# FedRAMP for Agency Buyers: Authorization Process and Cloud Service Selection (Intermediate) Course Canonical URL: ## Overview FedRAMP reshaped how federal agencies buy and run cloud services, requiring an authorized security package, shared responsibility documentation, and continuing compliance for any cloud service that touches federal data. This intermediate course gives federal program managers, contracting officers, ISSOs, and security teams what they need in practice: choosing FedRAMP-authorized services, reviewing security packages, driving the Agency Authorization-to-Operate process, working out shared responsibility, and sustaining continuous monitoring compliance. It is the prerequisite for the Advanced course in the FedRAMP for Agency Buyers Bootcamp Package. This course teaches the FedRAMP Rev 5 baseline that agencies operate under today. FedRAMP 20x certification and Rev 5-to-20x transition planning are covered in the companion course, FedRAMP Modernization: Transitioning from Rev5 to 20x & CR26. ## What you'll learn - Explain the FedRAMP authorization framework, contrasting the JAB and Agency authorization paths and covering impact levels and continuous monitoring obligations. - Search the FedRAMP Marketplace with purpose and weigh authorized cloud services against risk-informed selection criteria. - Review a FedRAMP security package (SSP, SAR, POA&M) and judge how well it fits agency mission requirements. - Work out and document what the agency owns versus what the cloud service provider owns, family by family. - Drive the agency ATO process for a FedRAMP-authorized service, including implementation of customer responsibilities. - Run the FedRAMP continuous monitoring lifecycle: monthly vulnerability scans, annual assessments, and significant change notifications. - Respond to cloud security incidents under FedRAMP's shared incident response obligations. - Apply FedRAMP requirements to multi-cloud environments, third-party integrations, and services that are not in the FedRAMP Marketplace. ## Curriculum #### Module 1: FedRAMP Authorization Framework and Policy Landscape - FedRAMP Modernization Act (2022): statutory authority, PMO structure, and accelerated authorization requirements. - Authorization paths: JAB Provisional ATO, Agency ATO, and FedRAMP Connect program. - FedRAMP impact levels: Low, Moderate, High, and LI-SaaS, including selection criteria and compliance implications. - Cloud service provider obligations: continuous monitoring, significant change notification, and annual assessment requirements. - FedRAMP Rev 5 transition: 800-53 Rev 5 alignment timeline and new control requirements. #### Module 2: FedRAMP Marketplace – Service Evaluation and Risk-Informed Selection - FedRAMP Marketplace navigation: search criteria, authorization status indicators, and package availability. - Evaluating authorized service listings: CSP contact information, authorization date, 3PAO name, and package currency. - Risk-informed cloud service selection: aligning impact level with data classification, user population, and mission criticality. - Comparing CSP security postures: using SAR findings and POA&M aging as selection inputs. - Procurement integration: incorporating FedRAMP requirements into RFIs, RFPs, and contract evaluation criteria. #### Module 3: FedRAMP Security Package Review – SSP, SAR, and POA&M - FedRAMP SSP structure: system description, boundary diagram, control implementation statements, and customer responsibility matrix. - Reviewing control implementation quality: what to look for in CSP-provided vs. customer-responsible control sections. - Security Assessment Report (SAR) analysis: finding severity distribution, 3PAO methodology, and open risk items. - POA&M review: aging items, false positive justifications, milestone credibility, and risk acceptance documentation. - Package red flags: indicators of inadequate security, stale documentation, or assessment scope limitations. #### Module 4: Shared Responsibility – Control Inheritance and Customer Obligations - FedRAMP shared responsibility model: inherited, shared, and customer-owned controls. - Customer Responsibility Matrix (CRM): how to read it, what it requires agencies to implement. - Inheriting controls from IaaS/PaaS to SaaS: multi-tier inheritance chains and documentation requirements. - Customer-responsible control implementation: commonly missed controls (AC-2, AU-2, IR-6). - Documenting inherited controls in the agency SSP: required detail level. #### Module 5: Agency ATO Process for FedRAMP-Authorized Services - Agency ATO leverage: using the FedRAMP package as the foundation, distinguishing what’s inherited from what’s new. - Residual risk identification and agency risk acceptance: what the AO is accepting. - System Security Plan additions: agency-specific controls, boundary additions, and data flow documentation. - Security Assessment scope for agency ATOs: what requires reassessment vs. what can leverage 3PAO work. - ATO documentation requirements: FedRAMP-specific elements for agency authorization packages. #### Module 6: FedRAMP Continuous Monitoring – Vulnerability Management and Annual Assessments - FedRAMP continuous monitoring requirements: monthly vulnerability scans, annual penetration testing, and configuration compliance. - Reviewing CSP continuous monitoring deliverables: what agencies should verify in monthly scan results. - Significant change notifications: what triggers a notification and agency review obligations. - Annual assessment cycle: 3PAO scope, methodology, and year-over-year changes. - CSP non-compliance: escalation procedures and revocation of agency authorization. #### Module 7: Cloud Incident Response Under FedRAMP Shared Obligations - FedRAMP incident reporting requirements: 1-hour detection notification and US-CERT reporting elements. - Shared incident response: what agencies do vs. what CSPs do, including roles, timelines, and escalation procedures. - Evidence preservation in cloud incidents: cloud-specific forensics challenges and CSP cooperation requirements. - Agency obligations when a CSP has an incident: data breach notification and alternative processing. - Coordinating with CISA and US-CERT during a cloud security incident affecting federal data. #### Module 8: Multi-Cloud, Integration Scenarios, and FedRAMP Compliance Capstone - Multi-cloud and hybrid environments: authorization strategy for complex deployment architectures. - FedRAMP and AI/ML services: emerging requirements for cloud-based AI platforms processing federal data, as a preview of the Advanced course. - Containerized workloads: boundary documentation challenges, as a preview of the Advanced course. - Third-party APIs and integrations: FedRAMP applicability and inherited risk. ## Schedule - Jan 14, 2027 – Jan 15, 2027 — Live Online - Feb 9, 2027 – Feb 10, 2027 — Live Online - Mar 31, 2027 – Apr 1, 2027 — Live Online - Apr 28, 2027 – Apr 29, 2027 — Live Online - May 13, 2027 – May 14, 2027 — Live Online - Jun 9, 2027 – Jun 10, 2027 — Live Online - Jul 21, 2027 – Jul 22, 2027 — Live Online ## Instructors ### Wes Bryan — Instructor Wes Bryan resides in Gainesville, Florida, and has built his career around technology, education, and helping others understand complex subjects. He values continuous learning, clear communication, and practical problem-solving. Outside of work, Wesley enjoys running, hiking, fishing, and spending time outdoors. He also has a strong interest in music and literature, enjoys reading both fiction and nonfiction, as well as playing guitar. ### Chuck Moore — Instructor With more than 25 years of experience in IT and cybersecurity, Chuck has built a career on a strong foundation in security, networking, help desk operations, and technical training. He has helped organizations strengthen their security posture by identifying vulnerabilities, conducting threat assessments, implementing security controls, and ensuring compliance with industry standards. Combining extensive technical expertise with a passion for education, Chuck equips professionals with the knowledge and practical skills needed to recognize risks, risks and respond effectively. ## Pricing **Tuition:** $1049