FedRAMP Rev 5 A.3: A.3 Deployment model, service model and system stack

Providers qualify their offering by NIST SP 800-145 deployment model (government-only community, public, private or hybrid; private clouds fully within federal facilities are the one exception to the mandate and private clouds on IaaS or PaaS use the FedRAMP process but receive no designation) and by service model (SaaS, PaaS, IaaS), and authorize the whole system stack: to achieve authorization a service must reside on FedRAMP Authorized infrastructure, inheriting controls through a leveraging relationship, or stand up its own infrastructure and platform inside its authorization boundary as a traditional authorization in which the provider is responsible for the entire stack. Controls can be inherited only from a pre-existing FedRAMP authorization; an underlying IaaS or PaaS that is not FedRAMP authorized is defined within the boundary as interconnections and external services.