.b · 01.v JML tickets, UAR exports, IAM config, role definitions
AT — Awareness & Training ELC · COSO Comp.4 CC1.4 A.6.3 PR.AT-01 Req 12.6 02.e · 02.f Completion reports, phishing tests, role-based training records
AU — Audit & Accountability ITGC — Operations CC7.1 · CC7.2 A.8.15 · A.8.16 DE.CM-01 Req 10 09.aa SIEM rules, log retention config, automated review evidence
CA — Assessment, Auth, Monitor Internal Audit fn CC4.1 · CC4.2 Cl. 9.2 ID.IM · GV.OV Req 12.4.1 06.h Internal audit reports, ConMon outputs, mgmt review records
CM — Configuration Mgmt ITGC — Change CC6.6 · CC8.1 A.8.9 · A.8.32 PR.PS-01 · PR.PS-06 Req 2 · Req 6.5 09.h · 10.h CIS benchmarks, change tickets, drift detection, IaC reviews
CP — Contingency Planning BPC · resilience A1.2 · A1.3 A.5.29 · A.5.30 RC.RP Req 12.10 12.b · 12.c DR plans, last-test reports, RTO/RPO documentation
IA — Identification & Auth ITGC — Access CC6.1 · CC6.2 A.5.16 · A.5.17 PR.AA-01 · PR.AA-03 Req 8 01.b · 01.q MFA enforcement, password policy, FIPS-validated crypto modules
IR — Incident Response BPC · IT ops CC7.3 – CC7.5 A.5.24 – A.5.27 RS.MA · RS.AN Req 12.10 11.a – 11.c IR plan, tabletop reports, post-incident reviews, US-CERT reports
MA — Maintenance ITGC — Operations CC6.6 A.7.13 PR.PS-04 Req 9.5 09.r Maintenance schedule, authorized personnel logs, tools inventory
MP — Media Protection ITGC — Operations CC6.5 A.7.10 · A.7.14 PR.DS-02 Req 9.4 · Req 3.2 07.a Asset register, sanitization records, transport logs
PE — Physical & Env ITGC — Operations CC6.4 A.7.1 – A.7.14 PR.AA-06 · PR.IR-02 Req 9 08.b · 08.j Badge logs, CCTV retention, facility maintenance, env controls
PL — Planning ELC · governance CC1.1 · CC5.3 Cl. 4 · Cl. 6 GV.OC · GV.PO Req 12 00.a · 04.a SSP, info security policy, baseline tailoring documentation
PM — Program Mgmt ELC · governance CC1.1 – CC1.3 Cl. 5 GV.RR · GV.RM Req 12.4 02.a Program charter, leadership communications, risk strategy
PS — Personnel Security ITGC — Access CC1.4 · CC6.2 A.6.1 · A.6.2 PR.AT-02 Req 12.7 02.b · 02.c Background check records, NDAs, transfer/termination logs
PT — PII Processing & Trans. Privacy program P1 – P8 A.5.34 GV.SC (privacy) — 13 (Privacy) Privacy policy, consent records, data inventory, DSARs
RA — Risk Assessment ELC · risk memo CC3.1 – CC3.4 Cl. 6.1 GV.RM · ID.RA Req 12.3 03.a · 03.b Risk register, threat models, vuln scan reports, pen tests
SA — System & Services Acq. ITGC — SDLC CC8.1 A.8.25 – A.8.32 PR.PS-06 Req 6 10.a · 10.b SDLC documentation, code review records, acquisition contracts
SC — System & Comms Protect. ITGC — Operations CC6.6 · CC6.7 A.8.20 – A.8.24 PR.IR-01 · PR.DS-02 Req 1 · Req 4 09.m · 09.s Network diagram, FIPS crypto config, boundary protection rules
SI — System & Info Integrity ITGC — Operations CC7.1 A.8.7 · A.8.8 DE.CM-09 · ID.RA-01 Req 5 · Req 11 09.j · 10.k Vuln scan reports, malware logs, flaw remediation tickets
SR — Supply Chain Risk Mgmt ITGC + BPC · TPRM CC9.2 A.5.19 – A.5.23 GV.SC Req 12.8 · Req 12.9 05.k Vendor inventory, due-diligence packages, SBOM, contracts

Why the federal control catalog is the baseline for everything else

800-53 isn't just one of many control catalogs — it's the most comprehensive prescriptive control set that exists in commercial use. NIST CSF maps explicitly to it (the Informative References to PR.AA, PR.PS, etc. all cite 800-53 control numbers). HITRUST CSF lists 800-53 as one of its primary Authoritative Sources. SOC 2's CC6.x and other criteria can be expressed as 800-53 subsets. ISO 27001 Annex A and 800-53 have published bidirectional mappings. PCI DSS v4.0.1 includes informational references to 800-53.

The implication: if you can pass FedRAMP, you can pass nearly anything else. The reverse is not true. SOC 2 Type 2 doesn't satisfy FedRAMP because FedRAMP requires specific control parameters, prescribed assessment procedures (800-53A), federally-accredited assessors (3PAOs), and an authorization decision by a federal AO. But evidence collected for FedRAMP — vulnerability scan reports, change tickets, IAM configurations, network diagrams, contingency test results — satisfies the evidence requirements of every other framework in the Atlas, often with no modification.

FedRAMP is the most expensive framework to achieve and the most-leveraged once you have it. The control library reused across every other audit you'll ever do.

The strategy for federal-adjacent CSPs. If you're targeting federal customers, FedRAMP is non-negotiable. If you're not, FedRAMP is rarely worth the investment — it's the most expensive path. But for CSPs serving heavily-regulated industries (defense contractors, federal contractors, large healthcare systems with federal grants, financial services with federal banking integration), FedRAMP can become a competitive differentiator that opens markets unavailable to less-regulated competitors. Cost: $500K-$2M+. Return: federal contract pipeline.

The shared-evidence model dominates. For multi-framework programs, build to FedRAMP / 800-53 first; let everything else inherit. Tagged evidence (a single Splunk log retention configuration document) satisfies AU-2 (FedRAMP), CC7.1 (SOC 2), A.8.15 (ISO 27001), DE.CM-01 (NIST CSF), Req 10 (PCI), and 09.aa (HITRUST) simultaneously. The audit work in the second framework is read-and-cite, not collect-fresh.