---
tags:
  - Federal Agencies
  - Guidance
title: "Agencies"
icon: material/bank-outline
hide:
  - toc
picto:
  source: person
---

<span class="picto">:lucide-person-standing:{ .person title="This content was written by a human just for this page." }</span>

# Federal Agencies

FedRAMP provides a standardized, reusable approach to security assessment and authorization for cloud computing products and services used by federal agencies. Federal agencies are
required by both [the law](../authority/law/agencies.md){ data-preview } and [OMB policy](../authority/m-24-15/roles.md) to follow the processes and rules established by FedRAMP
when using cloud services in agency information systems. This authority builds on existing requirements in the law and policy and may not be ignored;
[M-24-15](../authority/m-24-15/implementation.md){ data-preview } explicitly requires agencies to update their agency policies to align with FedRAMP.

!!! tip "FedRAMP was established to support agency mission delivery by standardizing how agencies use commercial cloud services."

    All of the work done by FedRAMP is designed to help agencies save money, effort, and time by providing them with a legal
    framework for using commercial cloud services within federal information systems that lowers the burden for adoption
    significantly. FedRAMP is not an oversight or enforcement body, it exists to be the primary point of connection between
    agencies and commercial services to enable adoption.

!!! danger "Oversight and enforcement is still performed!"

    Failure to follow processes outlined by FedRAMP, in alignment with the law and policy, will expose agency officials
    to audit by the Office of Management and Budget, Inspectors General, and the Government Accountability Office.
    FedRAMP has participated in multiple audits by each of these bodies that has resulted in findings against agencies
    for following legacy processes or failing to properly adopt FedRAMP processes.

    A [March 2026 Best Practices for Cloud Computing](https://www.ignet.gov/sites/default/files/files/CIGIE-OIG%20Best%20Practices%20for%20Cloud%20Computing.pdf)
    report from the Council of the Inspectors General highlights many failures by agencies to meet their responsibilities
    for the use of cloud services.

---

<!--

## What FedRAMP Does for Agencies in 2026

FedRAMP has an extensive and detailed set of responsibilities and mandates set in law and policy. In general, FedRAMP does the following for agencies:

1. **Provides the rules and processes** that agencies follow when using FedRAMP Certified cloud services to simplify and streamline the adoption of
   these services by many different agencies government-wide.

2. **Establishes a minimum set of security materials** for cloud service providers to supply to government customers that are legally sufficient for
   agencies to make initial and ongoing decisions to authorize the use of these services in agency information systems. Agencies must still determine
   the security categorization of systems they operate and review the FedRAMP materials to ensure the information in the materials demonstrates that
   the cloud service is appropriate for use.

3. **Supports agencies with technical assistance**, best practices, and other services to help agencies securely adopt FedRAMP Certified cloud services
   without every agency needing to start from scratch as if they are alone in the federal government.

4. **Connects the government-wide security community** at the practitioner-level through our Agency Liaison program, Agency Support Groups, FedRAMP Days,
   and other government-wide activities coordinated by FedRAMP and OMB.

---

## Learn More about FedRAMP

This section of the Consolidated Rules for 2026 is designed to help agencies get started with FedRAMP and manage all of their responsibilities around
the FedRAMP process.

-->

<div class="grid cards" markdown>

-   :lucide-heart-handshake:{ .xl .middle .stable } **Get Help with FedRAMP**

    ---

    Learn about our support systems, the Liaison Program, and all the other ways FedRAMP will help your agency deliver.

    [Getting Support as a Federal Agency](support/index.md){ data-preview }

-   :lucide-scan:{  .xl .middle .machine } **When FedRAMP Applies**

    ---

    Learn why not all cloud services are eligible for a FedRAMP Certification and when FedRAMP doesn't apply for agency information systems.

    [The Scope of FedRAMP](../scope.md){ data-preview }

-   :lucide-cloud-backup:{  .xl .middle .person } **How to use FedRAMP**

    ---

    Learn how to streamline and optimize the agency ATO process to properly use a FedRAMP Certified cloud service.

    [Using a FedRAMP Certified cloud service](use/index.md){ data-preview }

-   :lucide-gavel:{  .xl .middle .placeholder } **Follow the rules**

    ---

    Review a simplified set of declarative rules that summarize the law and policy in plain language to help agencies follow the rules.

    [Agency-Specific FedRAMP Rules](rules/index.md){ data-preview }

</div>
