Compliance & Regulations/North America/FedRAMP HIGH
Sovereign / National · United States (Federal)

FedRAMP HIGH

Federal cloud authorisation for systems handling High-impact CUI and mission data.

Regulator
GSA / OMB / DoD / DHS Joint Authorization Board
Jurisdiction
United States (Federal)
Status
Active baseline (Rev 5).
In force since
2024 (Rev 5 baseline)
Regulator's source
Who it applies to

Cloud Service Offerings used by US federal agencies at the HIGH impact level.

Audit / certification status

Safeguard's hosted environment is FedRAMP Moderate authorised; HIGH authorisation is in 3PAO assessment.

What it requires

What FedRAMP HIGH actually requires.

These are the obligations a regulated entity owes — the things an assessor or supervisor will ask about.

01

421 controls drawn from NIST SP 800-53 Rev 5 tailored to High impact.

02

Continuous monitoring with monthly POA&M updates and quarterly vulnerability scans.

03

Third-Party Assessment Organization (3PAO) audit prior to authorisation.

04

FIPS 140-3 validated cryptography for data at rest and in transit.

05

US-citizen personnel screening and incident reporting to US-CERT within 1 hour for High events.

06

Supply chain risk management aligned to NIST SP 800-161 Rev 2.

How Safeguard maps to it

Pre-mapped controls. Continuous evidence.

Each requirement above is bound to live telemetry — not screenshots. The mapping below is what your auditor or regulator sees.

Each of the 421 controls is bound to one or more telemetry sources — scan output, attestation logs, policy verdicts.

Continuous evidence collection replaces the screenshot-sprint pattern most teams use the week before audit.

SBOMs are generated, signed, and stored for the lifetime of each release — meeting EO 14028 §4(e) inheritance.

Policy gates block deployments missing FIPS-mode crypto or unapproved cloud regions.

Pre-built crosswalks to CMMC L3, NIST 800-53, and DoD SRG IL5 mean one evidence base covers four downstream attestations.

Evidence we produce

Artifacts your auditor accepts.

Each evidence artifact is signed and timestamped. Auditors can verify integrity without trusting Safeguard.

POA&M (Plan of Action & Milestones) — auto-generated weekly with finding deltas.

Continuous monitoring report — monthly export in OSCAL format.

Signed SBOMs per release with provenance (in-toto + SLSA L3).

Vulnerability scan summary with CVSS, EPSS, and KEV-overlap tags.

Configuration baseline diff vs. NIST 800-53 Rev 5 baseline.

Incident timeline export for any US-CERT-reportable event.

Certification path

How you get there.

01

Readiness assessment (3PAO RAR)

02

Full Security Assessment (SAR + SSP)

03

Agency or JAB authorisation

04

Continuous monitoring lifecycle

Ready for FedRAMP HIGH?

Bring the framework. We'll walk the controls with you — section by section, evidence packet by evidence packet, with the regulators you actually have to answer to.

Safeguard | Software Supply Chain Security Platform | Zero CVE + Self-Healing