FedRAMP Authorization Act (2022)

Summary

The law puts on a statutory footing the Federal Risk and Authorization Management Program (FedRAMP), which assesses and authorises the cloud services that US federal agencies use to process unclassified information. The programme is run by the General Services Administration, with a FedRAMP Board, accredited independent assessors and a Federal Secure Cloud Advisory Committee. It establishes a presumption of adequacy: a FedRAMP authorisation should be reusable by other agencies without repeating the assessment. The Office of Management and Budget guides implementation and the Department of Homeland Security provides security support.

Information

Jurisdiction

United States

Issuing body

United States Congress

Type

Law

Available languages

English

Topics

• Cloud computing
• Digital public administration
• Certification

Notes

Section 5921 is in Division E (Title LIX) of the 2023 defence authorization act; the text is also reproduced on the official fedramp.gov site. The law provides for its own sunset five years after enactment, on 23 December 2027, unless Congress extends it. The required security controls are based on the NIST SP 800-53 catalogue; since 2025 the programme has been moving to the new FedRAMP 20x process. The Consolidated Rules for 2026 (optional early adoption from 4 July 2026, mandatory from 1 January 2027) replace the FedRAMP Ready designation, no longer accepted after 28 July 2026, with Class A, B and C certifications; from 11 June 2027 no new Rev5 certifications will be accepted. The timeline is published on fedramp.gov.

United States Congress. (2022). FedRAMP Authorization Act (Section 5921 of the James M. Inhofe National Defense Authorization Act for Fiscal Year 2023) (Public Law 117-263, § 5921 (44 U.S.C. §§ 3607-3616)). https://www.govinfo.gov/app/details/PLAW-117publ263

United States Congress. "FedRAMP Authorization Act (Section 5921 of the James M. Inhofe National Defense Authorization Act for Fiscal Year 2023)." 23 December 2022. https://www.govinfo.gov/app/details/PLAW-117publ263.

@misc{us_fedramp_authorization_act_2022,
  author       = {{United States Congress}},
  title        = {{FedRAMP Authorization Act (Section 5921 of the James M. Inhofe National Defense Authorization Act for Fiscal Year 2023)}},
  year         = {2022},
  note         = {Public Law 117-263, § 5921 (44 U.S.C. §§ 3607-3616)},
  url          = {https://www.govinfo.gov/app/details/PLAW-117publ263},
  urldate      = {2026-10-29}
}