What is the Timeline for the FedRAMP Process?

Ever watched Jeopardy? Even if you haven’t, you’re likely familiar with the iconic theme music that plays every time contestants deliberate over their answers—it’s such an iconic tune that it’s become synonymous with waiting for a conclusion that takes quite a while.

Endeavoring for compliance with the Federal Risk Assessment Management Program (FedRAMP) is one such drawn-out conclusion—it takes time to complete this process, but how much? How long will the Jeopardy theme play?

Before you commit to achieving FedRAMP Authority to Operate (ATO), it’d be helpful to know what you’re getting yourself into. As a Third Party Assessment Organization (3PAO) with the most completed assessments on the FedRAMP marketplace, we have walked over 110 organizations through this journey, and now we want to provide organizations considering the same with important insight.

In this article we will outline the anticipated timeline for what we’ve separated into 4 major phases of FedRAMP—these include the development and preparation of your system, agency sponsorship, execution of an assessment, and the review(s) that yield Authority to Operate (ATO), as well as the continuous monitoring responsibility for your authorized system.

As things move along during your FedRAMP journey, it may—at times—feel like one long pregnant pause with the Jeopardy theme playing. But having read this, you’ll have an understanding of how to get from cradle to grave in the FedRAMP process so you’ll know for sure what step is coming next while you wait.

What is FedRAMP?

Just to lay the groundwork, here’s what you need to know about FedRAMP:

• It’s geared toward Cloud Service Providers (CSPs) that want to do business with the U.S. federal government.
• The standard is designed to safeguard cloud systems with security commensurate to the sensitive data that may be stored, processed, managed, and transmitted within the system.
• Each system that is assessed has an applicable Federal Information Processing Standard (FIPS) 199 risk designation of High, Moderate, or Low depending on the data being processed. These risk levels have considerable variance in the number of security controls:

There are two ways to get FedRAMP Authorized—through either agency sponsorship or the Joint Authorization Board (JAB). Since the agency route is more common, we’ll proceed through the phases of the process assuming you’ll be going that way too. 

The 4 Phases of FedRAMP

Phase 1: System Development and Preparation

Once you’ve determined your risk designation, you can proceed through the 3 phases of FedRAMP, and that starts with developing your Cloud Service Offering (CSO). The time this takes can range depending on the complexity of the system, but know that using a defense-in-depth methodology when building the system is extremely important if you don’t want to extend your timeline considerably.

Because FedRAMP assessments are some of the most difficult, take longer, and tend to be more expensive than average, developing your CSO with the NIST 800-53 controls in mind can prevent considerable rework, or worse, necessary rearchitecting of your environment to ensure you meet the “spirit” of the FedRAMP controls. But if your system is already developed, you may want to perform or have someone perform a gap assessment to better understand if you are truly meeting FedRAMP requirements before moving forward.

In most cases, hiring an experienced FedRAMP advisor can shorten this timeline—these consultants have interacted with the FedRAMP Project Management Office (PMO) and understand the federally mandated “showstoppers” (a.k.a. things that will derail your authorization). An authorized 3PAO Advisor can provide invaluable guidance on how to meet FedRAMP mandates, which a 3PAO assessor cannot.  

Phase 2: Agency Sponsorship

In any case, once your offering is ready to go live, you’ll need to secure an agency sponsor. Without one—or, as we mentioned earlier, authorization from the JAB—the furthest you’ll be able to get is  FedRAMP Ready status, which is not an authorization. (If you’re FedRAMP Ready, you’ve proven you have a system meeting the federal mandates and ready for a Security Assessment at either the Moderate or High baseline but will still need an agency sponsor to move to an In Process and eventually Authorized status). 

Because success with an agency looks different for everyone, we can’t accurately provide a timetable for how long this will take.

Phase 3: Security Assessment – 7-10 Weeks (Approximately)

But once you do secure an Agency sponsor, you can now proceed through a full initial FedRAMP Security Assessment, and we can provide a rough timeline for that.

While FedRAMP moved to NIST 800-53 Rev 5 which has added and removed controls to the baselines, there are also additional requirements that are new to the baseline which may extend readiness—check out our article explaining some of the most important changes here.

(It's particularly worth noting that FedRAMP added a Red Team exercise requirement. Along with the standard FedRAMP Penetration Test, FedRAMP mandated for all Rev 5 assessments an annual Red Team exercise—not only does this go above and beyond what was required previously with Rev 4, but as more guidance comes out on this requirement it could extend this timeline considerably.)

Anyway, before you get started, you’ll need an American Association for Laboratory Accreditation (A2LA) accredited 3PAO like Schellman to perform the assessment—the full FedRAMP Security Assessment Report (SAR) process can be broken into the following stages:

Phase 4: Agency Review and PMO Review – 2-6 months

After you’ve completed the assessment and the SAR is finalized, the SAR and supporting details are submitted as the “authorization package” for review to the sponsoring agency and FedRAMP PMO for their respective reviews.

Your sponsoring agency should review the SAR package at this point and hopefully grant an agency Authority to Operate (ATO), which will then kick off a FedRAMP PMO detailed technical review of the assessment.

Given the number of CSPs pursuing FedRAMP authorization, it’s common that a sponsoring agency and the FedRAMP PMO have a number of packages in their queue for review. Because of this and depending on the sponsoring agency, the completion of both reviews can take between 2 and 6 months.  

After completion of the PMO review, there will be a meeting that includes the FedRAMP PMO, your sponsoring agency, 3PAO, and you as the CSP to review feedback from the FedRAMP PMO and discuss any questions. This review often results in a revision of the SAR to ensure that all are in agreement with the results and the details contained within.

Once updated, the SAR and any other supporting documentation that has been updated are submitted to the PMO for an additional review. The ideal outcome from the resubmission is to receive an email notification within a few weeks from the FedRAMP PMO letting you know that your CSO has been granted FedRAMP Authorized. The authorization will allow you to provide your CSO to other agencies, and it will be listed on the FedRAMP Marketplace as FedRAMP Authorized with its applicable agency ATO. Given the number of variables that factor into the review process, the duration can vary widely based on the queue mentioned above and the feedback received. 

Next Steps for FedRAMP ATO

At this point, you may believe you’re done—the Jeopardy theme will stop playing, the conclusion having been reached. But as long as your CSO is providing services to a federal agency, you will be subject to meeting all continuous monitoring requirements, which include the annual assessment requirement to assess a subset of the full initial controls as well as the annual penetration test—this usually takes 10 – 12 weeks, plus potentially the time it takes to do a red team exercise.

In any case, the process of getting FedRAMP ATO is neither easy nor short, as you now understand. Just the assessment and review periods can take more than three months each, and that doesn’t factor in time spent preparing your offering, however long that may take. No matter what, you’ll need to ensure you have enough time and expertise to get your CSO up to standard so that all your efforts end successfully.

To learn more about FedRAMP, read our other content that can help you further simplify your approach and experience:

• The FedRAMP Assessment Process: What Do You Need to Provide?
• When to Engage a FedRAMP Consultant vs. When to Engage a 3PAO
• 5 Common Pitfalls when Pursuing FedRAMP Authorization