What FedRAMP covers, and what it does not
A visual guide to FedRAMP's scope under OMB memorandum M-24-15: the four questions, the six exclusions, and FedRAMP's own in-scope and out-of-scope examples, with the reason for each.
By FedXchange ·
Not every cloud service an agency uses needs certification from the Federal Risk and Authorization Management Program (FedRAMP). Office of Management and Budget (OMB) memorandum M-24-15, issued July 25, 2024, sets FedRAMP's scope and lists what falls outside it. FedRAMP's scope page puts that guidance into practice, with tests and real examples. This post lays it out as pictures: what is in scope, what is out, and why.
One rule comes first. FedRAMP says: "Only a federal agency can determine if their use case for a cloud service falls within the scope of FedRAMP." A provider can use the guidance to decide whether to seek certification. But scope depends on how an agency uses a service, not on the service alone. The same tool can be in scope for one use and out of scope for another.
What is in scope
FedRAMP covers cloud computing products and services that create, collect, process, store, or maintain federal information on behalf of an agency, unless an exclusion applies. The service model does not decide it. Infrastructure, platforms, and software are all in scope when they hold federal information for an agency.
Infrastructure as a service (IaaS)
In scope
Computing, storage, and networks that hold or process federal information for an agency.
Platform as a service (PaaS)
In scope
Platforms an agency builds on, when they store or process federal information for it.
Software as a service (SaaS)
In scope
Applications that collect, process, or keep federal information on an agency's behalf.
Shared services with shared responsibility
In scope
A service offered to many agencies, where the provider and each agency share the security work.
Source: OMB memorandum M-24-15, as published on FedRAMP's scope page.
Four questions that point the way
FedRAMP gives agencies four questions about a planned use. If every answer is yes, the use is in scope. If every answer is no, it is out of scope. If the answers are mixed, the case is harder, and the category guidance below decides it.
Source: FedRAMP scope page, "Agency use case indicators."
Read the steps as text
- Is it part of the agency's information duties?. Does the planned use fall within the responsibilities of agencies under 44 U.S. Code § 3506, such as managing federal information?
- Does it need an agency tenant or central administration?. Does the agency need its own tenant, or settings that someone configures and maintains for the agency?
- Will it connect to the agency's security services?. Will it plug into identity and access management, single sign-on, security information and event management (SIEM), or secure access service edge?
- Can other agencies use it too?. Is the service available to several agencies or third parties, so that other agencies could reasonably use it?
- Read the answers. All yes: in scope. All no: out of scope. Mixed: use the category guidance and its examples.
The six exclusions in M-24-15
M-24-15 excludes six kinds of use. The FedRAMP Director can make exceptions with OMB's approval, and the FedRAMP Board can add categories with the Federal Chief Information Officer's agreement.
Single-agency systems
Out of scope
Systems one agency uses for its own work on cloud infrastructure or a platform, not offered as a shared service and not run under a shared responsibility model.
Social media and communications
Out of scope
Platforms used under the agency's social media policies, mainly to talk with the public.
Search engines
Out of scope
Services that find public information and do not collect or keep federal information for the agency.
Information providers
Out of scope
Widely available services that give agencies commercial information and do not collect federal information.
Negligible-risk services
Out of scope
Ancillary services whose compromise would pose negligible risk, such as outside measurements or services that only read public data.
Others the FedRAMP Board names
Out of scope
Categories the Board identifies, with the Federal Chief Information Officer's agreement.
Source: OMB memorandum M-24-15, as published on FedRAMP's scope page.
Each exclusion, with the line that decides it
For each category, FedRAMP gives a test and examples on both sides of the line. The reason is nearly always the same: does the service hold sensitive federal information for the agency, and does the agency share security work with the provider?
Single-agency systems
The test: one agency builds and manages the system, or someone does it for that agency. It runs on cloud infrastructure not shared with other agencies. Other agencies reach it only as ordinary internet users.
USDA AgCloud Managed Platform Services
In scope
It works under a shared responsibility model with its customer agencies, so they must authorize it like any commercial shared service.
Data.gov
Out of scope
General Services Administration (GSA) keeps full responsibility for it and authorizes it alone. Other agencies use it, but they share none of its security work.
Vendor software in an agency's own tenant
Out of scope
The IaaS or PaaS that hosts the tenant is in scope; the software the agency installs and runs there is not.
Source: FedRAMP scope page, "Single Agency Systems."
Social media and communications
The test: the agency uses the service mainly to communicate with the public. What it shares is meant for public release. The service does not hold sensitive agency information.
Agency social media accounts
Out of scope
They carry public information, including built-in AI features that do not answer on the agency's behalf.
Scheduling tools such as Hootsuite and Buffer
Out of scope
Out of scope when they only schedule public, non-sensitive posts.
Newsletters, press releases, and public alerts
Out of scope
The content is meant for the public.
Internal or cross-agency messaging with sensitive information
In scope
Sensitive federal information with strict access control needs a FedRAMP certified service.
Source: FedRAMP scope page, "Social Media & Communications."
Search engines
The test: the service does not collect or keep federal information for the agency, and users are told not to enter sensitive information.
Public web search and public AI chatbots
Out of scope
Out of scope when used only with public or non-sensitive information.
AI coding assistants on public code
Out of scope
Out of scope when the repositories are entirely public, because the information is already public.
AI coding assistants on private code
In scope
In scope when used on private, access-controlled repositories.
Internal search over agency data
In scope
In scope when it indexes and keeps non-public federal information.
Source: FedRAMP scope page, "Search Engines."
Information providers
The test: the provider sells to agencies and the public alike. It may briefly handle non-sensitive details, such as a name or address, and keep records of requests. The agency does not expect it to keep or use that information after the transaction.
General training platforms
Out of scope
FedRAMP names Udemy, Coursera, KnowBe4, Skillsoft, and Ninjio when used for general training.
Public attack surface search
Out of scope
FedRAMP names Shodan, Censys, and similar services, when used without privileged access or non-public agency information.
Business intelligence for vendor checks
Out of scope
FedRAMP names WireScreen, used for non-sensitive vendor risk or grant research.
Address checks that keep nothing
Out of scope
An address validation service that returns a match and discards the data.
Commercial trust centers
Out of scope
An agency reading security information there is out of scope. The trust center may still need certification as part of a cloud service's own assessment.
Identity verification that keeps personal data
In scope
A service that collects and stores federal personally identifiable information for identity proofing and later review.
Source: FedRAMP scope page, "Information Providers."
Negligible-risk services
The test: a breach would have an insignificant effect on the agency's operations, assets, or people.
Basic CAPTCHA on public sites
Out of scope
Out of scope on public-facing, non-sensitive sites.
Outside uptime checks
Out of scope
Out of scope when it watches a non-critical public website or API without taking in sensitive data.
Font libraries
Out of scope
FedRAMP lists them among its examples: a compromise would have an insignificant effect on the agency.
Application performance monitoring with internal access
In scope
In scope when it collects internal logs and traces through agents or privileged access to agency systems.
Source: FedRAMP scope page, "Negligible Risk Services."
The pattern behind the rationales
Across every category, FedRAMP draws the line in the same three places:
- Federal information. A service that collects, keeps, or indexes non-public federal information on the agency's behalf is in scope. A service that only sees public information, or briefly handles a name or address and keeps nothing the agency relies on, is usually out.
- Shared responsibility. When the provider and the agency share security work, as with a shared service or a multi-tenant platform, the service is in scope. When one agency or one provider carries all of it, it usually is not.
- Access and integration. A service with privileged access to agency systems, or one wired into the agency's identity and monitoring tools, is in scope even if it looks like a simple utility.
Out of scope does not mean unmanaged. An agency still decides whether to use a service, under its own policies and risk decisions. M-24-15 only decides whether FedRAMP certification is the expected route.
What to do with this
- Write down your scope decision and the answers to the four questions for every cloud service you use. FedRAMP says the decision is yours, so keep the record.
- Recheck the decision when the use changes. A coding assistant on public code is out of scope. The same assistant on private code is in scope.
- For services in scope, use FedRAMP certified offerings. The FedXchange Marketplace tracker lists every certified offering.
Sources
- FedRAMP, Scope of FedRAMP, including its reproduction of OMB memorandum M-24-15's scope guidance and its category tests and examples.
- OMB, Memorandum M-24-15, Modernizing the Federal Risk and Authorization Management Program, July 25, 2024.
- 44 U.S. Code § 3506, federal agency responsibilities for information resources management.
Get new posts and federal governance by email
A weekly email on Fridays, an alert on the day the watch finds something new, or both. Free.