How do we decide which FedRAMP gaps to fix first?

Fix gaps in the order FedRAMP's requirements build on one another, and within each stage, fix the mandatory requirements first. FedRAMP is the U.S. government's security program for cloud software, and its newer version, FedRAMP 20X, arranges its requirements in stages: first the rules that define what the product covers and how its information is shared, then a record of how the company meets each rule, then the rules for proving that its security holds up over time. Rules marked MUST carry the most weight, because failing one can lead to required corrective action or a denied certification.

The order of the work:

The first stage covers what FedRAMP calls the Boundary rules, which define exactly which systems are included and how the product's data is shared. While working through them, the company builds its Certification Package Overview, the summary document at the core of its FedRAMP application. A listing on the FedRAMP Marketplace, FedRAMP's public online directory of cloud products, comes early in this stage and requires certain public information about the product. Next comes the Security Decision Record, the company's record of how it meets each rule, which usually takes the most time, followed by the Assurance rules for proving security over time.

How strong each rule is

Rules that depend on the class:

FedRAMP 20X has four certification tiers, called classes, from Class A (the lightest) to Class D (the most demanding), and the requirements grow with each one. For example, Class A must address 23 mandatory rules, while Class C requires at least two automated ways of checking each Key Security Indicator, a measurable security outcome the company must show. Before it is first certified, a company must also show it is ready for the Ongoing Certification requirements, the rules for keeping a certification once it has been granted.

Keeping priorities useful:

A list of gaps helps most when each gap comes with a description of how to close it, so the effort involved and the right order are clear. Priorities also shift as the product changes, so an analysis that is kept current is more useful than a one-time snapshot.