Glossary of Compliance

Compliance Glossary

Our list of curated compliance glossary offers everything you to know about compliance in one place.

Glossary » FedRAMP » FedRAMP

FedRAMP

FedRAMP or Federal Risk and Authorization Management Program is a government-led compliance program to make the adoption of cloud services across federal agencies secure and efficient. The FedRAMP Authorization Act of 2022 further made FedRAMP a stronger standard after which it was also incorporated into the National Defense Authorization Act (NDAA) in the U.S.

The main aim of FedRAMP is to provide companies with a standardized approach to security measures for products and services in the cloud. This program provides an integrated approach to security assessment, continuous monitoring and authorization to protect sensitive information. It determines the processes that are to be used by cloud businesses so they are qualified to provide services to federal agencies. 

Businesses can have their cloud service authorized for use by federal agencies one of two ways:

1. Joint Authorization Board (JAB) provisional authorization: JAB includes representatives from GSA (General Services Administration), DoD (Department of Defense) and DHS (Department of Homeland Security).
2. Individual Agencies: An individual authorization can be obtained based on specific needs and requirements. This route is usually more favorable, but it requires the cloud business to undergo a separate evaluation or audit to acquire an ATO (Authority to Operate).

Additional reading

Your Guide to ISMS Awareness Training Program

In the age of cloud computing, information is vulnerable. Bad actors are always on the lookout for their next target. They scope for vulnerabilities in an organization’s ISMS (Information Security Management System) and exploit them. This often disrupts business activities. Businesses look at security as a one-time activity and often forget that their employees are…

How to Strengthen Your Organization’s Security Culture

Over the years, stringent laws have come into effect, along with the introduction of most advanced threat detection and prevention technologies. However we continue to encounter familiar breach stories—employees using weak passwords, opening malicious emails, misusing too many permissions, etc. No matter the geography, hackers worldwide have been playing on human behaviors, attitudes, cognition, and…

SOC 2 Auditors and Service Providers [How to Choose One]

Every business looking to get SOC 2 (Service Organization Control) compliant must work with a credible SOC 2 auditor—either a licensed CPA or an American Institute of Certified Public Accountants (AICPA) accredited third-party firm. Auditors must be independent, with no connection to your organization, to ensure unbiased reporting. When selecting the best SOC 2 auditor,…

Sprinto: Your growth superpower

Use Sprinto to centralize security compliance management – so nothing
gets in the way of your moving up and winning big.

Contact sales