Work out whether FedRAMP applies.

The use case comes first

FedRAMP applicability depends on an agency’s use of a cloud service, not simply on whether a company sells software. Official scope guidance addresses services handling federal information on an agency’s behalf and identifies exclusions. The agency determines whether the specific use case is in scope.

Make the scope concrete

• Describe who uses the service and which agency work it supports.
• Record the information created, collected, processed, stored or maintained.
• Sketch administrators, identity connections, integrations and data flows.
• Identify which party is responsible for each part of the service.
• List unanswered scope questions and take them to the agency.

Leave with a useful scope note

Create a one-page description of the use case and responsibilities. Distinguish observed facts from open questions and assign an owner to resolve each uncertainty. That note is a practical starting point for provider planning or agency review, not an official application.

Do this before setting a certification schedule. Otherwise, a precise-looking plan can be built on an offering boundary no one has agreed on.

Fund the right problem first

Resolve the buyer, use case and applicable requirement before purchasing assessment or consulting work. Compare a credible customer opportunity with the setup cost and the operating work it will require. A badge is not a business case.

Official sources

These sources support the guidance above. Verify current requirements with the official program before making a compliance decision.

1. FedRAMP scope and applicabilityFedRAMP, U.S. General Services Administration · Access checked 2026-11-04
2. DFARS 252.204-7012U.S. Department of Defense / Acquisition.gov · Access checked 2026-11-04