%201.svg)
HIPAA Compliance Checklist for 2025
Selling SaaS to US federal agencies requires more than a good product. Vendors must also demonstrate that their cloud services meet applicable security requirements for protecting federal information. This is where FedRAMP compliance becomes important.
According to FedRAMP's FY2026 year-end report, the program ended fiscal year 2026 with 538 certified cloud service offerings, including 92 new certifications issued during the year.
For SaaS vendors, understanding the requirements early helps identify security gaps, estimate costs, and choose an appropriate certification path.
This guide explains what FedRAMP requires, how the process works, and how vendors can prepare.
1. What Is FedRAMP Compliance?
FedRAMP (Federal Risk and Authorization Management Program) is a US government-wide program that standardizes security assessment, authorization, and continuous monitoring for cloud products and services used by federal agencies.
FedRAMP compliance means meeting the applicable security requirements through implemented controls, documented evidence, assessment, and ongoing oversight. The exact requirements depend on the service's scope and the applicable certification pathway.
Using a FedRAMP-certified cloud infrastructure provider does not automatically certify a SaaS application built on that infrastructure. Vendors must address the security responsibilities applicable to their own service.
2. Why Does FedRAMP Compliance Matter for SaaS Vendors?
For SaaS vendors targeting federal agencies, FedRAMP certification can help meet the security requirements involved in selling cloud services to the government. It also influences how vendors prepare their products and manage security risks.
- Access to federal opportunities: Agencies may require an applicable FedRAMP certification or status before using a cloud service. Meeting these requirements can help vendors compete for relevant contracts, although certification does not guarantee a contract.
- Stronger security practices: The process requires vendors to address gaps in access management, data protection, vulnerability remediation, and incident response.
- Evidence for security reviews: Documented controls and assessment results give agencies evidence to evaluate a service's security rather than relying solely on vendor claims.
- Ongoing accountability: Monitoring, remediation, and required reporting help vendors maintain security as their products evolve.
Pursuing FedRAMP requires sustained investment. Vendors should evaluate their target customers, intended federal use cases, and applicable requirements before committing to a certification path.
3. Understanding FedRAMP Certification Classes
FedRAMP's 2026 framework uses Certification Classes A, B, C, and D to represent progressively greater levels of assurance and commitment to federal customers. These classes should not be treated simply as a direct replacement for the former Low, Moderate, and High labels.
According to FedRAMP's certification class guidance, the classes differ in the assurance information they provide for agency decisions.
The appropriate class depends on the agency's needs, intended use, and the vendor's readiness. Higher classes involve greater assurance commitments and investment, so vendors should not assume they need the highest class from the outset.
4. What Are the Key FedRAMP Compliance Requirements?
FedRAMP requirements depend on the applicable pathway. Rev. 5-based assessments use relevant NIST SP 800-53 security controls, while FedRAMP 20x uses its defined practices and assurance requirements. Both approaches require vendors to demonstrate that their security measures are implemented and supported by evidence.
A. Identity and Access Management
Vendors must control who can access their systems and what permissions each user receives. This includes appropriate authentication, least-privilege access, administrative safeguards, and regular access reviews.
For example, a former employee should not retain production access because their account was overlooked during offboarding. Access records and review evidence help demonstrate that permissions are managed consistently.
B. Data Protection and Encryption
Vendors must protect federal information as it is stored, transmitted, accessed, and backed up. Depending on the applicable requirements, this can involve encryption, key management, secure data handling, and appropriate separation of sensitive information.
Mapping data flows across applications, databases, backups, and integrations helps vendors identify where information travels and which components fall within the service's security boundary.
C. Vulnerability Management and Secure Configuration
Vendors need processes to identify vulnerabilities, assess their severity, maintain secure configurations, and address findings within applicable timelines.
Finding a vulnerability is only the first step. Teams must assign an owner, prioritize remediation, test the fix, and document the outcome. Unresolved findings should be managed according to applicable risk-handling and reporting requirements.
D. Audit Logging and Incident Response
Security logs help vendors investigate suspicious activity, trace administrative changes, and determine the scope of an incident. Vendors need appropriate logging coverage, procedures for reviewing relevant events, and clearly defined incident response responsibilities.
They must also follow applicable escalation and reporting requirements. Collecting logs alone is insufficient if teams cannot use them to investigate events and respond effectively.
E. Security Documentation and Assessment
Vendors must document how applicable security requirements are implemented and provide evidence to support evaluation. Depending on the pathway, this may include a System Security Plan (SSP), architecture documentation, control evidence, assessment findings, and remediation records.
Independent assessment is required where the applicable pathway specifies it. A FedRAMP-recognized Third Party Assessment Organization (3PAO) is relevant to pathways that use that assessment model.
Documentation must reflect the actual production environment. A policy describing a control is not enough if the control is not implemented or the vendor cannot demonstrate that it works.
5. How Does the FedRAMP Authorization Process Work?
The process depends on the certification type, class, and pathway. Vendors should consult the FedRAMP Consolidated Rules for 2026 before planning their approach.
Step 1: Choose the Applicable Pathway
Determine whether the service should pursue FedRAMP 20x or an eligible Rev. 5 route. Consider existing agency sponsorship, the intended use case, the required class, and current transition deadlines.
As of October 2026, the Consolidated Rules are available for adoption. They become mandatory for Rev. 5 certification applications and ongoing certification from January 1, 2027, subject to applicable transition provisions. FedRAMP plans to stop accepting new Rev. 5 certification applications on June 11, 2027.
Step 2: Define the Service Scope and Assess Readiness
Identify the SaaS offering, the federal information it will handle, and the systems and dependencies supporting it. Map application components, hosting infrastructure, integrations, and relevant data flows.
Then review the applicable requirements to identify security gaps. A readiness assessment helps prioritize work, but it does not itself grant certification.
Step 3: Implement Controls and Prepare Evidence
Address identified gaps and prepare the documentation required by the selected pathway. This may include the SSP, architecture details, control implementation evidence, and supporting assessment materials.
The documents should match the actual service configuration. Differences between documented controls and production behavior can lead to findings and additional remediation.
Step 4: Complete the Required Assessment and Review
Complete the assessment and validation activities required by the applicable pathway. Where independent assessment is required, the recognized assessment service evaluates the relevant controls and records its findings.
Vendors must address findings and submit the required certification materials. Review and decision-making steps differ by pathway, so not every service follows an identical sequence.
Step 5: Obtain Certification and Meet Agency Requirements
Once the applicable process is complete, the service receives the relevant certification outcome. Where an agency Authorization to Operate (ATO) is required, the agency makes its own risk-based decision about using the service.
Certification does not end the vendor's responsibilities. Ongoing monitoring, remediation, reporting, and change management remain important parts of maintaining the service's security posture.
6. How Much Does FedRAMP Compliance Cost, and How Long Does It Take?
The cost and timeline depend on the service's security maturity, system scope, applicable pathway, and the work needed to address gaps. A vendor with established controls and reliable documentation may need less preparation than one building these capabilities from scratch.
The main cost drivers include:
- Security remediation: Strengthening access controls, logging, configurations, and vulnerability management may require significant engineering work.
- Assessment services: Independent assessments, where required, involve testing, findings management, and follow-up.
- Documentation and internal resources: Security, engineering, IT, and compliance teams must prepare evidence and coordinate reviews.
- Ongoing compliance: Vendors must budget for monitoring, remediation, reporting, and recurring assessment activities where applicable.
Timelines also depend on assessment scheduling and the time needed to resolve findings. Incomplete documentation or significant security gaps can delay progress.
Before committing to a budget, vendors should define their service scope, confirm the applicable pathway, and complete a readiness assessment. This provides a more realistic estimate than relying on a universal cost or timeline.
7. Common FedRAMP Compliance Challenges for SaaS Vendors and How to Overcome Them
Several issues can make certification more difficult than expected.
A. Unclear System Boundaries
A SaaS product may rely on databases, APIs, infrastructure, and external integrations. Overlooking a component that processes or protects federal information can create gaps in scope and documentation.
How to address it: Map data flows and dependencies before formal assessment begins.
B. Incomplete Security Evidence
A policy may describe a control without proving that it operates effectively. For example, a vendor may require access reviews but lack records showing that they occurred.
How to address it: Assign control owners and maintain evidence that reflects actual operating practices.
C. Confusion About Third-Party Responsibilities
A certified infrastructure provider does not automatically certify the vendor's application. Vendors must understand which controls they inherit and which remain their responsibility.
How to address it: Document shared responsibilities and assess how integrations and external services affect the intended scope.
D. Underestimated Remediation Work
Assessment findings may require changes to application architecture, configurations, or operating procedures. These changes can compete with product development priorities.
How to address it: Prioritize gaps by risk and applicable requirements, assign owners, and track remediation through verified closure. .
8. FedRAMP Compliance Readiness Checklist for SaaS Vendors
Before pursuing certification, use this checklist to identify foundational gaps.
- Define the service boundary: Map the application, infrastructure, integrations, and data flows.
- Confirm the pathway: Verify the intended federal use case, applicable class, and current requirements.
- Review security controls: Identify gaps in access management, encryption, logging, vulnerability management, and incident response.
- Assess third-party dependencies: Document inherited controls and vendor responsibilities.
- Prepare evidence: Ensure security documentation reflects the production environment.
- Assign control owners: Establish responsibility for implementation, evidence, remediation, and reporting.
- Plan assessment and remediation: Estimate the work and resources required for the selected pathway.
- Establish ongoing monitoring: Prepare for vulnerability tracking, reporting, and change management.
Start with foundational issues, such as an unclear system boundary or major security gaps, before investing heavily in assessment preparation. This checklist supports readiness planning but does not replace official pathway requirements or guarantee certification.
9. How SaaS Governance Supports FedRAMP Readiness
FedRAMP focuses on the security of a cloud service used by federal agencies. SaaS governance addresses a related but different challenge: managing applications, identities, access, and third-party relationships across an organization's environment.
SaaS governance can support relevant operational workflows in three ways:
- Application visibility: An accurate inventory helps teams identify applications and third-party dependencies that may need review.
- Access governance: Current records of users, permissions, and application ownership can support access reviews and accountability.
- Risk coordination: Clear ownership across IT, security, procurement, and compliance teams helps track issues and remediation.
CloudEagle.ai supports SaaS and AI governance workflows, including application visibility and access governance. These capabilities can complement broader security practices, but they do not replace FedRAMP-specific controls, assessments, or certification requirements.
Turn FedRAMP Requirements Into Daily Controls
10. Make FedRAMP Compliance an Ongoing Security Commitment
FedRAMP certification requires SaaS vendors to select the appropriate pathway, implement applicable safeguards, provide evidence, and maintain their security posture over time.
A readiness assessment helps identify gaps early, while effective governance supports visibility and accountability across applications and access. For vendors pursuing federal opportunities, the goal is to make security part of everyday operations, not a one-time effort to meet procurement requirements.
11. Frequently Asked Questions
1. What are the main FedRAMP compliance requirements for SaaS vendors?
Requirements depend on the applicable pathway and may cover access management, data protection, vulnerability management, incident response, logging, documentation, assessment, and ongoing monitoring. Vendors must verify the rules that apply to their service.
2. How long does FedRAMP certification take?
The timeline depends on security maturity, system scope, the selected pathway, assessment scheduling, and remediation needs. A readiness assessment helps estimate the work involved, but there is no universal timeline for every vendor.
3. How much does FedRAMP compliance cost?
Costs vary with engineering changes, documentation, assessment services, internal resources, and ongoing monitoring. Vendors should budget for both initial certification and continuing obligations.
4. Does using a FedRAMP-certified cloud provider make a SaaS product certified?
No. The SaaS vendor must address the requirements applicable to its own service, including its scope, application controls, integrations, and shared responsibilities.
5. How can SaaS governance support FedRAMP readiness?
SaaS governance can improve visibility into applications, users, access, and third-party relationships. These workflows can support relevant reviews and risk management, but they do not replace FedRAMP-specific security controls, assessments, or certification decisions.
Make Compliance Part of Everyday Operations
.avif)
.avif)
.avif)
.png)
.avif)
.avif)
.avif)
