US FEDERAL CLOUD AUTHORISATION
The authorisation route for cloud service providers selling to US federal agencies.
01
Cloud service providers that want to sell to US federal agencies. The authorisation rests on NIST SP 800-53 at a Low, Moderate or High baseline, is assessed by an accredited Third Party Assessment Organisation (3PAO), and is granted by a federal agency or the FedRAMP programme. For a UK SaaS company it is a question only once a US federal buyer is in view, and the cost and time are well above ISO 27001 or SOC 2.
02
A scoping conversation on whether FedRAMP is the right ask, then a control mapping from the company's ISO 27001 or SOC 2 evidence to the 800-53 baseline, and the gap list the 3PAO will test. Goldline does not run the 3PAO assessment and does not hold the authorisation conversation with the agency.
03
A federal agency, on a 3PAO's assessment.
04
The ISO 27001 or SOC 2 evidence is the starting point for the 800-53 mapping.
05
Scoped on the diagnostic. Any third-party fee is paid direct.
Scoped on the diagnosticBring the contract, questionnaire or buyer request. The diagnostic establishes the scope and the evidence route.
We use cookies and similar technologies to measure how this site is used, to see which organisations visit and to measure our advertising. Until you choose, Google tags run in a consent-limited mode that sets no cookies. If you accept, we load Google Analytics 4 and Google Ads with cookies, PostHog, Plausible, Microsoft Clarity, which records session replays, and Apollo. Read our Cookies policy.