Annex
FedRAMP Sector Requirements Annex
This annex describes how a cloud service provider seeking US Federal Risk and Authorization Management Program (FedRAMP) authorization can use the core GRC library to demonstrate the control set, evidence, and operating expectations FedRAMP requires. The annex maps the library to FedRAMP baselines, identifies applicability triggers, describes the authorization routes, and lists the supplementary documentation FedRAMP requires beyond the library's baseline.
- Type
- Annex
- Version
- 0.0.19
- Date
- 2026-11-03
- Owner
- Chief Compliance Officer
- Approving authority
- Governance Library Maintainer
- Classification
- Public
- Confidentiality
- Public
- Category
- Compliance: Sector-Specific
- Review frequency
- Annual and upon material FedRAMP baseline, OMB guidance, or authorization status change
- Licence
- CC BY-SA 4.0
Read the full text on GitHub (opens in a new tab)
Outline
- Purpose
- Applicability triggers
- Authorization route selection
- Certification class selection
- Library coverage and gaps
- Operating expectations
- Framework alignment
- Limitations
Frameworks it maps to
- FedRAMP Rev5
- FedRAMP 20x
- NIST SP 800-53 Rev. 5
- NIST SP 800-37 Rev. 2
- NIST SP 800-171 / 800-172
- OMB M-22-09
- FIPS 199
- FIPS 200
- FIPS 140 (NIST CMVP)
Related documents
- compliance/
README.md (opens in a new tab) source - Legal and Regulatory Compliance Policycompliance
- Global Regulatory Applicability Registercompliance
- GRC Library Compliance Alignment Matrixcompliance
- Information Security Policysecurity
- Cloud Security Configuration Baselineoperations
- Supplier Security and Privacy Assurance Standardsupply-chain
Next
All Documents