---
tags:
  - Federal Agencies
  - Cloud Service Providers
  - Independent Assessors
  - Advisors
  - FedRAMP
  - Guidance
picto:
  source: person
---

<span class="picto">:lucide-person-standing:{ .person title="This content was written by a human just for this page." }</span>

# Getting Support

FedRAMP is a government program with a strictly limited ability to provide support for private companies. In general,
FedRAMP must provide the same information in the same way to all cloud service providers and other public stakeholders
to ensure no vendor receives an unfair advantage; otherwise public stakeholders must navigate the FedRAMP process on
their own.

Keep in mind that FedRAMP has limited resources, based on appropriations determined by Congress, and is not able to
scale customer service or provide additional services beyond those we are mandated and funded to perform. In 2025,
FedRAMP was restructured to focus on ensuring a consistent and high quality review process by retaining only highly
technical staff.

!!! tip "Advisory services can provide additional support"

    There are many advisory services that specialize in helping companies navigate the FedRAMP process. The best of
    these can provide detailed business advice to help you understand the latest requirements and align your goals
    to meeting those requirements. Private companies that rely on trusted advisory services frequently outperform
    those that try to do this on their own. Remember, FedRAMP is just one step in complex world of establishing a
    contract with a federal agency to use a cloud service.

## Documentation

**Documentation** is the primary mechanism that FedRAMP uses to provide public support. The production of
rules, best practices, technical assistance, and other materials is part of FedRAMP's responsibility and we take
it seriously. Private companies will need to review FedRAMP materials in depth as the first line of support.

!!! success "You are here!"

    You are in the right place to learn about FedRAMP - keep going!

The Consolidated Rules for 2026 are designed to be a complete source of truth for FedRAMP rules and requirements.
If it is not written down in these rules or on fedramp.gov then it is not real. Stakeholders should refer to this documentation early
and often.

!!! tip "Source material is available for AI services"

    We strongly encourage the use of AI services to understand, navigate, and process all of these rules.
    Just make sure they are configured to rely only on these materials, as there's a glut of incorrect historical
    material about FedRAMP that no longer applies.

    Our [Source Data](sources.md) page explains how to point agents at the underlying source data directly
    for an optimal experience.

## The FedRAMP Community

**Public discussions** provide a secondary mechanism that allows FedRAMP to provide public support that is available to
everyone in a fair, consistent manner. We strongly prefer and prioritize responding to questions asked in public so
that everyone can benefit.

The links below will take you away from the Consolidated Rules for 2026 and over to the primary FedRAMP website, where
general community information is shared about our FedRAMP Community on GitHub and monthly Community Updates
(and other events).

<div class="grid cards" markdown>

-   :octicons-mark-github-24:{ .xl .middle .stable } **GitHub Discussions**

    ---

    Post any question about FedRAMP in our Community GitHub discussions and get answers and feedback directly from
    FedRAMP leadership or senior staff. This is typically the fastest way to get a high level response from FedRAMP.

    [FedRAMP Community](https://fedramp.gov/community)

-   :lucide-presentation:{ .xl .middle .empty } **Monthly Webinars**

    ---

    We host monthly Community Updates for both FedRAMP Rev5 and FedRAMP 20x communities, and often attend
    or host other events to interact with the community. Q&A is typically a priority for these events, and you
    can review past events on our YouTube channel.

    [FedRAMP Events](https://fedramp.gov/events)

</div>

## Updates on FedRAMP.gov

The Consolidated Rules for 2026 are intended to be quite fixed in time, while our primary website at FedRAMP.gov has all
of the latest changes and updates. These links go outside the Consolidated Rules, but there are a few sections of
FedRAMP.gov that you should be familiar with.

<div class="grid cards" markdown>

-   :octicons-git-compare-24:{ .xl .middle .stable } **Tracking Changes**

    ---

    The Changelog is updated any time something significant changes on FedRAMP.gov - and there's an RSS feed to
    make sure you get a quick notification!

    [FedRAMP.gov Changelog](https://fedramp.gov/changelog)

-   :lucide-newspaper:{ .xl .middle .empty } **Big Updates on the Blog**

    ---

    Our blog is updated around every month with big updates about the program and our progress on various initiatives.

    [FedRAMP Blog](https://fedramp.gov/blog)

-   :lucide-megaphone:{ .xl .middle .placeholder } **Public Notices**

    ---

    Public notices are critical announcements that don't fit well as a blog post but require a dedicated update that everyone can reference.

    [Public Notices](https://fedramp.gov/notices)

-   :lucide-mail-question-mark:{ .xl .middle .machine } **Requests for Comment**

    ---

    FedRAMP is required by law to seek public comment before publishing guidance that can affect stakeholders, and our
    Requests for Comment (RFC) process ensures everyone has an opportunity to provide formal feedback.

    [FedRAMP RFCs](https://fedramp.gov/rfcs)

</div>

## Direct Help

In the event that all of these resources don't provide the help you need, you can ask for help directly from FedRAMP via our
customer service portal. Requests sent through our help desk are typically routed to senior staff and addressed routinely via
the course of daily operations. FedRAMP does not provide an SLA or other guarantee on response times, and may ignore help
requests that are inappropriate or otherwise publicly addressed.

!!! tip "Cloud service providers should ask for help directly, not through an intermediary!"

    If FedRAMP receives a request for help on behalf of a specific cloud service provider in a specific scenario
    from a different party, we will typically advise that party that they should tell the provider to contact
    us directly.

!!! danger "All communications with FedRAMP are federal records that may be made public!"

    Members of the public who communicate with FedRAMP have no right to privacy in their communications with
    the U.S. federal government. Any request for help, email, document, or other communication sent to FedRAMP
    is a federal record and subject to disclosure to other parts of the government or the public.

<div class="grid cards" markdown>

-   :octicons-git-compare-24:{ .xl .middle .stable } **Direct Help**

    ---

    It's not your typical corporate inbox with a thousand agents who don't know the subject - ours is monitored primarily by senior technical staff and leadership.

    [E-mail info@fedramp.gov](mailto:info@fedramp.gov)

</div>

!!! warning "Transition from info@fedramp.gov in progress"

    FedRAMP plans to transition to web-based forms for help and support soon, but this page currently does
    not have this capability. This content is here only as a preview - please reach out to info@fedramp.gov
    in the interim.

    FedRAMP plans to transition away from providing support via info@fedramp.gov to private
    entities in the near term.

## Things FedRAMP Won't Do

Many of our stakeholders are used to working with private companies where casual communication and competitive
service is an expectation; this is not the case when working with FedRAMP. We are strictly limited by the law,
government policy, and GSA policy in our ability to interact with the public or provide support to the public.
Each employee is subject to ethics rules, financial disclosures, and other limitations on our ability to act
independently.

The nature of our work frequently exposes us to investigation from Congress, Inspectors General, or the public.
We work diligently to follow all necessary rules to avoid even the appearance of impropriety while acting
strictly within our own authority and responsibilities set for the program.

Things that FedRAMP will not do for stakeholders include:

1. **Meet with individual companies or their representatives to discuss FedRAMP.** We must decline any meeting
   request from a private company or individual to discuss FedRAMP, especially if they are seeking advice or other
   special advantage. We only meet with companies in strictly limited mission-critical scenarios following
   procedures that are vetted by the GSA Office of General Counsel.

2. **Provide advice, recommendations, or other guidance that may be construed as such.** We can't appear in
   any way to be guiding private companies and must remain impartial in communications. This is especially
   critical when folks explicitly say they are seeking advice from FedRAMP as it sets up a dangerous situation
   for FedRAMP staff; we may be forced to entirely ignore messages that solicit advice for critical business
   decisions.

3. **Mediate disagreements between private stakeholders.** This is especially true between cloud service providers
   and their assessor or advisor; FedRAMP will not enter any disagreements or other relationship issues between
   private companies, it's up to the private companies to sort them out. Parties may consult with FedRAMP for
   clarity in different situations but FedRAMP will only provide information.

