If you’re aiming to sell your tech to the federal government, achieving FedRAMP In Process status is a critical milestone that shows your product or service is actively working through the complete FedRAMP authorization pipeline.
It means you’ve committed to submitting a complete authorization package, you’re working with a Third Party Assessment Organization (3PAO), and you’re partnered with a federal government agency that will “sponsor” you to get it done.
Some organizations first pursue FedRAMP Ready as a way to show intent and gain early visibility. Others move directly into the In Process phase once they’ve secured an agency sponsor that agrees to evaluate your system and, if successful, issue an Authority to Operate (ATO). Either way, this is where the hardest work begins.
FedRAMP In Process vs. FedRAMP Ready: What’s the difference?
FedRAMP Ready is an optional designation that signals your system has the foundational security elements in place. FedRAMP In Process means you’ve moved beyond readiness — you have a federal agency sponsor, a 3PAO engagement, and you’re actively building your complete authorization package. In Process demonstrates a serious commitment to federal compliance and differentiates you from competitors still in the Ready phase.
The FedRAMP approval process: What happens during In Process
Your system will be evaluated against the complete set of required FedRAMP security controls for your selected baseline — Low, Moderate, or High. Your team will need to fully implement and document:
The 3PAO will assess your implementation and gather evidence to support your authorization package — including your System Security Plan (SSP), security scanning and penetration test results, and risk analysis documentation.
You’ll also need to coordinate closely with your federal agency sponsor to address any findings, manage timelines, and finalize deliverables. This partnership is essential throughout the FedRAMP In Process phase.
How does the FedRAMP ATO process begin?
To gain official FedRAMP In Process designation, your sponsoring agency submits an In Process Request (IPR) letter to the FedRAMP Board formally confirming their partnership with your organization for initial FedRAMP Authorization. They also submit a Work Breakdown Structure (WBS) outlining project timelines.
Submission of the IPR and WBS is what triggers your listing as “FedRAMP In Process” on the FedRAMP Marketplace, and officially initiates the authorization process.
There’s no fixed time limit for how long you can be in the FedRAMP In Process phase, but timelines must be agreed upon between you and your government sponsoring agency.
Frequently Asked Questions
How long does FedRAMP In Process take?
There’s no fixed deadline, but most organizations spend several months in this phase. The timeline depends on the complexity of your system, the number of controls required, and how closely you coordinate with your agency sponsor and 3PAO.
What is the FedRAMP approval process?
The FedRAMP approval process involves implementing your required security controls, undergoing a 3PAO assessment, coordinating with your federal agency sponsor, and submitting a complete authorization package for review. Once accepted, your sponsor issues an Authority to Operate (ATO).
Do I need an agency sponsor for FedRAMP In Process?
Yes. A federal agency sponsor is required. They submit the In Process Request (IPR) letter and Work Breakdown Structure (WBS) that officially initiate your authorization and list your product on the FedRAMP Marketplace.