If you’re asking this question, it’s likely you’ve stumbled onto this support article to check out what Drata has to offer with regards to FedRAMP.

Deciding whether to pursue FedRAMP is far more nuanced than deciding to get a SOC 2 attestation or to be GDPR-compliant. Achieving FedRAMP compliance and authorization to operate (ATO) requires a significant amount of time; typically 1-3 years from starting the process to obtaining an ATO. It also has a high cost, often a million dollars or more. A strong indication that the FedRAMP path may be right for your organization is if one of your current customers or prospects is a federal government agency, and mandates a FedRAMP ATO; even better if they are willing to officially sponsor your company through the FedRAMP authorization process.

If you’d like to learn more about the process of achieving FedRAMP compliance, check out our blog post that gives a comprehensive guide to FedRAMP.

If you’ve already started to pursue FedRAMP and are using Drata to help manage your efforts, the rest of this article is for you!

If you need to get familiar with frameworks in general, this article is a great place to start.

We also have a frameworks section of our help center for you to get context on all things related to managing your frameworks.

As part of our FedRAMP framework, we allow you to change between the LI-SaaS, Low, Moderate, and High baselines. One unique way that FedRAMP approaches the requirements included in their framework is that the very nature of the requirement may change as the baseline changes, through set parameters and additional requirements which modify the original NIST 800-53r5 controls. When using Drata, this means that the requirement may also have different controls mapped to it at different baseline settings. This is why we provide the control mappings only after the baseline is selected. If you were to change baselines at any point, the controls mapped to those requirements would change as well.

Parameters are pre-defined values set by FedRAMP to modify NIST 800-53r5 controls, on which FedRAMP is based, to make the requirements more strict. Through the use of OSCAL, which Drata’s framework is built on, these set values are dynamically selected according to your selected baseline. Additionally, parameters that have not been explicitly set by FedRAMP, allow you to select or write in the specific aspects that are true for your FedRAMP compliance program. Typically, these parameters are more strict the higher the baseline. In essence, defining your parameters helps to define the details of your FedRAMP compliance program.

The FedRAMP framework page includes a Parameters filter to easily see which requirements have and have not been completed. NOTE: Requirement readiness is not impacted by parameter completeness, therefore a requirement with incomplete parameters might still be “ready”.

When you’re getting started with the FedRAMP framework, one of the first things you’ll do is complete the parameters that have not been set automatically, for each of the requirements in your chosen baseline. We like to refer to this process as compliance “Mad Libs” because completing these is much like the nostalgic word game.

There will be an edit button on any requirement that has parameters that need to be completed.

Sometimes, there are no parameters on a specific requirement. Other times, there is nothing to edit because the requirement is at a baseline where the parameters are selected on your behalf because of what FedRAMP stipulates. In this case, you’ll see an indication that there is nothing to edit on that requirement.

Drata does not currently have a FedRAMP ATO, nor are we planning to pursue a FedRAMP ATO in the foreseeable future. However, we are officially NIST 800-171 compliant.

Why is this important?

Our compliance with NIST 800-171 enables you to use Drata to store evidence that contains indirect impact data and metadata related to the federal government or government agencies. However, since we do not have a FedRAMP ATO, it means that direct impact data or metadata related to the federal government or government agencies cannot be stored in Drata; this type of evidence must be stored in FedRAMP-authorized systems. That said, evidence that contains direct impact data can be maintained alongside all other evidence in Drata’s evidence library by providing the URL to where the evidence resides externally.

Drata’s Evidence library has two options; you can either upload a file, or provide a link to a URL to where evidence is externally stored. Use the URL option to track evidence containing direct impact data in Drata.

Drata automatically maps monitoring tests to DCF controls, however, some of these tests could inadvertently bring in direct impact data into Drata, depending on the connections you have enabled. We recommend reviewing the following monitoring tests to evaluate if any of them could bring in direct impact data. If you find that any of these tests bring in direct impact data, we strongly urge you to disable those tests.