fedramp
starsforks
How to install fedramp?
sushegaad/claude-skills-governance-risk-and-compliance/fedramp
$npx -y skills add Sushegaad/Claude-Skills-Governance-Risk-and-Compliance --skill fedrampExpert guidance for FedRAMP certification and compliance under CR26 (FedRAMP Consolidated Rules for 2026). Use this skill whenever a user asks about FedRAMP authorization, ATO (Authority to Operate), cloud security for federal government, NIST SP 800-53 controls, CSP compliance,
SKILL.md
| 1 | # FedRAMP Certification Skill |
| 2 | |
| 3 | > **Last verified:** 2026-07-03 |
| 4 | |
| 5 | A comprehensive guide for helping users navigate FedRAMP authorization — from initial |
| 6 | readiness through ATO and ongoing continuous monitoring. |
| 7 | |
| 8 | ## Quick Reference: What Does the User Need? |
| 9 | |
| 10 | Identify the user's goal and jump to the appropriate section: |
| 11 | |
| 12 | | User Goal | Go To | |
| 13 | |---|---| |
| 14 | | "Are we ready for FedRAMP?" / gap assessment | → [Readiness & Gap Assessment](#1-readiness--gap-assessment) | |
| 15 | | Writing SSP, POA&M, SAR, SAP, or other docs | → [ATO Documentation](#2-ato-documentation) | |
| 16 | | "Which controls apply to us?" / control mapping | → [NIST 800-53 Control Mapping](#3-nist-800-53-control-mapping) | |
| 17 | | Cloud architecture / AWS/Azure/GCP config | → [Architecture Guidance](#4-architecture-guidance) | |
| 18 | | Already authorized, ongoing compliance | → [Continuous Monitoring](#5-continuous-monitoring) | |
| 19 | |
| 20 | --- |
| 21 | |
| 22 | ## Current FedRAMP State (as of July 2026 — CR26) |
| 23 | |
| 24 | > ⚠️ **CR26 (FedRAMP Consolidated Rules for 2026)**: FedRAMP has restructured its authorization framework. FIPS 199-based baseline labels (Low/Moderate/High/LI-SaaS) are replaced with **Certification Classes A–D** (per notice NTC-0004; CR26 rules valid through December 31, 2028). Class labels change the *names* of the baselines, not their requirements. CSPs already authorized under the old labels retain their authorization through a transition period in which old and new labels are linked. |
| 25 | |
| 26 | - **Baseline**: NIST SP 800-53 **Rev 5** (fully in effect) |
| 27 | - **Control counts** (Rev 5): Low ≈ 156, Moderate = 323, High = 421 (legacy references; CR26 class-based counts being published by PMO) |
| 28 | - **CR26 Certification Classes** (official mapping, NTC-0004): **A** = new pilot/transitional baseline (entry via external frameworks such as SOC 2 Type II through Program Certification; holders have a 2-year window to obtain B/C/D), **B** = current **LI-SaaS + Low** baselines, **C** = current **Moderate** baseline (majority of federal deployments, incl. CUI), **D** = current **High** baseline. |
| 29 | - **FedRAMP 20x**: Now the **primary authorization pathway** — continuous authorization, modular API-driven submissions, automated evidence collection. Traditional SSP/SAP/SAR templates remain for legacy paths. |
| 30 | - **FedRAMP Ready** designation: **Retires July 28, 2026**. CSPs currently in FedRAMP Ready status must transition to FedRAMP 20x or initiate a full authorization package. No new FedRAMP Ready designations are being issued. |
| 31 | - **JAB P-ATO**: Fully suspended; FedRAMP PMO is the sole authorization body. |
| 32 | - **OSCAL mandate**: RFC-0024 requires all CSPs to submit machine-readable OSCAL packages by **September 30, 2026**. |
| 33 | - **Security Inbox**: All authorized CSPs must maintain a dedicated Security Inbox (no CAPTCHAs or barriers) for urgent vulnerability directives — effective January 5, 2026. |
| 34 | - **Key templates updated**: SSP, SAR, SAP, POA&M, CIS/CRM, IIW, ISCP — all updated to align with Rev 5 (Dec 2024 releases). |
| 35 | |
| 36 | --- |
| 37 | |
| 38 | ## 1. Readiness & Gap Assessment |
| 39 | |
| 40 | ### Approach |
| 41 | 1. **Clarify scope** — Ask the user: What is the CSO (Cloud Service Offering)? IaaS/PaaS/SaaS? Target Certification Class under CR26? |
| 42 | 2. **Identify authorization path** — FedRAMP 20x (primary, preferred) vs. legacy Agency Authorization package (still available for complex systems during CR26 transition) |
| 43 | 3. **Run through the readiness checklist** — See `references/readiness-checklist.md` |
| 44 | 4. **Surface gaps** — Map current state to required controls; flag missing documentation, unimplemented controls, and architectural deficiencies |
| 45 | 5. **Prioritize** — Group gaps by: (a) blockers for readiness review, (b) items addressable before 3PAO assessment, (c) POA&M candidates |
| 46 | |
| 47 | > **FedRAMP Ready is retiring July 28, 2026.** If a CSP is currently pursuing FedRAMP Ready, advise them to pivot immediately to FedRAMP 20x or begin a full authorization package. |
| 48 | |
| 49 | ### Key Readiness Questions to Ask the User |
| 50 | - Are you targeting FedRAMP 20x (preferred) or a legacy authorization package? |
| 51 | - What cloud platform (AWS GovCloud, Azure Gov |
People who liked this also viewed
6 picksType
- entra-app-registrationGuides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. USE FOR: create app registration, register Azure AD app, configure OAuth, set up authentication, add API perSkillsJul 2026
- azure-complianceRun Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: SkillsJul 2026
- azure-rbacOfficial agent plugin providing skills and MCP server configurations for Azure scenarios.SkillsJul 2026
- better-auth-best-practicesAgent skill from better-auth/skillsSkillsJul 2026
- firebase-security-rules-auditorA skill to evaluate how secure Firestore security rules are. Use this when Firestore security rules are updated to ensure that the generated rules are extremely secure and robust.SkillsJul 2026
- audit-websiteAudit a website with the squirrelscan CLI and fix the findings in code. Runs SEO, performance, security, technical, content, accessibility, and 15 other rule categories (260+ rules), returns an LLM-opSkillsJul 2026
