---
tags:
  - FedRAMP
  - Legal Authority
picto:
  source: person
---

<span class="picto">:lucide-person-standing:{ .person title="This content was written by a human just for this page." }</span>

# OMB Memorandum M-24-15

!!! abstract "The rescission and replacement of FedRAMP"

    OMB Memorandum M-24-15 was published on **July 25, 2024**, in response to the establishment of FedRAMP on **December 23, 2022** in the [FedRAMP Authorization Act](../law/index.md).

    This Memorandum formally rescinded and replaced FedRAMP in its entirety, effectively creating a new program with the same name but an entirely different set of authority and responsibilities.

!!! info "Minor Modifications for Readability"

    The text of M-24-15 shown on this site has been modified slightly for readability (including additional subheaders) and to fix broken links. No material content or words have been changed. [The original PDF is available on whitehouse.gov](https://www.whitehouse.gov/wp-content/uploads/2024/07/M-24-15-Modernizing-the-Federal-Risk-and-Authorization-Management-Program.pdf).

---

![**MEMORANDUM FOR THE HEADS OF EXECUTIVE DEPARTMENTS AND AGENCIES** **July 25, 2024** **Subject: Modernizing the Federal Risk and Authorization Management Program
(FedRAMP)**](m-24-15-official.png)


---

The Federal Risk and Authorization Management Program, known as FedRAMP, was
established by the Office of Management and Budget (OMB) through a December 8,
2011 memorandum from the Federal Chief Information Officer (CIO),
"[Security Authorization of Information Systems in Cloud Computing Environments](https://bidenwhitehouse.archives.gov/wp-content/uploads/legacy_drupal_files/omb/assets/egov_docs/fedrampmemo.pdf)[^1],"
to safely accelerate the adoption of cloud computing products and services by
Federal agencies, and help those agencies avoid duplicating efforts by offering
a consistent and reusable authorization process.

In 2022, recognizing the value that FedRAMP has provided to Federal agencies and
to industry, Congress passed the FedRAMP Authorization Act ("the Act"). The Act
established FedRAMP within the General Services Administration (GSA) and created
a FedRAMP Board to provide input and recommendations to the Administrator of
GSA.[^2] The Act also requires OMB to issue guidance defining the scope of
FedRAMP, establishing requirements for the use of the program by Federal
agencies, establishing further responsibilities of the FedRAMpP Board and the
program management office (PMO) at GSA, and generally promoting consistency in
the assessment, authorization, and use of secure cloud services by Federal
agencies.

As a result, this memorandum rescinds the Federal CIO's December 8, 2011
memorandum, and replaces it with an updated vision, scope, and governance
structure for FedRAMP that is responsive to developments in Federal
cybersecurity and substantial changes to the commercial cloud marketplace that
have occurred since the program was established.

---

- [Section I. Background](background.md)
- [Section II. Vision](vision.md)
- [Section III. Scope of FedRAMP](scope.md)
- [Section IV. The FedRAMP Authorization Process](process.md)
- [Section V. Automation and Efficiency](automation.md)
- [Section VI. Continuous Monitoring](monitoring.md)
- [Section VII. Roles and Responsibilities](roles.md)
- [Section VIII. Industry Engagement](industry.md)
- [Section IX. Implementation](implementation.md)
- [Section X. Rescissions](rescissions.md)
- [Section XI. Policy and Program Implementation Assistance](assistance.md)

---

[^1]:
    https://bidenwhitehouse.archives.gov/wp-content/uploads/legacy_drupal_files/omb/assets/egov_docs/fedrampmemo.pdf

[^2]:
    Pub. L. No. 117-263, § 5921 (2022), _codified in part at_ 44 U.S.C. §§
    3607-16.
