US
FedRAMP
The US government's authorisation programme for cloud services, built on NIST 800-53.
Who it applies to
Cloud providers selling to US federal agencies.
What it can cost
Lost deals, failed audits and penalties set by your regulator or contract.
- Run by
- The US General Services Administration
- Baselines
- Low, moderate and high
- Built on
- NIST 800-53
What FedRAMP asks of you
- 01Continuous monitoring
- 02Access control
- 03Configuration management
- 04Incident response
- 05Vulnerability scanning
- 06Plan of action and milestones
How orta covers FedRAMP
300 FedRAMP requirements, mapped
Each requirement is linked to orta's common controls, so evidence you already have counts here too.
Checked from your own systems
Host, Kubernetes and AWS checks run on a schedule and mark controls passing or failing, every day.
Ready for your auditor
Give them a read-only login to see controls, evidence and documents in one place.
What feeds it
- Continuous complianceA passing check counts in every framework that needs it.
- Cloud postureYour cloud accounts, checked. Your data, left where it is.
