A FedRAMP gap analysis usually takes anywhere from a few weeks to several months. A gap analysis is a review of how far a company's cloud product is from meeting the requirements of FedRAMP, the U.S. government's security program for cloud software. How long it takes depends mostly on the approach and on how complex the product is: a company working through the requirements on its own, in a spreadsheet, often needs months, while an analysis led by a consultant typically involves several weeks of workshops and interviews.
What affects timing:
How long FedRAMP preparation takes "varies wildly" from one company to the next. The main factors are:
- How many engineers are available for governance, risk and compliance (GRC) work, the work of managing security risks and the rules the company follows
- How complex the product's infrastructure and systems are
- How mature the company's existing engineering and security programs are
- How much the product relies on outside cloud platforms or services that are not FedRAMP certified
- How much support the effort has from executives, especially in engineering and security
Making the time count:
Speed only helps if the analysis also explains how to close each gap. Otherwise, the time saved up front is lost to a second round of research once the team starts fixing things.
Related FedRAMP timeframes:
Other FedRAMP timelines come into play after the gap analysis. Once a product is listed on the FedRAMP Marketplace, FedRAMP's public online directory of cloud products, the company must schedule an independent assessment for Class B, C or D, the three higher of FedRAMP's four certification tiers, within two years of first being listed. Under FedRAMP 20X, the program's newer version, a Class B certification may be reachable within a few months. And once FedRAMP receives a company's application, it aims to make an initial decision within 30 days, though that is a goal rather than a guarantee.
Sources
Related Articles
- How do I know how far my company is from FedRAMP certification?
- Where do I start with FedRAMP 20X?
- What is a FedRAMP gap analysis?
- Is a FedRAMP gap analysis the same as a 3PAO readiness assessment?
- Can we run a FedRAMP gap analysis ourselves?
- What documents do we need to start a FedRAMP gap analysis?
- Who on our team should be involved in a FedRAMP gap analysis?
- How do we decide which FedRAMP gaps to fix first?
- How do I show leadership how close we are to FedRAMP certification?