What is a FedRAMP gap analysis?

A FedRAMP gap analysis is a review that compares how a company's cloud product handles security today against the requirements of FedRAMP, the U.S. government's security program for cloud software. The result is a list of the gaps between the two, ideally with an explanation of what it would take to close each one, so the company knows exactly what must change before its product can be certified for use by federal agencies.

How it works:

FedRAMP's requirements depend on which version of the program a company is pursuing (the newer FedRAMP 20X or the older Rev5) and which certification level, or class, it is aiming for. A gap analysis starts by gathering every requirement that applies to that combination. The company then compares those requirements with how its product, processes and documentation work today, and sorts out which things must actually change and which only need to be documented or reported. FedRAMP treats this comparison as the first step of the work toward certification.

Why it matters:

A company pursuing FedRAMP has to address hundreds of requirements, and many of them change how the company operates, not just what it writes down. As FedRAMP puts it, certification "is not simply writing about everything that already exists." The gaps a company finds can be technical, such as a missing security feature; procedural, such as a process that isn't followed consistently; or about documentation.

Where it fits:

A gap analysis comes after a company has chosen its version of FedRAMP and its class, and before it hires an independent assessor, a security firm that FedRAMP recognizes, to check the work. FedRAMP itself does not provide tools, guidance, advice or support for this stage; private companies offer those instead.

What a good one looks like:

A useful gap analysis goes beyond listing gaps: it also explains how to close each one. It should be thorough, quick enough to act on and affordable, and it should stay current as the product changes. It works best when it builds the team's own FedRAMP knowledge, rather than leaving that knowledge with an outside party.