FedRAMP Rev 5 G.1: G.1 Scope of FedRAMP

Agencies must obtain and maintain a FedRAMP authorization for cloud computing products and services, including IaaS, PaaS and SaaS, that create, collect, process, store or maintain federal information on behalf of a federal agency, for unclassified information outside national security systems. Six categories are outside scope unless the FedRAMP Director, with OMB approval, makes an exception: single-agency systems hosted on cloud infrastructure that are not offered as a shared service or under a shared responsibility model; social media and communications platforms used under agency social media policies; search engines; widely available services that provide commercial information without collecting federal information; ancillary services whose compromise would pose negligible risk, such as external measurement or ingestion of public information; and other categories the FedRAMP Board excludes with the Federal CIO's concurrence. FedRAMP publishes guidelines with examples for interpreting the categories, and the initial authorizing agency determines whether data is federal information and whether FedRAMP applies.