External services
Every interconnection identified, risk-assessed and documented.
FedRAMP & GovRAMP readiness
FedRAMP authorization, engineered by people who build federal systems.
Most delays are decided before testing starts: a boundary drawn too wide, cryptography that isn’t FIPS-validated, an inventory that drifts. We find those problems early, engineer the fixes and walk into your 3PAO assessment with a package that matches reality.
- NIST SP 800-53 Rev 5
- FedRAMP Rev5 & 20x
- GovRAMP
- CMMC
- Who it is for
- SaaS, PaaS and IaaS providers selling to US government
- Basis
- FIPS 199, NIST SP 800-53 Rev 5, FedRAMP Rev5 and 20x
- Our role
- Boundary design, cloud security engineering, SSP authoring and pre-assessment testing
- Working with
- Your chosen 3PAO, your agency sponsor and your engineering teams
The challenge
Authorization is a boundary problem first.
Every FedRAMP answer depends on where the boundary sits. Draw it too wide and corporate IT falls into scope. Draw it carelessly and your external services become findings.
None of this can be fixed in documentation. Run FedRAMP as an architecture project that happens to produce documents.
01Boundary sprawl
Shared corporate services pulled into scope.
02External services
Third parties handling federal data without authorization.
03Non-validated crypto
Modules that are not FIPS 140-validated.
04Inventory drift
Ephemeral infrastructure that never matches the inventory.
05POA&M debt
Findings that age without milestones.
Outcomes
Ready means testing could start tomorrow.
01
A defensible boundary
The smallest scope that still captures every federal data path.
02
Engineering gaps closed
Cryptography, identity, logging and scanning fixed before formal testing.
03
A package that matches reality
An SSP your engineers recognize holds up in assessor interviews.
04
Continuous monitoring that lasts
Scanning, inventory and POA&M discipline, month after month.
Technical requirements
Where authorizations are won and lost.
The Rev 5 control families that drive most engineering effort.
FIPS 140 cryptography
Validated modules in an approved mode, in transit and at rest.
Phishing-resistant MFA
Strong authentication for privileged and federal users.
Scanning and inventory
Authenticated scans, container images included, reconciled to inventory every month.
Logging and monitoring
Defined events, retention and alerting, with evidence that someone reviews them.
Supply chain risk
New in Rev 5: supplier assessment and component provenance.
Interactive tool
Where does your service land?
A FIPS 199 categorizer. The highest impact rating across confidentiality, integrity and availability sets your baseline. Pick a profile or set the ratings yourself.
Illustrative profiles
Categorization follows FIPS 199 and NIST SP 800-60 and is agreed with your agency sponsor. Baseline sizes are approximate.
Authorization paths
Three routes to the public sector.
We plan around the rules in force when you submit, and build evidence that works on either federal path.
The established route: an agency sponsor, the full Rev 5 baseline, a 3PAO assessment and an agency Authorization to Operate.
FedRAMP plans to modernize Rev5 over time. We confirm the rules in force at the start of every engagement.
- 01Sponsor & categorizeSecure an agency partner. FIPS 199 sets the baseline.
- 02Build & documentImplement the controls, then write the SSP and attachments.
- 033PAO assessmentSAP, control testing, penetration test and SAR.
- 04Agency ATOThe agency accepts the risk and FedRAMP lists you on the Marketplace.
- 05Continuous monitoringMonthly scans and POA&M updates, plus an annual assessment.
Launched in 2025, 20x validates Key Security Indicators largely through machine-readable evidence rather than long narratives.
The 20x rules are still moving. We track every release so your evidence meets the version you submit against.
- 01Map to indicatorsTranslate your platform into the program’s KSIs.
- 02Automate evidenceMachine-readable validation drawn from configuration and pipelines.
- 03Independent validationAn accredited 3PAO confirms the evidence reflects reality.
- 04Continuous reportingAutomated reporting replaces annual document refreshes.
GovRAMP (formerly StateRAMP) gives state, local, tribal and education buyers one shared verification model, built on NIST SP 800-53 Rev 5.
GovRAMP sets its own statuses, security levels and fees. Most FedRAMP evidence carries straight across.
- 01Membership & levelJoin and confirm the security level your buyers require.
- 02AssessmentIndependent assessment that reuses your FedRAMP work.
- 03Verified statusA published status that procurement teams rely on.
The authorization package
Who writes what, and what we deliver.
The provider owns the documentation, the 3PAO tests it and the agency accepts the risk. We sit on your side of that line, from the first diagram to the final SAR.
| Artifact | Purpose | Owner | MarkTillson role |
|---|---|---|---|
| Readiness Assessment Report (RAR) | Proof the system is ready for authorization | 3PAO | Advisory: pre-assessment readiness review so the 3PAO finds nothing new |
| System Security Plan (SSP) | Boundary, architecture and how each control is implemented | Provider | Advisory: boundary design, implementation statements and responsibility matrix |
| SSP attachments | Policies, IR, contingency and configuration plans, inventory | Provider | Advisory: drafted to describe what your teams actually do |
| Security Assessment Plan & Report | Test plan, testing, findings and recommendation | 3PAO | Advisory: mock testing, evidence indexing and finding response |
| POA&M | Every open weakness with an owner and milestones | Provider | Advisory: process, deviation requests and monthly rhythm |
| Continuous monitoring | Monthly scans, inventory, annual assessment, change requests | Provider & 3PAO | Advisory: ConMon operations, change analysis and annual readiness |
Accreditation & scope
What we do, and what your 3PAO does
MarkTillson, as your readiness and engineering team
- Boundary, data-flow and inventory design
- Gap assessment against your Rev 5 baseline
- SSP, attachments and customer responsibility matrix
- Cloud security engineering: FIPS cryptography, identity, logging and scanning
- Mock assessment and penetration testing before formal testing
- POA&M and continuous monitoring operations
Your accredited 3PAO
- Readiness Assessment Report (RAR)
- Security Assessment Plan, control testing and SAR
- Annual and significant-change assessments
FedRAMP keeps assessment and advisory apart. We prepare and engineer; an independent, A2LA-accredited 3PAO assesses. Agencies grant authorizations; GovRAMP grants GovRAMP statuses.
Our approach
Architecture to authorization.
Our five-phase lifecycle, tuned for federal authorization.
- Discover
Boundary
Architecture, data flows, external services and a first categorization.
- Assess
Baseline gaps
Gaps ranked by engineering effort and assessment risk.
- Remediate
Engineer & write
Engineering sprints, with the SSP written as the work lands.
- Validate
Assessment
Readiness assessment, then formal testing and the SAR.
- Sustain
ConMon
Monthly operations, annual assessment and significant-change support.
Boundary and data-flow diagrams
Every component, port and connection that will be tested.
SSP and attachments
Implementation statements written with your engineers.
Cryptographic module register
Each module, its certificate and where it is enforced.
FedRAMP is an architecture project with a documentation output.
Never the other way round.
Framework mapping
How FedRAMP work carries across.
Most of the effort is reusable. Each program keeps its own scope and evidence rules.
| Control area | GovRAMP | CMMC / 800-171 | ISO/IEC 27001 | SOC 2 |
|---|---|---|---|---|
| Access control and identity (AC, IA) | Directly addressed | Directly addressed | Directly addressed | Directly addressed |
| Audit logging and monitoring (AU, SI-4) | Directly addressed | Directly addressed | Directly addressed | Directly addressed |
| Configuration management (CM) | Directly addressed | Directly addressed | Directly addressed | Partially addressed |
| FIPS 140-validated cryptography (SC-13) | Directly addressed | Directly addressed | Partially addressed | Not addressed– |
| Vulnerability scanning cadence (RA-5) | Directly addressed | Partially addressed | Partially addressed | Partially addressed |
| Continuous monitoring deliverables (CA-7) | Directly addressed | Not addressed– | Not addressed– | Not addressed– |
Directly addressed Partially addressed or different evidence expectations , Not a primary objective. CMMC has its own assessment rules, and cloud services that handle CUI need FedRAMP Moderate or equivalency as a separate requirement.
Industry considerations
Who pursues authorization, and why.
The most common applicants, and the most exposed to boundary sprawl. Many need a dedicated federal environment and a clear customer responsibility matrix.
Inherited controls, hardware supply chains and data provenance must be represented precisely. Agency buyers now ask about AI governance as well.
Cloud services that store CUI may need FedRAMP Moderate or equivalency on top of the contractor’s own CMMC obligations. We prepare both sides of that picture together, so one evidence set serves both.
State and local buyers increasingly ask for GovRAMP status. Much of it carries over from FedRAMP or ISO/IEC 27001 work.
Technical use cases
Engineering questions we resolve.
Scanning ephemeral workloads
Images scanned at build time and mapped to the running inventory.
FIPS endpoints and libraries
Validated modules running in approved mode, end to end.
Leveraging IaaS authorizations
Inherited, shared and provider controls documented precisely.
Shipping under ConMon
Significant-change decisions that don’t slow delivery.
Engagement journey
How an engagement runs.
-
01
Scoping
Architecture, sponsor and path.
OutputBoundary definition
-
02
Readiness
Assessment against your baseline.
OutputRAR or sequenced roadmap
-
03
Build
Remediation and package authoring.
OutputSSP and responsibility matrix
-
04
Assessment
Formal 3PAO testing.
OutputSAP and SAR
-
05
ConMon
Monthly rhythm and annual assessment.
OutputPOA&M and ConMon runbook
FAQs
Questions we are asked.
What role does MarkTillson play?
We are your readiness, engineering and advisory team. We design the boundary, close the engineering gaps, write the package with your engineers and rehearse the assessment, so your 3PAO tests a system that is already ready.
Do you work with our 3PAO?
Yes, every week of the engagement if you want. FedRAMP keeps advisory and assessment independent, so we coordinate with the 3PAO you select and answer their questions with evidence, not narrative.
Rev5 or FedRAMP 20x?
It depends on what the program accepts when you submit, on your sponsor and on how automated your evidence is. We build evidence that works for both and confirm the current rules at the start of every engagement.
Do we need an agency sponsor?
On the Rev5 agency path, yes. The 20x path has its own entry requirements, and we walk you through the version in force.
Can we reuse SOC 2 or ISO/IEC 27001 work?
Partly. FedRAMP adds FIPS-validated cryptography, a strict scanning cadence, inventory accuracy, federal incident reporting and monthly continuous monitoring.
Is GovRAMP the same as FedRAMP?
No. GovRAMP serves state, local, tribal and education buyers with its own statuses. It builds on Rev 5, so FedRAMP work carries across.
FedRAMP & GovRAMP
Find out how authorizable your service is today.
Send us your architecture, target agencies and timeline. A senior practitioner will come back with a clear view of your boundary and the gaps that matter most.