FedRAMP Rev 5 G.7: G.7 Acceptance of external security frameworks and certifications

FedRAMP establishes criteria, approved by the Board, for accepting widely recognized external cloud security frameworks and certifications, in whole or in part, based on its assessment of risk and agency needs, leveraging external assessments in lieu of new ones and, where appropriate, designating certifications that serve as a full authorization, targeting FIPS 199 Low offerings and higher levels where harmonization exists; every service must still meet FedRAMP continuous monitoring requirements for its impact level, agencies may accept compensating controls or risk where federal and external frameworks diverge in line with Board guidance, and FedRAMP may accept a level of risk to support interoperability and reduced burden.