FedRAMP Rev 5 G.3: G.3 Authorization paths

FedRAMP supports agency authorizations, signed by an agency authorizing official or conducted jointly by a group of agencies that pool resources and reach consensus on acceptable risk, with the FedRAMP Director ensuring they can support the presumption of adequacy and the Board convening agency IT leaders into authorization groups; program authorizations signed by the FedRAMP Director where no agency sponsor exists but multi-agency use is reasonably expected or where a service has become widely adopted; and other paths designed by the program office with OMB and NIST and approved by the Board, all held to the program's standards. Existing JAB provisional authorizations were re-designated by the program office with the provider, agency AOs determine acceptable risk for their agency, the Director determines what may be called a FedRAMP authorization, and an agency may authorize an already authorized provider at a higher impact level after tailoring.