FedRAMP Rev 5 G.2: G.2 Presumption of adequacy and its limits

Where a cloud product or service holds a FedRAMP authorization at a FIPS 199 impact level, agencies must presume the security assessment in the authorization package adequate for issuing their own authorization to operate at or below that level, as long as the authorization is actively maintained through continuous monitoring, and assessment materials in a FedRAMP package are presumed adequate when incorporated into a broader authorization for another offering. The presumption does not override agency heads' FISMA responsibilities: an agency may overcome it by a demonstrable need for security requirements beyond the package, such as specific legal requirements, or by a determination that the package is wholly or substantially deficient, in which case it documents the reasons in the resulting package and informs the program office, and the FedRAMP Director decides whether the additional needs merit revised FedRAMP work. Authorizations that leverage external frameworks are also presumed adequate, and agency policies must not treat particular authorization paths or sponsors as unacceptable.