FISMA is a US law that requires federal agencies to run risk based information security programs. FedRAMP is a government program that standardizes how cloud services are assessed and authorized for agency use. FISMA sets the obligation on agencies. FedRAMP is one way agencies meet it for cloud products.
What is FISMA?
The Federal Information Security Management Act was passed in December 2002 as part of the E-Government Act (Public Law 107-347). NIST explains that it requires each federal agency to develop, document and implement an agency wide program to provide information security for the information and systems that support its operations and assets, including those provided or managed by another agency, a contractor or another source. The Federal Information Security Modernization Act of 2014 amended it, with changes that include less overall reporting and more emphasis on continuous monitoring.
NIST stresses that its suite of risk management standards is not a "FISMA compliance checklist." The NIST Risk Management Framework gives a seven step process: prepare, categorize, select controls from NIST SP 800-53, implement, assess, authorize and continuously monitor. Compliance with laws and directives is described as a byproduct of a risk based program.
What is FedRAMP?
FedRAMP is the Federal Risk and Authorization Management Program. Its website describes a Marketplace that lists cloud services, authorizing agencies and recognized assessors. Cloud providers that want agencies to use their services go through its process, with independent assessors testing the controls, and agencies reuse the results rather than each running its own full review. The program is modernizing its approach, and its site currently lists newer efforts under the name FedRAMP 20x, so read its current rules before planning.
How do they fit together?
Think of FISMA as the duty and FedRAMP as a shared way to discharge part of it.
An agency must authorize each system it operates before use, including systems run by contractors on its behalf. For a cloud service, doing that from scratch for every agency would be wasteful. FedRAMP provides a common set of requirements, built on NIST security controls, so one assessment supports many agency decisions. The agency still makes its own risk decision. A FedRAMP listing does not remove that responsibility.
Who has to care?
If you are a federal agency, FISMA applies to you directly. If you are a cloud vendor selling to agencies, FedRAMP is probably the gate, and your customers' FISMA duties flow down to you as contract requirements. If you are a contractor running a system on an agency's behalf, expect agency requirements tied to FISMA.
Constructed example: a note taking app
A SaaS note taking company wants a civilian agency as a customer. The agency says its security office needs the product to hold a FedRAMP authorization before storing any agency data. The vendor learns the work is mainly documenting and operating hundreds of controls, hiring an assessor and committing to continuous monitoring. The agency's obligation under FISMA is the reason for the request. FedRAMP is the route.
How do they compare side by side?
- Origin: FISMA is a statute. FedRAMP is a program run by the government.
- Subject: FISMA covers agency information systems. FedRAMP covers cloud services used by agencies.
- Output: FISMA yields agency programs and authorizations. FedRAMP yields assessed and listed services.
- Controls source: both lean on NIST publications, notably SP 800-53.
How to check or apply this
- Decide which side you are on: agency, contractor on an agency system, or cloud vendor.
- If you are a vendor, check the FedRAMP Marketplace for current status of your or your competitors' offerings and read the current rules on the program site.
- Map your controls to NIST SP 800-53 so the evidence can be reused.
- Plan for continuous monitoring, not a one time audit.
- Confirm the actual contract language for each agency customer.
Quick check
Is FedRAMP a law?
No. FISMA is the law. FedRAMP is a government program that supports agencies in meeting it for cloud services.
Does a FedRAMP listing mean an agency can skip its own review?
No. Agencies reuse the assessment but still make their own risk decision.
Sources
Last reviewed: 18 October 2026.
