Glossary of Compliance

Compliance Glossary

Our list of curated compliance glossary offers everything you to know about compliance in one place.

Glossary » FedRAMP » Joint Authorization Board

Joint Authorization Board

A Joint Authorization Board or JAB provides FedRAMP (Federal Risk and Authorization Management Program) authorization to cloud service providers. 

The Board consists of the Chief Information Officers (CIOs) from the DHS (Department of Homeland Security, DoD (Department of Defense), and GSA (General Services Administration). 

The JAB reviews authorization packages based on the priority queue for cloud businesses. It is also responsible for assessing the requirements under the FedRAMP security authorization and updating it if necessary. 

Once a business has been selected to be sponsored by JAB, it will be required to create a Readiness Assessment Report (RAR) within a period of 60 days. An RAR contains specific information regarding the capability of the business toward meeting FedRAMP guidelines and requirements.

The JAB designates a “FedRAMP Ready,” stamp after which shows the CSP has been assessed by a Third Party Assessment Organization (3PAO)  and is acceptable as per FedRAMP requirements. After this, a CSP is listed in the FedRAMP marketplace.

After FedRAMP authorization, the JAB continues to monitor the cloud products and services of these business entities, ensuring the continuation of their level of compliance with standards on security and their ability to address issues that arise.

If the JAB grants provisional approval for any cloud service, agencies are empowered to provide their own security authorizations and ATOs. The board must also notify agencies promptly of any changes or removals of provisional approvals.

Additional reading

ISO 27001 Malware and Antivirus Policy: Your SMB’s Frontline Defense

Malware protection is a core requirement for ISO 27001 compliance, but many security and compliance teams underestimate the depth of what’s needed. It’s easy to install antivirus software across endpoints. What’s harder is proving that protection is consistently active, up to date, monitored, and backed by evidence that auditors will accept. For SMBs with lean…

SOC 2 Automation: What Is It, and Why Do You Need It?

TL, DR : SOC 2 automation streamlines audit prep by automating evidence collection, continuous control monitoring, and policy management, replacing spreadsheet tracking and cutting audit readiness from months to weeks. The software automates repetitive tasks like mapping Trust Service Criteria to controls, deploying security controls, and generating reports, integrating with your tech stack for full…

Rethinking Trust: How Zero Trust Architecture Redefines Cybersecurity

TL,DR: Zero Trust Architecture (ZTA) eliminates implicit trust by continuously verifying users, devices, and applications, enforcing least privilege access, and dynamically restricting access to critical assets regardless of network location Implementation follows a phased approach: start with identity and access management, introduce software-defined perimeters, enforce micro-segmentation to contain breaches within isolated zones, and automate policies…

Sprinto: Your growth superpower

Use Sprinto to centralize security compliance management – so nothing
gets in the way of your moving up and winning big.

Contact sales