Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

In the past, FedRAMP has used impact levels as a sort of classification system for cloud services that wish to work with the government in some capacity. The impact levels evaluate a cloud service provider (CSP) based on the sort of information they would be handling and the service they would provide to the government. They are classified across three axes: confidentiality, integrity, and availability.

FedRAMP as a program has been through a lot over the years it has existed. Different authorization paths, different requirements and standards, multiple rounds of streamlining and changes; it's been a rocky road. Things are starting to smooth out now that FedRAMP 20x is broadly available, but there's still a lot to learn or to question before you can be fully up to speed. So, let's talk about authorization and where we stand today.

Working on a government contract is a big deal for many businesses. It's also frequently the culmination of months (if not years) of effort in building, architecting, defining, and securing systems meant to handle the sensitive information the government needs you to handle. It would be miserable to miss a step and fail at the finish line, but it's surprisingly not too uncommon that it happens.

CMMC is vast and complex, but when you drill down to the heart of it, it's all about one thing: properly securing CUI. And yet that, in and of itself, is a problem. All CUI needs to be marked, which means if you receive CUI from your agency or prime, it needs to be properly marked. And it means if you produce CUI, you need to mark it properly yourself. How do you know what is and isn't CUI, and how do you mark it properly? What happens if you get it wrong?

When you read through the posts on the Ignyte blog focusing on CMMC, you'll see that just about everything we talk about, unless otherwise specified, refers to CMMC Level 2. This is because it's the impact level that the vast majority of DoD contractors are going to need. CMMC Level 1 is the lowest level, protecting the least sensitive of the sensitive information the government has to offer. If all you're handling is Federal Contract Information (FCI), Level 1 is enough for you.

CMMC is increasingly important for any company that is even tertiary to the Department of Defense and the defense industrial base. Prime contractors are prime targets, but even two, three, four, or more steps down the chain, CMMC may be mandatory. It's all about protecting information, after all. This means a lot of businesses are looking seriously at CMMC, and a lot of high-level executives are being asked to put their names on things they might not understand at a glance.

For most of the history of the FedRAMP program, it has been more or less isolated. Despite sharing much of the same cybersecurity DNA with other frameworks, like CMMC and ISO 27001, no formal reciprocity ever came into being.

FedRAMP has long been one of the more complex certifications you can achieve, but the rewards are well worth the effort. Validating your company's information security is a huge benefit, and on top of that, working with the government on sensitive contracts is a lucrative business venture. We do our best to explain various aspects of FedRAMP in plain English, to make it easier to figure out what your goals should be and where you should place your efforts.

FedRAMP moved POA&Ms to agencies and replaced them with Accepted Weaknesses under the 2026 rules. Cloud providers must evaluate vulnerabilities in context (criticality, reachability, exploitability, detectability, prevalence, privilege, proximity, known threats), report results in JSON with PAIN N1–N5 ratings, and assume attacker automation. Remediate high PAIN, internet reachable risks fast; low PAIN risks can be accepted. Machine-readable data and platforms can help meet requirements.

CMMC is a major cost and time commitment, often months long and may cost tens or hundreds of thousands of dollars. A C3PAO checks 320 items tied to 110 NIST SP 800-171 controls. Outcomes: full approval, conditional approval with POA&Ms (usually 180 days), or denial. If denied, fix control gaps, update the SSP and evidence, then reapply. Use proper tools and avoid assessor conflict. CMMC is unquestionably a huge investment.